Josh HawkinsandGitHub 33cb8d987d pass only the request path in X-Original-URL (#24602) ...

nginx built X-Original-URL from the client's Host header plus the request path, so a Host containing '#' or '?' pushed the real path into the URL fragment or query. The media and go2rtc auth checks then saw an empty path and allowed restricted-role users to read other cameras' clips, recordings, exports and live streams. The header now carries only $request_uri, which is all the auth checks need.

2026-10-09 07:44:53 -05:00

..

hailo8l

Update hailo installation instructions and script (#21882)

2026-02-05 06:38:34 -07:00

main

pass only the request path in X-Original-URL (#24602)

2026-10-09 07:44:53 -05:00

memryx

update installation code to hold SDK 2.1 version (#20781)

2025-11-03 13:23:51 -07:00

rockchip

Increase ruff coverage (#23644)

2026-07-06 12:28:02 -05:00

rocm

ROCm Optimizations (#23118)

2026-05-05 16:33:43 -05:00

rpi

Improve ffmpeg versions handling (#16712)

2025-02-20 18:07:41 -07:00

synaptics

[Init] Initial commit for Synaptics SL1680 NPU (#19680)

2025-09-26 07:07:12 -05:00

tensorrt

Slightly downgrade CUDA version to fix overaggressive BFC (#22589)

2026-03-23 08:13:32 -06:00