Josh HawkinsandGitHub 33cb8d987d pass only the request path in X-Original-URL (#24602) ...

nginx built X-Original-URL from the client's Host header plus the request path, so a Host containing '#' or '?' pushed the real path into the URL fragment or query. The media and go2rtc auth checks then saw an empty path and allowed restricted-role users to read other cameras' clips, recordings, exports and live streams. The header now carries only $request_uri, which is all the auth checks need.

2026-10-09 07:44:53 -05:00

..

ffmpeg

Upgrade ffmpeg to 8 by default (#23393)

2026-06-03 12:28:28 -05:00

go2rtc

Miscellaneous fixes (#23610)

2026-07-01 15:03:34 -05:00

nginx

pass only the request path in X-Original-URL (#24602)

2026-10-09 07:44:53 -05:00