az10b 0072d3488a Fix permissive CORS policy that allows cross-origin attacks ... The on_prepare handler unconditionally reflected the Origin request header into Access-Control-Allow-Origin, and Socket.IO was configured with cors_allowed_origins='*'. This allowed any website to make authenticated cross-origin requests to all API endpoints, enabling cross-origin download initiation, cookie overwrite, and data deletion. Replace the blanket origin reflection with an explicit allowlist via the CORS_ALLOWED_ORIGINS environment variable. When unset, cross-origin requests are denied by default. Users who need cross-origin access can set CORS_ALLOWED_ORIGINS to a comma-separated list of trusted origins.		2026-04-09 19:45:51 -05:00
..
tests	fix: parse string boolean values when updating subscriptions	2026-04-05 14:05:59 +08:00
dl_formats.py	code review fixes	2026-03-15 20:53:13 +02:00
main.py	Fix permissive CORS policy that allows cross-origin attacks	2026-04-09 19:45:51 -05:00
state_store.py	add subscriptions; change persistence file format to JSON (closes #901, #76, #113, #170, #242, #444, #503, #555, #566)	2026-04-01 14:33:24 +03:00
subscriptions.py	fix: handle playlists that don't supply video ids	2026-04-09 10:15:11 -05:00
ytdl.py	fix: handle playlists that don't supply video ids	2026-04-09 10:15:11 -05:00