az10b 636fc7ce6e Block dangerous yt-dlp options in ytdl_options_overrides ... When ALLOW_YTDL_OPTIONS_OVERRIDES is enabled, arbitrary yt-dlp options are accepted and passed directly to yt-dlp without restriction. This allows injection of the Exec postprocessor or exec_cmd option, which executes arbitrary OS commands on the server after a download completes. Add a blocklist of dangerous yt-dlp option keys (exec_cmd, exec, postprocessors, post_hooks, external_downloader, external_downloader_args, cookiefile, cookiesfrombrowser) that are rejected with a 400 error when present in overrides.		2026-04-09 19:47:24 -05:00
..
tests	fix: parse string boolean values when updating subscriptions	2026-04-05 14:05:59 +08:00
dl_formats.py	code review fixes	2026-03-15 20:53:13 +02:00
main.py	Block dangerous yt-dlp options in ytdl_options_overrides	2026-04-09 19:47:24 -05:00
state_store.py	add subscriptions; change persistence file format to JSON (closes #901, #76, #113, #170, #242, #444, #503, #555, #566)	2026-04-01 14:33:24 +03:00
subscriptions.py	fix: handle playlists that don't supply video ids	2026-04-09 10:15:11 -05:00
ytdl.py	fix: handle playlists that don't supply video ids	2026-04-09 10:15:11 -05:00