10 Commits

Author SHA1 Message Date
Joseph Milazzo
88b5ebeb69
Security Hotfix (#1415)
* Updated ngx-extended-pdf-viewer to 14.5.2 + misc security vuln

* Hooked up remove from want to read AND fixed a bug in the logic that was removing everything BUT what was passed.

Allow for bookmarks to have date info for better ordering.

* Implemented a quick way to set darkneses level on manga reader for when nightlight just isn't dark enough

* Added Japanese Series name support in the Parser

* Updated our security file with our Huntr.

* Fixed a security vulnerability where through the API, an unauthorized user could delete/modify reading lists that did not belong to them.

Fixed a bug where when creating a reading list with the name of another users, the API would throw an exception (but reading list would still get created)

* Ensure all reading list apis are authorized

* Ensured all APIs require authentication, except those that explicitly don't. All APIs are default requiring Authentication.

Fixed a security vulnerability which would allow a user to take over an admin account.

* Fixed a bug where cover-upload would accept filenames that were not expected.

* Explicitly check that a user has access to the pdf file before we serve it back.

* Enabled lock out when invalid user auth occurs. After 5 invalid auths, the user account will be locked out for 10 mins.
2022-08-08 13:47:37 -07:00
Joseph Milazzo
2ab0aedd22
Swagger, Tachiyomi, and some new settings (#1331)
* Fixed up swagger generation

* Updated Tachiyomi's latest-chapter to hopefully solve some sync issues.

* Fixed #1279 with table of contents due to new EPubReader

* When errors occur, show the event widget icon in red

* Lots of documentation added and tweaked some wording around backups and swagger

* For promidius

* Return proper ChapterDTO

* Hacks for Promidius

* Cleanup code

* No loose leaf, send max chapter

* One more encode change

* Implemented code per promiduius' requirements

* Fixed a bug in the epub parsing where even if you had a series index and series group, but didn't have the series in the title, Kavita wouldn't group them properly.

* Removed some extra comment

* Implemented the ability to change a library's type after it's been setup. This displays a warning explaining the dangers of it.

* Removed some whitespace

* Blur descriptions based on read status for list item view to avoid spoilers

* Tweaked placement of a tooltip due to new series detail styles

* Hooked up a user preference for bluring unread summaries. Fixed a bug in refresh token where we would cause re-authentication when it shouldn't be needed.
2022-06-25 15:52:21 -07:00
Joseph Milazzo
1050fa4e54 Ability to update settings. Take effect on next reboot. 2021-02-04 16:49:48 -06:00
Joseph Milazzo
fa71a40990 Fixed warnings in code 2021-01-01 14:18:29 -06:00
Joseph Milazzo
8c80ed090d Added basic parsing and unit tests. Setting up an intermediate object to hold information from parser. Removed hangfire db from git. 2020-12-27 11:14:45 -06:00
Joseph Milazzo
4fd9943b91 Added Hangfire with LiteDB for a task running system. At the most basic, this allows us to monitor tasks running on the system (during dev only) and run tasks on a reoccuring or ad-hoc basis. 2020-12-26 14:03:35 -06:00
Joseph Milazzo
a40bc9e9f7 Added Policy for getUsers and moved some APIs. 2020-12-24 10:13:22 -06:00
Joseph Milazzo
f0919042b0 Added a new policy to require being an admin. Implemented ability to delete a user. 2020-12-24 08:13:58 -06:00
Joseph Milazzo
bb276a5984 Some changes to get register/login flow working smoothly with Admin role. 2020-12-22 17:28:38 -06:00
Andrew Song
f8d7581a12 adding admin exists api 2020-12-20 18:32:24 -06:00