Selfhosted

60426 readers

248 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

Detailed Rules Post

Be civil.
No spam.
Posts are to be related to self-hosting.
Don't duplicate the full text of your blog or readme if you're providing a link.
Submission headline should match the article title.
No trolling.
Promotion posts require active participation, with an account that is at least 30 days old. F/LOSS without a paywall has exceptions, with requirements. See the rules link for details.

Resources:

selfh.st Newsletter and index of selfhosted software and apps
awesome-selfhosted software
awesome-sysadmin resources
Self-Hosted Podcast from Jupiter Broadcasting

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 3 years ago

MODERATORS

curbstickle@anarchist.nexus

curbstickle_lw@lemmy.world

747

Plex’s price hikes prove I was right to switch to Jellyfin (www.androidauthority.com)

submitted 1 month ago by KatherinaReichelt@feddit.org to c/selfhosted@lemmy.world

336 comments fedilink hide all child comments

you are viewing a single comment's thread
view the rest of the comments

[–] maxprime@lemmy.ml 0 points 1 month ago (1 children)

All (raw) image endpoints in ImageByNameController, ImageController & RemoteImageController are unauthenticated

This allows probing on whether a specific image exists on the server by guessing item id's (which can be done without too much trouble, as item ids are based on filepath and filename information) and then checking on what content (movies, series etc) exist on a given server, without having an account.

[–] ShortN0te@lemmy.ml 1 points 1 month ago

As I said, when you know the exact path of a media item on the server then you can check if the item exists.

If you choose a none standard filepath its not an issue.

Should that be fixed yes.

Whats the scenario? A law firm could brute force check all media items on open jellyfin servers? Highly illegal to exploit something like this in a lot of jurisdiction. And would also not proof the existence of the media on the server, just a file named like it.

Mitigation? Just add another random letter in the docker-compose mount path.