v1.9.1 - Security Update for jellyfin-web

[iwalton3]

This release is primarily to get the updated jellyfin-web to correct the stored XSS vulnerability GHSA-89hp-h43h-r5pq. While JMP is not vulnerable to most XSS vulnerabilities due to being an isolated application, this one could affect it.

Changes:

• Update web client to 10.8.10 to patch stored XSS issue.
• Skip searching for SSL bundles on Linux. (Flatpak Playback Failed #301)
• Disallow flac from video transcoding. (Jellyfin Windows Client no audio when original audio codec was FLAC and when the video is transcoded #423)
• Allow disabling dovi transcode rule.
• Fix missing port in translation. (Only Windows clients unable to connect to server. #288)
• Censor token from new stored creds block.

If you have issues with media playback due to hardware decoding (green/purple or artifacts), you can disable it using these instructions.

About Windows Downloads:

• The desktop installer requires administrator rights.
• You can avoid warnings on files by unblocking the file in the properties dialog.
• You can manually build a release using these instructions.

---

This discussion was created from the release v1.9.0 - Security Update for jellyfin-web.

[khakers]

was this (and the release) intended to be titled as v1.9.1?

[DetermineAbsurd]

Yes. It's a series of bugfixes without making breaking API changes or feature changes, so it iterates on the third number, following SemVer spec.

[khakers]

It was originally titled as v1.9.0, thus the comment

[loa111]

How to make this version working on windows 7 64bit? Its crashing upon starting
Problem signature:
Problem Event Name: APPCRASH
Application Name: JellyfinMediaPlayer.exe
Application Version: 0.0.0.0
Application Timestamp: 64456915
Fault Module Name: JellyfinMediaPlayer.exe
Fault Module Version: 0.0.0.0
Fault Module Timestamp: 64456915
Exception Code: c0000005
Exception Offset: 000000000008b4a4
OS Version: 6.1.7601.2.1.0.256.1
Locale ID: 2057
Additional Information 1: 82b3
Additional Information 2: 82b3e699ff0b75ecdd21f5ddf7598d13
Additional Information 3: e0ba
Additional Information 4: e0ba5b46cd10e052f94cf37e3d0692df

[iwalton3]

Sorry, but I don't support Windows 7. It's been end of life for a few years now so I highly encourage updating to protect from security threats. I believe the update to Windows 10 is still free.

[loa111]

I hate windows 10 and windows 11 is like my arch nemesis.

[iwalton3]

You can use the program O&O Shutup 10 to clean up a lot of the nonsense in Windows 10. There are other, more questionable cleanup scripts too. The security impacts of using an unsupported OS are serious and will only get worse. Linux and Mac OS are also supported by JMP.

[loa111]

Testing it on the win10 which I will not use, because its one awful system, but where are subtitle options like subtitle position and colors, also where is the audio delay like on the android version.
Also I remember that earlier few years ago, that there was an option like on the plex player to set large cache size?
Its seems this Windows Desktop version is just basic player without controls.
This is the first time to see that desktop application is marginal and tv application full of features. Why is that?

[iwalton3]

All of these options are under the "Client Settings" menu. JMP embeds Jellyfin Web which currently has limited ability to expose additional capabilities outside of settings.

[loa111]

As you can see noting is available on the desktop version, could you explain how could I make custom css to enable subtitle position and subtitles colors?

[iwalton3]

It's under "Client Settings" not "Subtitles". You can also use MPV styling via the mpv.conf if you want more control.

[loa111]

Ok I found, there is cache option and subs color, t but you cant move it like on android or web version with option vertical position -3,-4 ,-5 you were the only one who have it, on fully supported versions and on the web version, Its one of the most important options and now huge number of users will come in because they are abandoning plex.

[loa111]

Ok I found in config section
},
"subtitles": {
"color": "#EEEEEE,#000000",
"placement": "center,bottom",
"size": 32

I presume that I would need to move with the padding position like
"placement": "center,bottom", padding-bottom: 50px;
But with every start jellyfinmediaplayer.conf will restart option for any changes that I would make, even the documented changes.

[loa111]

It's under "Client Settings" not "Subtitles". You can also use MPV styling via the mpv.conf if you want more control.

I tried to use mpv.conf by adding
sub-pos = 95 or sub-pos = 55

Everything is ignored, it seems mpv.conf is not used by JMP
Maybe I'm missing some cofing option which instructs JMP to use mpv.conf

Also I remember in plex when changing the main config file that its always reverting back to default as I'm seeing same behavior with the jellyfinmediaplayer.conf.
Why is that?

is there some detailed documentation how to use mpy.conf?

[iwalton3]

Subtitle position is controlled by JMP and cannot be set through mpv.conf. (It gets overriden.)

[loa111]

Could you make JMP version which would have vertical position -4 and -5, bottom position is awful.

[mclmt-owo]

Which file should I use for Ubuntu Mantic (23.10)? Using jellyfin-media-player_1.9.1-1_amd64-kinetic.deb throws a bunch of dependency errors for libmpv.