jvoisin 387678a771 Prevent OAuth relinking. ...

When an OAuth provider_user_id is already linked to User A, and User B
authenticates with the same OAuth identity, User B is silently logged in as
User A. This is by design for single-user OAuth, but in a multi-user
environment it means: if an attacker gains access to the same OAuth provider
account (e.g., a shared GitHub org account, or by compromising the OAuth
provider), they can log in as the linked Calibre-Web user with no password
needed.

2026-04-14 22:28:06 +02:00

..

cw_advocate

Fix error in requirements.txt

2024-11-04 21:20:34 +01:00

cw_login

Generate valid session-cookie-path(s) (fix for #3459)

2026-01-18 15:38:44 +01:00

metadata_provider

Caliblur theme display fix

2025-12-04 18:52:30 +01:00

services

Updated testresults

2025-11-22 15:06:40 +01:00

static

Merge remote-tracking branch 'add-to-shelves-dropdown-menu/add-to-shelves-dropdown-menu'

2026-02-21 09:43:50 +01:00

tasks

Fix traceback encoding

2025-04-12 03:59:32 +08:00

templates

Better error handling on series display in basic view

2026-04-06 15:28:10 +02:00

translations

Merge remote-tracking branch 'it/patch-1'

2026-03-07 09:28:14 +01:00

__init__.py

Update translation

2026-02-14 11:30:50 +01:00

about.py

Improved dep check for windows exe version and further fixes for windows exe

2024-11-18 19:47:33 +01:00

admin.py

Better error handling on order parameter for sorting of user and books table

2026-04-06 15:12:09 +02:00

audio.py

Fixes for parallel upload (coverfiles get individual temporary names)

2024-11-30 09:45:46 +01:00

basic.py

Better error handling on series display in basic view

2026-04-06 15:28:10 +02:00

cache_buster.py

…

clean_html.py

Clean strings in comments before displaying

2026-04-03 09:01:01 +02:00

cli.py

Simplified version string

2024-09-07 20:07:45 +02:00

comic.py

Sort names before trying to extract coverfile of comics

2025-12-04 14:19:58 +01:00

config_sql.py

Merge remote-tracking branch 'sort/master'

2026-02-21 09:27:04 +01:00

constants.py

Cover path is now selected based on correct setting and not if split_path is present or not (fix for #3527)

2026-02-08 12:12:34 +01:00

converter.py

…

cover.py

Transform color space to srgb instead of rgb to prevent dark images

2025-01-05 01:49:46 +01:00

cw_babel.py

List locale alphabetically

2025-03-23 09:18:48 +01:00

db.py

Merge remote-tracking branch 'page_count/fix-series-list-view-sorts-by-name-instead-of-sort-field'

2026-03-07 10:24:58 +01:00

debug_info.py

Improved dep check for windows exe version and further fixes for windows exe

2024-11-18 19:47:33 +01:00

dep_check.py

Improved dep check for windows exe version and further fixes for windows exe

2024-11-18 19:47:33 +01:00

editbooks.py

Merge remote-tracking branch 'page_count/fix-series-list-view-sorts-by-name-instead-of-sort-field'

2026-03-07 10:24:58 +01:00

embed_helper.py

Fix for #3131 (Enable/Disable "Separate Book Files from Library" issue)

2024-08-23 10:51:37 +02:00

epub_helper.py

Code cosmetics

2024-06-20 19:12:46 +02:00

epub.py

Add UniDecodeError to catched errors during kobo sync check layout

2025-03-23 08:41:18 +01:00

error_handler.py

Update translation

2026-02-14 11:30:50 +01:00

fb2.py

…

file_helper.py

Added logging of ip address (#3237)

2024-12-07 07:27:00 +01:00

fs.py

Rename CACHE_DIR env var to CACHE_DIRECTORY (#3343)

2025-04-01 01:13:45 -07:00

gdrive.py

proxy login is now no longer saving cookies,

2024-07-14 16:24:07 +02:00

gdriveutils.py

Enabled covers with gdrive

2024-07-02 20:53:08 +02:00

gevent_wsgi.py

Log Forwarded for address in accesslog instead of client address for gevent

2024-07-08 14:42:48 +02:00

helper.py

fix: support native UTF-8 downloaded filenames for browsers

2026-02-20 23:07:06 +08:00

iso_language_names.py

Merge remote-tracking branch 'arabic/add-arabic-translation'

2025-06-29 09:46:23 +02:00

isoLanguages.py

Merge branch 'Develop' - Improved compability for python 3.12+

2024-11-02 16:59:19 +01:00

jinjia.py

Clean strings in comments before displaying

2026-04-03 09:01:01 +02:00

kobo_auth.py

Better Fix for flask limiter 4.0

2026-02-18 19:11:38 +01:00

kobo_sync_status.py

Update mass edit

2024-12-13 18:03:14 +01:00

kobo.py

Kobo: include PriorityTimestamp in PUT /state response

2026-03-01 18:19:40 -06:00

logger.py

Updates dependencies

2025-03-23 15:12:06 +01:00

main.py

Fix AttributeError on unauthenticated OPDS requests

2026-02-21 16:54:14 -06:00

MyLoginManager.py

Removed unused imports

2024-07-29 20:08:17 +02:00

oauth_bb.py

Prevent OAuth relinking.

2026-04-14 22:28:06 +02:00

oauth.py

Python 3.13 compatibility

2025-03-30 12:03:12 +02:00

opds.py

Remove debug code

2025-12-20 13:22:20 +01:00

pagination.py

…

redirect.py

Updated testresults

2025-11-22 15:06:40 +01:00

remotelogin.py

proxy login is now no longer saving cookies,

2024-07-14 16:24:07 +02:00

render_template.py

Remove Get Parameter sort_param, where it is not valid (#3447)

2026-01-18 16:07:04 +01:00

reverseproxy.py

Generate valid session-cookie-path(s) (fix for #3459)

2026-01-18 15:38:44 +01:00

schedule.py

Clean expired sessions (also old sessions without expiry date)

2024-07-17 20:05:51 +02:00

search_metadata.py

Update search_metadata.py

2026-03-01 15:44:29 +01:00

search.py

Merge remote-tracking branch 'page_count/fix-series-list-view-sorts-by-name-instead-of-sort-field'

2026-03-07 10:24:58 +01:00

server.py

add console process interruption by ctrl C

2025-10-26 21:28:58 +01:00

shelf.py

Fix for #3520 (Mass remove books from shelf)

2026-01-18 12:59:40 +01:00

string_helper.py

Marked 2 strings as raw strings to suppress warnings

2024-10-25 14:18:22 +02:00

subproc_wrapper.py

…

tasks_status.py

Added error message to task list

2024-08-02 18:08:18 +02:00

tornado_wsgi.py

Log Forwarded for address in accesslog instead of client address for tornado

2024-07-08 15:04:53 +02:00

ub.py

Python 3.13 compatibility

2025-03-30 12:03:12 +02:00

updater.py

Fix for stable update version

2024-11-11 18:46:07 +01:00

uploader.py

Fixes for parallel upload (coverfiles get individual temporary names)

2024-11-30 09:45:46 +01:00

usermanagement.py

Fix for flask limiter 4.0

2026-02-18 18:59:29 +01:00

web.py

Better error handling on order parameter for sorting of user and books table

2026-04-06 15:12:09 +02:00