jellyfin/Jellyfin.Server.Implementations/Users/UserManager.cs, branch v12.0-rc3Unnamed repository; edit this file 'description' to name the repository.
https://git.b0n.dev/jellyfin/atom?h=v12.0-rc32026-07-21T12:30:55ZApply review suggestions2026-07-21T12:30:55ZShadowghostGhost_of_Stone@web.de2026-07-21T12:30:55Zurn:sha1:4cc69f4be0a568ebc8c922dcf1f855458755ad85Merge remote-tracking branch 'upstream/master' into security-path-traversal-fixes2026-07-21T05:14:47ZShadowghostGhost_of_Stone@web.de2026-07-21T05:14:47Zurn:sha1:b99703301f43927f632bbc49d040a32824d43cb3
# Conflicts:
# Jellyfin.Api/Controllers/HlsSegmentController.cs
# Jellyfin.Api/Controllers/PluginsController.cs
Merge pull request #17282 from TowyTowy/fix/13137-clear-profile-image2026-07-20T23:58:43ZCody Robiberocody@robibe.ro2026-07-20T23:58:43Zurn:sha1:23fa02eb59519cdc4c2b15b9778ef006b5e85341
Fix profile image being impossible to clear when its in-memory key is temporaryMerge pull request #17302 from ElianCodes/fix/lastlogindate-stale-entity2026-07-20T06:36:53ZBond-009bond.009@outlook.com2026-07-20T06:36:53Zurn:sha1:aead9c0e229534296c7cc61d0b1850e602189178
Keep authenticated user entity in sync with persisted login timestampsHarden remaining path-construction sinks against traversal2026-07-17T15:08:59ZShadowghostGhost_of_Stone@web.de2026-07-17T14:51:19Zurn:sha1:21801e8ba138af71c4c58489ea33534adf7426c5Keep authenticated user entity in sync with persisted login timestamps2026-07-11T12:04:07ZElian Van Cutsemhello@elian.codes2026-07-11T12:04:07Zurn:sha1:47f567b6f1ad9729ad3721a5798cab03978300f5
ExecuteUpdateAsync bypasses the EF change tracker, so the user entity
returned by AuthenticateUser still carried the old LastLoginDate and
LastActivityDate. SessionManager.LogSessionActivity then saved that
stale entity in full, reverting LastLoginDate (usually to null)
milliseconds after every login. Setting the properties on the entity
keeps the follow-up save consistent and lets the 60-second activity
guard skip the redundant write during login.
Fixes #17301
Fix profile image being impossible to clear when its in-memory key is temporary2026-07-09T11:39:09ZTowyTowytowy@airreps.link2026-07-09T11:39:09Zurn:sha1:2326ecdedc042f7f1c2ce2a5da409377c09778d7
ClearProfileImageAsync removed the ProfileImage instance attached to the
passed-in User, but that instance can carry a stale, never-persisted
(temporary) key because UpdateUserAsync creates the persisted image on a
separately loaded entity and never copies the generated key back.
Removing that detached entity on a fresh DbContext made EF Core throw
InvalidOperationException ('ImageInfo.Id has a temporary value'), leaving
the profile image impossible to delete or replace.
Load the tracked, persisted user and remove its actual ProfileImage,
matching the removal pattern already used in UpdateUserAsync. Adds
regression tests covering the temporary-key case and the no-image no-op
(the first fails before this change and passes after).
Fixes #13137
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Fix max login attempts2026-07-09T03:07:57Ztheguymadmaxtheguymadmax@proton.me2026-07-09T03:07:57Zurn:sha1:8b826d981bcfec22063d6008e38016f4b77790d0Allow changing capitalization of usernames2026-07-03T16:33:10ZBond_009bond.009@outlook.com2026-07-03T16:33:10Zurn:sha1:482cf4b8c3e78463b61cac01c0f3a38fe2045a5c
Fixes #17195
Adds a regression test
Backport pull request #16944 from jellyfin/release-10.11.z2026-06-07T18:29:36ZJPVensongithub@jpb.email2026-06-07T18:29:36Zurn:sha1:6ccdaad0a47351d30cfde39c7470ae26bb6f7567
Add lockhelper for UserManager
Original-merge: 39958ad9e51f83f520803aa9bc5e70e58f3a0836
Merged-by: Bond-009 <bond.009@outlook.com>
Backported-by: Bond_009 <bond.009@outlook.com>