From 6a52d2a96844d0e53043ceaf14fe05a3a507c52f Mon Sep 17 00:00:00 2001
From: Vito0912 <86927734+Vito0912@users.noreply.github.com>
Date: Sun, 3 Aug 2025 13:52:58 +0200
Subject: [PATCH 1/7] CORS

---
 client/pages/config/index.vue             | 25 +++++++++++++++++++++++
 server/Server.js                          |  4 ++--
 server/objects/settings/ServerSettings.js |  3 +++
 3 files changed, 30 insertions(+), 2 deletions(-)

diff --git a/client/pages/config/index.vue b/client/pages/config/index.vue
index 7083c789..0a885854 100644
--- a/client/pages/config/index.vue
+++ b/client/pages/config/index.vue
@@ -144,6 +144,10 @@
             <ui-dropdown :label="$strings.LabelLanguageDefaultServer" ref="langDropdown" v-model="newServerSettings.language" :items="$languageCodeOptions" small class="max-w-52" @input="updateServerLanguage" />
           </div>
 
+          <div class="py-2">
+            <ui-multi-select v-model="newServerSettings.allowedOrigins" :items="newServerSettings.allowedOrigins" label="Allowed Cors" class="max-w-52" @input="updateCorsOrigins" />
+          </div>
+
           <!-- old experimental features -->
           <!-- <div class="pt-4">
             <h2 class="font-semibold">{{ $strings.HeaderSettingsExperimental }}</h2>
@@ -323,6 +327,26 @@ export default {
     updateServerLanguage(val) {
       this.updateSettingsKey('language', val)
     },
+    updateCorsOrigins(val) {
+      const containsInvalid = val.some((origin) => {
+        try {
+          new URL(origin)
+          return false
+        } catch {
+          return true
+        }
+      })
+
+      if (containsInvalid) {
+        this.$toast.error('Invalid CORS origin')
+        this.newServerSettings.allowedOrigins = val.map((origin) => origin.trim().toLowerCase())
+        return
+      }
+
+      this.newServerSettings.allowedOrigins = val.map((origin) => origin.trim().toLowerCase())
+
+      this.updateSettingsKey('allowedOrigins', this.newServerSettings.allowedOrigins)
+    },
     updateSettingsKey(key, val) {
       if (key === 'scannerDisableWatcher') {
         this.newServerSettings.scannerDisableWatcher = val
@@ -352,6 +376,7 @@ export default {
     initServerSettings() {
       this.newServerSettings = this.serverSettings ? { ...this.serverSettings } : {}
       this.newServerSettings.sortingPrefixes = [...(this.newServerSettings.sortingPrefixes || [])]
+      this.newServerSettings.allowedOrigins = [...(this.newServerSettings.allowedOrigins || [])]
       this.scannerEnableWatcher = !this.newServerSettings.scannerDisableWatcher
 
       this.homepageUseBookshelfView = this.newServerSettings.homeBookshelfView != this.$constants.BookshelfView.DETAIL
diff --git a/server/Server.js b/server/Server.js
index 1a8db406..a384b93c 100644
--- a/server/Server.js
+++ b/server/Server.js
@@ -240,8 +240,8 @@ class Server {
        * Running in development allows cors to allow testing the mobile apps in the browser
        * or env variable ALLOW_CORS = '1'
        */
-      if (global.AllowCors || Logger.isDev || req.path.match(/\/api\/items\/([a-z0-9-]{36})\/(ebook|cover)(\/[0-9]+)?/)) {
-        const allowedOrigins = ['capacitor://localhost', 'http://localhost']
+      if (global.AllowCors || Logger.isDev || req.path.match(/\/api\/items\/([a-z0-9-]{36})\/(ebook|cover)(\/[0-9]+)?/) || global.ServerSettings.allowedOrigins?.length) {
+        const allowedOrigins = ['capacitor://localhost', 'http://localhost', ...(global.ServerSettings.allowedOrigins ? global.ServerSettings.allowedOrigins : [])]
         if (global.AllowCors || Logger.isDev || allowedOrigins.some((o) => o === req.get('origin'))) {
           res.header('Access-Control-Allow-Origin', req.get('origin'))
           res.header('Access-Control-Allow-Methods', 'GET, POST, PATCH, PUT, DELETE, OPTIONS')
diff --git a/server/objects/settings/ServerSettings.js b/server/objects/settings/ServerSettings.js
index 4f0aa97b..a03e17c7 100644
--- a/server/objects/settings/ServerSettings.js
+++ b/server/objects/settings/ServerSettings.js
@@ -53,6 +53,7 @@ class ServerSettings {
     this.dateFormat = 'MM/dd/yyyy'
     this.timeFormat = 'HH:mm'
     this.language = 'en-us'
+    this.allowedOrigins = []
 
     this.logLevel = Logger.logLevel
 
@@ -120,6 +121,7 @@ class ServerSettings {
     this.dateFormat = settings.dateFormat || 'MM/dd/yyyy'
     this.timeFormat = settings.timeFormat || 'HH:mm'
     this.language = settings.language || 'en-us'
+    this.allowedOrigins = settings.allowedOrigins || []
     this.logLevel = settings.logLevel || Logger.logLevel
     this.version = settings.version || null
     this.buildNumber = settings.buildNumber || 0 // Added v2.4.5
@@ -231,6 +233,7 @@ class ServerSettings {
       dateFormat: this.dateFormat,
       timeFormat: this.timeFormat,
       language: this.language,
+      allowedOrigins: this.allowedOrigins,
       logLevel: this.logLevel,
       version: this.version,
       buildNumber: this.buildNumber,

From af67c2e86f9659a37dced10311d5f17add278aac Mon Sep 17 00:00:00 2001
From: Vito0912 <86927734+Vito0912@users.noreply.github.com>
Date: Sun, 3 Aug 2025 13:57:44 +0200
Subject: [PATCH 2/7] locale

---
 client/pages/config/index.vue | 4 ++--
 client/strings/en-us.json     | 2 ++
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/client/pages/config/index.vue b/client/pages/config/index.vue
index 0a885854..fdc811c1 100644
--- a/client/pages/config/index.vue
+++ b/client/pages/config/index.vue
@@ -145,7 +145,7 @@
           </div>
 
           <div class="py-2">
-            <ui-multi-select v-model="newServerSettings.allowedOrigins" :items="newServerSettings.allowedOrigins" label="Allowed Cors" class="max-w-52" @input="updateCorsOrigins" />
+            <ui-multi-select v-model="newServerSettings.allowedOrigins" :items="newServerSettings.allowedOrigins" :label="$strings.LabelCorsAllowed" class="max-w-52" @input="updateCorsOrigins" />
           </div>
 
           <!-- old experimental features -->
@@ -338,7 +338,7 @@ export default {
       })
 
       if (containsInvalid) {
-        this.$toast.error('Invalid CORS origin')
+        this.$toast.error(this.$strings.ToastInvalidUrls)
         this.newServerSettings.allowedOrigins = val.map((origin) => origin.trim().toLowerCase())
         return
       }
diff --git a/client/strings/en-us.json b/client/strings/en-us.json
index f31a8a1d..d5e57847 100644
--- a/client/strings/en-us.json
+++ b/client/strings/en-us.json
@@ -293,6 +293,7 @@
   "LabelContinueListening": "Continue Listening",
   "LabelContinueReading": "Continue Reading",
   "LabelContinueSeries": "Continue Series",
+  "LabelCorsAllowed": "Allowed CORS",
   "LabelCover": "Cover",
   "LabelCoverImageURL": "Cover Image URL",
   "LabelCoverProvider": "Cover Provider",
@@ -1034,6 +1035,7 @@
   "ToastInvalidImageUrl": "Invalid image URL",
   "ToastInvalidMaxEpisodesToDownload": "Invalid max episodes to download",
   "ToastInvalidUrl": "Invalid URL",
+  "ToastInvalidUrls": "One or more URLs are invalid",
   "ToastItemCoverUpdateSuccess": "Item cover updated",
   "ToastItemDeletedFailed": "Failed to delete item",
   "ToastItemDeletedSuccess": "Deleted item",

From e408070b19c0f6aacb436cd639e76f46603a6e0e Mon Sep 17 00:00:00 2001
From: Vito0912 <86927734+Vito0912@users.noreply.github.com>
Date: Sun, 3 Aug 2025 14:02:33 +0200
Subject: [PATCH 3/7] better heading

---
 client/strings/en-us.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/client/strings/en-us.json b/client/strings/en-us.json
index d5e57847..9b97d727 100644
--- a/client/strings/en-us.json
+++ b/client/strings/en-us.json
@@ -293,7 +293,7 @@
   "LabelContinueListening": "Continue Listening",
   "LabelContinueReading": "Continue Reading",
   "LabelContinueSeries": "Continue Series",
-  "LabelCorsAllowed": "Allowed CORS",
+  "LabelCorsAllowed": "Allowed CORS Origins",
   "LabelCover": "Cover",
   "LabelCoverImageURL": "Cover Image URL",
   "LabelCoverProvider": "Cover Provider",

From 1097de6f1fdfaa78c8e9105c1cb7efd1e352a2e9 Mon Sep 17 00:00:00 2001
From: Vito0912 <86927734+Vito0912@users.noreply.github.com>
Date: Mon, 4 Aug 2025 19:17:46 +0200
Subject: [PATCH 4/7] now updates the input field

---
 client/pages/config/index.vue | 21 +++++++++++----------
 1 file changed, 11 insertions(+), 10 deletions(-)

diff --git a/client/pages/config/index.vue b/client/pages/config/index.vue
index fdc811c1..8796d52a 100644
--- a/client/pages/config/index.vue
+++ b/client/pages/config/index.vue
@@ -328,24 +328,25 @@ export default {
       this.updateSettingsKey('language', val)
     },
     updateCorsOrigins(val) {
-      const containsInvalid = val.some((origin) => {
+      const validOrigins = []
+      const invalidOrigins = []
+
+      val.forEach((origin) => {
+        const trimmedOrigin = origin.trim().toLowerCase()
         try {
-          new URL(origin)
-          return false
+          new URL(trimmedOrigin)
+          validOrigins.push(trimmedOrigin)
         } catch {
-          return true
+          invalidOrigins.push(trimmedOrigin)
         }
       })
 
-      if (containsInvalid) {
+      if (invalidOrigins.length > 0) {
         this.$toast.error(this.$strings.ToastInvalidUrls)
-        this.newServerSettings.allowedOrigins = val.map((origin) => origin.trim().toLowerCase())
-        return
       }
 
-      this.newServerSettings.allowedOrigins = val.map((origin) => origin.trim().toLowerCase())
-
-      this.updateSettingsKey('allowedOrigins', this.newServerSettings.allowedOrigins)
+      this.newServerSettings.allowedOrigins = validOrigins
+      this.updateSettingsKey('allowedOrigins', validOrigins)
     },
     updateSettingsKey(key, val) {
       if (key === 'scannerDisableWatcher') {

From df3878d4cad448d0f450845059724bec200bdb31 Mon Sep 17 00:00:00 2001
From: advplyr <advplyr@protonmail.com>
Date: Mon, 4 Aug 2025 17:54:29 -0500
Subject: [PATCH 5/7] Add Security section to settings with allowed cors origin
 setting, increase width of setting inputs

---
 client/pages/config/index.vue | 12 ++++++++----
 client/strings/en-us.json     |  1 +
 2 files changed, 9 insertions(+), 4 deletions(-)

diff --git a/client/pages/config/index.vue b/client/pages/config/index.vue
index 8796d52a..1fd2cbcc 100644
--- a/client/pages/config/index.vue
+++ b/client/pages/config/index.vue
@@ -131,21 +131,25 @@
           </div>
 
           <div class="grow py-2">
-            <ui-dropdown :label="$strings.LabelSettingsDateFormat" v-model="newServerSettings.dateFormat" :items="dateFormats" small class="max-w-52" @input="(val) => updateSettingsKey('dateFormat', val)" />
+            <ui-dropdown :label="$strings.LabelSettingsDateFormat" v-model="newServerSettings.dateFormat" :items="dateFormats" small class="max-w-72" @input="(val) => updateSettingsKey('dateFormat', val)" />
             <p class="text-xs ml-1 text-white/60">{{ $strings.LabelExample }}: {{ dateExample }}</p>
           </div>
 
           <div class="grow py-2">
-            <ui-dropdown :label="$strings.LabelSettingsTimeFormat" v-model="newServerSettings.timeFormat" :items="timeFormats" small class="max-w-52" @input="(val) => updateSettingsKey('timeFormat', val)" />
+            <ui-dropdown :label="$strings.LabelSettingsTimeFormat" v-model="newServerSettings.timeFormat" :items="timeFormats" small class="max-w-72" @input="(val) => updateSettingsKey('timeFormat', val)" />
             <p class="text-xs ml-1 text-white/60">{{ $strings.LabelExample }}: {{ timeExample }}</p>
           </div>
 
           <div class="py-2">
-            <ui-dropdown :label="$strings.LabelLanguageDefaultServer" ref="langDropdown" v-model="newServerSettings.language" :items="$languageCodeOptions" small class="max-w-52" @input="updateServerLanguage" />
+            <ui-dropdown :label="$strings.LabelLanguageDefaultServer" ref="langDropdown" v-model="newServerSettings.language" :items="$languageCodeOptions" small class="max-w-72" @input="updateServerLanguage" />
+          </div>
+
+          <div class="pt-4">
+            <h2 class="font-semibold">{{ $strings.HeaderSettingsSecurity }}</h2>
           </div>
 
           <div class="py-2">
-            <ui-multi-select v-model="newServerSettings.allowedOrigins" :items="newServerSettings.allowedOrigins" :label="$strings.LabelCorsAllowed" class="max-w-52" @input="updateCorsOrigins" />
+            <ui-multi-select v-model="newServerSettings.allowedOrigins" :items="newServerSettings.allowedOrigins" :label="$strings.LabelCorsAllowed" class="max-w-72" @input="updateCorsOrigins" />
           </div>
 
           <!-- old experimental features -->
diff --git a/client/strings/en-us.json b/client/strings/en-us.json
index 9b97d727..87d4887d 100644
--- a/client/strings/en-us.json
+++ b/client/strings/en-us.json
@@ -198,6 +198,7 @@
   "HeaderSettingsDisplay": "Display",
   "HeaderSettingsExperimental": "Experimental Features",
   "HeaderSettingsGeneral": "General",
+  "HeaderSettingsSecurity": "Security",
   "HeaderSettingsScanner": "Scanner",
   "HeaderSettingsWebClient": "Web Client",
   "HeaderSleepTimer": "Sleep Timer",

From 1908ec3df5a18d4fcfb28a171e29ec69c2eaf532 Mon Sep 17 00:00:00 2001
From: advplyr <advplyr@protonmail.com>
Date: Mon, 4 Aug 2025 17:54:59 -0500
Subject: [PATCH 6/7] Remove commented out experimental features setting

---
 client/pages/config/index.vue | 17 -----------------
 1 file changed, 17 deletions(-)

diff --git a/client/pages/config/index.vue b/client/pages/config/index.vue
index 1fd2cbcc..3d030bb3 100644
--- a/client/pages/config/index.vue
+++ b/client/pages/config/index.vue
@@ -151,23 +151,6 @@
           <div class="py-2">
             <ui-multi-select v-model="newServerSettings.allowedOrigins" :items="newServerSettings.allowedOrigins" :label="$strings.LabelCorsAllowed" class="max-w-72" @input="updateCorsOrigins" />
           </div>
-
-          <!-- old experimental features -->
-          <!-- <div class="pt-4">
-            <h2 class="font-semibold">{{ $strings.HeaderSettingsExperimental }}</h2>
-          </div>
-
-          <div class="flex items-center py-2">
-            <ui-toggle-switch labeledBy="settings-experimental-features" v-model="showExperimentalFeatures" />
-            <ui-tooltip :text="$strings.LabelSettingsExperimentalFeaturesHelp">
-              <p class="pl-4">
-                <span id="settings-experimental-features">{{ $strings.LabelSettingsExperimentalFeatures }}</span>
-                <a :aria-label="$strings.LabelSettingsExperimentalFeaturesHelp" href="https://github.com/advplyr/audiobookshelf/discussions/75" target="_blank">
-                  <span class="material-symbols icon-text">info</span>
-                </a>
-              </p>
-            </ui-tooltip>
-          </div> -->
         </div>
       </div>
     </app-settings-content>

From 08c9e8d47d76c29b2ad78731ffb09061a6d131ee Mon Sep 17 00:00:00 2001
From: advplyr <advplyr@protonmail.com>
Date: Mon, 4 Aug 2025 17:56:56 -0500
Subject: [PATCH 7/7] Fix i18n string order

---
 client/strings/en-us.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/client/strings/en-us.json b/client/strings/en-us.json
index 87d4887d..70ac874d 100644
--- a/client/strings/en-us.json
+++ b/client/strings/en-us.json
@@ -198,8 +198,8 @@
   "HeaderSettingsDisplay": "Display",
   "HeaderSettingsExperimental": "Experimental Features",
   "HeaderSettingsGeneral": "General",
-  "HeaderSettingsSecurity": "Security",
   "HeaderSettingsScanner": "Scanner",
+  "HeaderSettingsSecurity": "Security",
   "HeaderSettingsWebClient": "Web Client",
   "HeaderSleepTimer": "Sleep Timer",
   "HeaderStatsLargestItems": "Largest Items",