Merge branch 'advplyr:master' into master

client/components/controls/LibraryFilterSelect.vue

@@ -276,6 +276,11 @@ export default {
           text: this.$strings.ButtonIssues,
           value: 'issues',
           sublist: false
+        },
+        {
+          text: this.$strings.LabelRSSFeedOpen,
+          value: 'feed-open',
+          sublist: false
         }
       ]
     },

client/components/widgets/EncoderOptionsCard.vue

@@ -162,7 +162,7 @@ export default {
       } else {
         // Find closest bitrate rounding up
         const bitratesToMatch = [32, 64, 128, 192]
-        const closestBitrate = bitratesToMatch.find((bitrate) => bitrate >= this.currentBitrate)
+        const closestBitrate = bitratesToMatch.find((bitrate) => bitrate >= this.currentBitrate) || 192
         this.selectedBitrate = closestBitrate + 'k'
       }
 

client/pages/upload/index.vue

@@ -359,15 +359,14 @@ export default {
       // Check if path already exists before starting upload
       //  uploading fails if path already exists
       for (const item of items) {
-        const filepath = Path.join(this.selectedFolder.fullPath, item.directory)
         const exists = await this.$axios
-          .$post(`/api/filesystem/pathexists`, { filepath, directory: item.directory, folderPath: this.selectedFolder.fullPath })
+          .$post(`/api/filesystem/pathexists`, { directory: item.directory, folderPath: this.selectedFolder.fullPath })
           .then((data) => {
             if (data.exists) {
               if (data.libraryItemTitle) {
                 this.$toast.error(this.$getString('ToastUploaderItemExistsInSubdirectoryError', [data.libraryItemTitle]))
               } else {
-                this.$toast.error(this.$getString('ToastUploaderFilepathExistsError', [filepath]))
+                this.$toast.error(this.$getString('ToastUploaderFilepathExistsError', [Path.join(this.selectedFolder.fullPath, item.directory)]))
               }
             }
             return data.exists

server/controllers/FileSystemController.js

@@ -84,27 +84,46 @@ class FileSystemController {
    */
   async checkPathExists(req, res) {
     if (!req.user.canUpload) {
-      Logger.error(`[FileSystemController] Non-admin user "${req.user.username}" attempting to check path exists`)
+      Logger.error(`[FileSystemController] User "${req.user.username}" without upload permissions attempting to check path exists`)
       return res.sendStatus(403)
     }
 
-    const { filepath, directory, folderPath } = req.body
+    const { directory, folderPath } = req.body
 
-    if (!filepath?.length || typeof filepath !== 'string') {
+    if (!directory?.length || typeof directory !== 'string' || !folderPath?.length || typeof folderPath !== 'string') {
+      Logger.error(`[FileSystemController] Invalid request body: ${JSON.stringify(req.body)}`)
+      return res.status(400).json({
+        error: 'Invalid request body'
+      })
+    }
+
+    // Check that library folder exists
+    const libraryFolder = await Database.libraryFolderModel.findOne({
+      where: {
+        path: folderPath
+      }
+    })
+
+    if (!libraryFolder) {
+      Logger.error(`[FileSystemController] Library folder not found: ${folderPath}`)
+      return res.sendStatus(404)
+    }
+
+    const filepath = Path.posix.join(libraryFolder.path, directory)
+    // Ensure filepath is inside library folder (prevents directory traversal)
+    if (!filepath.startsWith(libraryFolder.path)) {
+      Logger.error(`[FileSystemController] Filepath is not inside library folder: ${filepath}`)
       return res.sendStatus(400)
     }
 
-    const exists = await fs.pathExists(filepath)
-
-    if (exists) {
+    if (await fs.pathExists(filepath)) {
       return res.json({
         exists: true
       })
     }
 
-    // If directory and folderPath are passed in, check if a library item exists in a subdirectory
+    // Check if a library item exists in a subdirectory
     // See: https://github.com/advplyr/audiobookshelf/issues/4146
-    if (typeof directory === 'string' && typeof folderPath === 'string' && directory.length > 0 && folderPath.length > 0) {
     const cleanedDirectory = directory.split('/').filter(Boolean).join('/')
     if (cleanedDirectory.includes('/')) {
       // Can only be 2 levels deep
@@ -128,7 +147,6 @@ class FileSystemController {
         })
       }
     }
-    }
 
     return res.json({
       exists: false

server/models/MediaProgress.js

@@ -246,9 +246,10 @@ class MediaProgress extends Model {
     // For local sync
     if (progressPayload.lastUpdate) {
       this.updatedAt = progressPayload.lastUpdate
+      this.changed('updatedAt', true)
     }
 
-    return this.save()
+    return this.save({ silent: !!progressPayload.lastUpdate })
   }
 }
 

server/utils/podcastUtils.js

@@ -205,7 +205,7 @@ function extractEpisodeData(item) {
     } else if (typeof guidItem?._ === 'string') {
       episode.guid = guidItem._
     } else {
-      Logger.error(`[podcastUtils] Invalid guid ${item['guid']} for ${episode.enclosure.url}`)
+      Logger.error(`[podcastUtils] Invalid guid for ${episode.enclosure.url}`, item['guid'])
     }
   }
 

server/utils/queries/libraryItemsPodcastFilters.js

@@ -149,11 +149,12 @@ module.exports = {
       libraryId
     }
     const libraryItemIncludes = []
-    if (includeRSSFeed) {
+    if (filterGroup === 'feed-open' || includeRSSFeed) {
+      const rssFeedRequired = filterGroup === 'feed-open'
       libraryItemIncludes.push({
         model: Database.feedModel,
-        required: filterGroup === 'feed-open',
-        separate: true
+        required: rssFeedRequired,
+        separate: !rssFeedRequired
       })
     }
     if (filterGroup === 'issues') {