From 9b06212a92b67e692807320ab0286b0abe587a62 Mon Sep 17 00:00:00 2001 From: shamoon <4887959+shamoon@users.noreply.github.com> Date: Fri, 14 Mar 2025 18:29:27 -0700 Subject: [PATCH 1/9] Fix: wrapping in bookmarks (#4945) --- src/components/bookmarks/item.jsx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/components/bookmarks/item.jsx b/src/components/bookmarks/item.jsx index dd18bb71..4208f070 100644 --- a/src/components/bookmarks/item.jsx +++ b/src/components/bookmarks/item.jsx @@ -22,7 +22,7 @@ export default function Item({ bookmark, iconOnly = false }) { className={classNames( settings.cardBlur !== undefined && `backdrop-blur${settings.cardBlur.length ? "-" : ""}${settings.cardBlur}`, "text-left cursor-pointer transition-all rounded-md font-medium text-theme-700 dark:text-theme-200 dark:hover:text-theme-300 shadow-md shadow-theme-900/10 dark:shadow-theme-900/20 bg-theme-100/20 hover:bg-theme-300/20 dark:bg-white/5 dark:hover:bg-white/10", - iconOnly ? "h-[60px] w-[60px] grid" : "block w-full h-8 mb-3", + iconOnly ? "h-[60px] w-[60px] grid" : "block w-full h-full mb-3", )} > {iconOnly ? ( From b5ac6175973b6fd612990819bf666662a064610c Mon Sep 17 00:00:00 2001 From: shamoon <4887959+shamoon@users.noreply.github.com> Date: Fri, 14 Mar 2025 21:09:46 -0700 Subject: [PATCH 2/9] Fix: fix kavita API body with key (#4948) --- src/widgets/kavita/proxy.js | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/src/widgets/kavita/proxy.js b/src/widgets/kavita/proxy.js index af29d048..842e4b87 100644 --- a/src/widgets/kavita/proxy.js +++ b/src/widgets/kavita/proxy.js @@ -14,7 +14,11 @@ async function login(widget, service) { const endpoint = "Account/login"; const api = widgets?.[widget.type]?.api; const loginUrl = new URL(formatApiCall(api, { endpoint, ...widget })); - const loginBody = {}; + const loginBody = { + username: "", + password: "", + apiKey: "", + }; if (widget.username && widget.password) { loginBody.username = widget.username; loginBody.password = widget.password; From ea1375e57583941f0a0c112e36d9376e71ebbaaf Mon Sep 17 00:00:00 2001 From: brikim Date: Sat, 15 Mar 2025 00:02:13 -0500 Subject: [PATCH 3/9] Fix: correct units for speedtest tracker API v2 (#4950) Co-authored-by: shamoon <4887959+shamoon@users.noreply.github.com> --- src/widgets/speedtest/component.jsx | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/widgets/speedtest/component.jsx b/src/widgets/speedtest/component.jsx index b4fbeaa6..e34f53ac 100644 --- a/src/widgets/speedtest/component.jsx +++ b/src/widgets/speedtest/component.jsx @@ -36,14 +36,14 @@ export default function Component({ service }) { From 9d40b67d499a51dc91ebd4e72f664b7eace587d7 Mon Sep 17 00:00:00 2001 From: shamoon <4887959+shamoon@users.noreply.github.com> Date: Fri, 14 Mar 2025 22:51:07 -0700 Subject: [PATCH 4/9] Change: prefer IPv4 in docker image (#4954) --- Dockerfile | 4 ++-- src/middleware.js | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/Dockerfile b/Dockerfile index 2c15dc6c..7963407c 100644 --- a/Dockerfile +++ b/Dockerfile @@ -56,12 +56,12 @@ COPY --link --chmod=755 docker-entrypoint.sh /usr/local/bin/ RUN apk add --no-cache su-exec -ENV HOSTNAME=:: +ENV HOSTNAME=0.0.0.0 ENV PORT=3000 EXPOSE $PORT HEALTHCHECK --interval=10s --timeout=3s --start-period=20s \ - CMD wget --no-verbose --tries=1 --spider --no-check-certificate http://localhost:$PORT/api/healthcheck || exit 1 + CMD wget --no-verbose --tries=1 --spider --no-check-certificate http://127.0.0.1:$PORT/api/healthcheck || exit 1 ENTRYPOINT ["docker-entrypoint.sh"] CMD ["node", "server.js"] diff --git a/src/middleware.js b/src/middleware.js index f2011903..853a0094 100644 --- a/src/middleware.js +++ b/src/middleware.js @@ -4,7 +4,7 @@ export function middleware(req) { // Check the Host header, if HOMEPAGE_ALLOWED_HOSTS is set const host = req.headers.get("host"); const port = process.env.PORT || 3000; - let allowedHosts = [`localhost:${port}`]; + let allowedHosts = [`localhost:${port}`, `127.0.0.1:${port}`]; if (process.env.HOMEPAGE_ALLOWED_HOSTS) { allowedHosts = allowedHosts.concat(process.env.HOMEPAGE_ALLOWED_HOSTS.split(",")); } From 16c1b2da9bcb2b78364377095c364f1ce4e92566 Mon Sep 17 00:00:00 2001 From: shamoon <4887959+shamoon@users.noreply.github.com> Date: Sat, 15 Mar 2025 07:14:41 -0700 Subject: [PATCH 5/9] Enhancement: allow disabling host header checking (#4967) --- docs/installation/index.md | 6 +++++- src/middleware.js | 4 ++-- 2 files changed, 7 insertions(+), 3 deletions(-) diff --git a/docs/installation/index.md b/docs/installation/index.md index dd8c18f3..38fb30ea 100644 --- a/docs/installation/index.md +++ b/docs/installation/index.md @@ -29,4 +29,8 @@ You have a few options for deploying homepage, depending on your needs. We offer ### `HOMEPAGE_ALLOWED_HOSTS` -As of v1.0 there is one required environment variable when deploying via a public URL, HOMEPAGE_ALLOWED_HOSTS. This is a comma separated (no spaces) list of allowed hosts (sometimes with the port) that can access your homepage. See the [docker](docker.md) and [source](source.md) installation pages for examples. +As of v1.0 there is one required environment variable when deploying via a public URL, HOMEPAGE_ALLOWED_HOSTS. This is a comma separated (no spaces) list of allowed hosts (sometimes with the port) that can access your homepage. See the [docker](docker.md) and [source](source.md) installation pages for more information. + +`localhost:3000` and the loopback address `127.0.0.1:3000` are always allowed, but you can add a domain or IP address to this list to allow access from that host such as `HOMEPAGE_ALLOWED_HOSTS=gethomepage.io:1234,gethomepage.dev`, etc. + +This can be disabled by setting `HOMEPAGE_ALLOWED_HOSTS` to `*` but this is not recommended. diff --git a/src/middleware.js b/src/middleware.js index 853a0094..a2b24f4a 100644 --- a/src/middleware.js +++ b/src/middleware.js @@ -4,11 +4,11 @@ export function middleware(req) { // Check the Host header, if HOMEPAGE_ALLOWED_HOSTS is set const host = req.headers.get("host"); const port = process.env.PORT || 3000; - let allowedHosts = [`localhost:${port}`, `127.0.0.1:${port}`]; + const allowAll = process.env.HOMEPAGE_ALLOWED_HOSTS === "*"; if (process.env.HOMEPAGE_ALLOWED_HOSTS) { allowedHosts = allowedHosts.concat(process.env.HOMEPAGE_ALLOWED_HOSTS.split(",")); } - if (!host || !allowedHosts.includes(host)) { + if (!allowAll && (!host || !allowedHosts.includes(host))) { // eslint-disable-next-line no-console console.error( `Host validation failed for: ${host}. Hint: Set the HOMEPAGE_ALLOWED_HOSTS environment variable to allow requests from this host / port.`, From 0d0f465e16942ea4cb849d49e89fe80c4bcd5a79 Mon Sep 17 00:00:00 2001 From: shamoon <4887959+shamoon@users.noreply.github.com> Date: Sat, 15 Mar 2025 07:16:42 -0700 Subject: [PATCH 6/9] Update index.md --- docs/installation/index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/installation/index.md b/docs/installation/index.md index 38fb30ea..cc5f7a07 100644 --- a/docs/installation/index.md +++ b/docs/installation/index.md @@ -31,6 +31,6 @@ You have a few options for deploying homepage, depending on your needs. We offer As of v1.0 there is one required environment variable when deploying via a public URL, HOMEPAGE_ALLOWED_HOSTS. This is a comma separated (no spaces) list of allowed hosts (sometimes with the port) that can access your homepage. See the [docker](docker.md) and [source](source.md) installation pages for more information. -`localhost:3000` and the loopback address `127.0.0.1:3000` are always allowed, but you can add a domain or IP address to this list to allow access from that host such as `HOMEPAGE_ALLOWED_HOSTS=gethomepage.io:1234,gethomepage.dev`, etc. +`localhost:3000` and `127.0.0.1:3000` are always allowed, but you can add a domain or IP address to this list to allow access from that host such as `HOMEPAGE_ALLOWED_HOSTS=gethomepage.dev,192.168.1.2:1234`, etc. This can be disabled by setting `HOMEPAGE_ALLOWED_HOSTS` to `*` but this is not recommended. From 133a0a65398515f28a38b2c65da94ce6fc34fede Mon Sep 17 00:00:00 2001 From: shamoon <4887959+shamoon@users.noreply.github.com> Date: Sat, 15 Mar 2025 07:31:15 -0700 Subject: [PATCH 7/9] Fix this --- src/middleware.js | 1 + 1 file changed, 1 insertion(+) diff --git a/src/middleware.js b/src/middleware.js index a2b24f4a..bb9fbea5 100644 --- a/src/middleware.js +++ b/src/middleware.js @@ -4,6 +4,7 @@ export function middleware(req) { // Check the Host header, if HOMEPAGE_ALLOWED_HOSTS is set const host = req.headers.get("host"); const port = process.env.PORT || 3000; + let allowedHosts = [`localhost:${port}`, `127.0.0.1:${port}`]; const allowAll = process.env.HOMEPAGE_ALLOWED_HOSTS === "*"; if (process.env.HOMEPAGE_ALLOWED_HOSTS) { allowedHosts = allowedHosts.concat(process.env.HOMEPAGE_ALLOWED_HOSTS.split(",")); From 607a14083eb3a17078af0266abf3c3f63d81b628 Mon Sep 17 00:00:00 2001 From: shamoon <4887959+shamoon@users.noreply.github.com> Date: Sat, 15 Mar 2025 07:38:35 -0700 Subject: [PATCH 8/9] Fix: jellyfin handle empty episode numbers (#4970) --- src/widgets/emby/component.jsx | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/widgets/emby/component.jsx b/src/widgets/emby/component.jsx index b37b5018..41220e22 100644 --- a/src/widgets/emby/component.jsx +++ b/src/widgets/emby/component.jsx @@ -35,8 +35,8 @@ function generateStreamTitle(session, enableUser, showEpisodeNumber) { let streamTitle = ""; if (Type === "Episode" && showEpisodeNumber) { - const seasonStr = `S${ParentIndexNumber.toString().padStart(2, "0")}`; - const episodeStr = `E${IndexNumber.toString().padStart(2, "0")}`; + const seasonStr = ParentIndexNumber ? `S${ParentIndexNumber.toString().padStart(2, "0")}` : ""; + const episodeStr = IndexNumber ? `E${IndexNumber.toString().padStart(2, "0")}` : ""; streamTitle = `${SeriesName}: ${seasonStr} ยท ${episodeStr} - ${Name}`; } else { streamTitle = `${Name}${SeriesName ? ` - ${SeriesName}` : ""}`; From 964991781c3e710ca938ebc7c466b8e8cfb60348 Mon Sep 17 00:00:00 2001 From: Xavier Alexander Date: Sat, 15 Mar 2025 10:40:26 -0400 Subject: [PATCH 9/9] Documentation: add HOMEPAGE_ALLOWED_HOSTS to k8s docs (#4969) --- docs/installation/k8s.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/docs/installation/k8s.md b/docs/installation/k8s.md index cd9184ee..2aeff8ec 100644 --- a/docs/installation/k8s.md +++ b/docs/installation/k8s.md @@ -302,6 +302,9 @@ spec: - name: homepage image: "ghcr.io/gethomepage/homepage:latest" imagePullPolicy: Always + env: + - name: HOMEPAGE_ALLOWED_HOSTS + value: gethomepage.dev # required, may need port ports: - name: http containerPort: 3000