mirror of
https://github.com/navidrome/navidrome.git
synced 2026-10-08 02:17:25 +02:00
59f1b4206cThe image endpoint only served a private playlist's cover when the request carried a token identifying its owner or an admin. But clients fetch cover URLs without credentials — real Jellyfin's image routes are anonymous — so every private playlist rendered the generic placeholder in Jellyfin clients (observed in production), while the same covers displayed fine through the always-authenticated Subsonic/native APIs. Drop the gate and serve playlist covers like album/artist/track artwork: playlist ids are unguessable without credentials, so anonymous access does not meaningfully expose private playlist contents. |
||
|---|---|---|
| .. | ||
| backgrounds | ||
| events | ||
| filter | ||
| jellyfin | ||
| nativeapi | ||
| public | ||
| subsonic | ||
| testdata | ||
| auth.go | ||
| auth_test.go | ||
| initial_setup.go | ||
| initial_setup_test.go | ||
| middlewares.go | ||
| middlewares_test.go | ||
| serve_index.go | ||
| serve_index_test.go | ||
| server.go | ||
| server_suite_test.go | ||
| server_test.go | ||
| throttle_backlog.go | ||
| throttle_backlog_test.go | ||