From 74a7192a7f61aba5cf9c5f7dd196011407903e9e Mon Sep 17 00:00:00 2001
From: Shane Israel <shanemisrael@gmail.com>
Date: Mon, 14 Sep 2026 10:01:53 -0600
Subject: [PATCH 1/5] fix: add the missing Uploader action to the images file
 manager
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The Videos tab has had a bulk Uploader action since ownership landed, but
the Images tab never grew one, so images indexed from disk before
ownership existed were stuck unattributed with no way to adopt them. The
server side was already in place — bulk-set-uploader has always taken
image_ids — so this is only the missing control: an Uploader button in
the organize group, labelled on desktop and icon-only on mobile, opening
the same account picker as videos, including the option to clear
attribution.

The success toast reported "(0)" on both tabs, because runBulkAction
counts the updated/moved/deleted array while bulk-set-uploader answers
with updated_images / updated_videos counts instead. Both now prefer that
count when the response carries one.

Fixes #726
---
 .../src/components/admin/ImageFileManager.js  | 114 +++++++++++++++++-
 .../src/components/admin/VideoFileManager.js  |   2 +-
 2 files changed, 114 insertions(+), 2 deletions(-)

diff --git a/app/client/src/components/admin/ImageFileManager.js b/app/client/src/components/admin/ImageFileManager.js
index 64acbcf8..d91a77f2 100644
--- a/app/client/src/components/admin/ImageFileManager.js
+++ b/app/client/src/components/admin/ImageFileManager.js
@@ -34,6 +34,7 @@ import SearchIcon from '@mui/icons-material/Search'
 import FolderIcon from '@mui/icons-material/Folder'
 import OpenInNewIcon from '@mui/icons-material/OpenInNew'
 import LockIcon from '@mui/icons-material/Lock'
+import PersonIcon from '@mui/icons-material/Person'
 import LockOpenIcon from '@mui/icons-material/LockOpen'
 import RefreshIcon from '@mui/icons-material/Refresh'
 import KeyboardArrowDownIcon from '@mui/icons-material/KeyboardArrowDown'
@@ -305,6 +306,9 @@ export default function ImageFileManager({ setAlert }) {
   const [moveModalOpen, setMoveModalOpen] = useState(false)
   const [createFolderDialogOpen, setCreateFolderDialogOpen] = useState(false)
   const [renameDialogOpen, setRenameDialogOpen] = useState(false)
+  const [uploaderDialogOpen, setUploaderDialogOpen] = useState(false)
+  const [uploaderChoice, setUploaderChoice] = useState(null)
+  const [uploaderOptions, setUploaderOptions] = useState([])
   const [colVisAnchor, setColVisAnchor] = useState(null)
 
   // Rename form state
@@ -493,7 +497,7 @@ export default function ImageFileManager({ setAlert }) {
       setActionLoading(true)
       try {
         const { data } = await Api().post(endpoint, body)
-        const updatedCount = (data.updated ?? data.moved ?? data.deleted ?? []).length
+        const updatedCount = data.updated_images ?? (data.updated ?? data.moved ?? data.deleted ?? []).length
         const errorCount = (data.errors ?? []).length
         if (errorCount > 0) {
           setAlert({
@@ -597,6 +601,23 @@ export default function ImageFileManager({ setAlert }) {
     }
   }
 
+  useEffect(() => {
+    if (!uploaderDialogOpen) return
+    Api()
+      .get('/api/admin/uploaders')
+      .then((res) => setUploaderOptions(res.data.users || []))
+      .catch(() => setUploaderOptions([]))
+  }, [uploaderDialogOpen])
+
+  const handleSetUploader = async () => {
+    const ok = await runBulkAction(
+      '/api/admin/image-files/bulk-set-uploader',
+      { image_ids: [...selected], username: uploaderChoice },
+      uploaderChoice ? `Attributed to ${uploaderChoice}` : 'Uploader cleared',
+    )
+    if (ok) setUploaderDialogOpen(false)
+  }
+
   const handleSetPrivacy = async (isPrivate) => {
     await runBulkAction(
       '/api/admin/image-files/bulk-set-privacy',
@@ -709,6 +730,26 @@ export default function ImageFileManager({ setAlert }) {
                   </IconButton>
                 </span>
               </Tooltip>
+              <Tooltip title="Set uploader">
+                <span>
+                  <IconButton
+                    size="small"
+                    disabled={onlyEmptyFoldersSelected}
+                    onClick={() => {
+                      setUploaderChoice(null)
+                      setUploaderDialogOpen(true)
+                    }}
+                    sx={{
+                      border: '1px solid #3399FF44',
+                      borderRadius: 1,
+                      color: '#7FBFFF',
+                      '&:hover': { bgcolor: '#3399FF12' },
+                    }}
+                  >
+                    <PersonIcon sx={{ fontSize: 20 }} />
+                  </IconButton>
+                </span>
+              </Tooltip>
               <Tooltip title="Rename">
                 <span>
                   <IconButton
@@ -810,6 +851,28 @@ export default function ImageFileManager({ setAlert }) {
                     </Button>
                   </span>
                 </Tooltip>
+                <Tooltip title="Attribute selected images to a user">
+                  <span>
+                    <Button
+                      size="small"
+                      variant="outlined"
+                      disabled={onlyEmptyFoldersSelected}
+                      startIcon={<PersonIcon />}
+                      onClick={() => {
+                        setUploaderChoice(null)
+                        setUploaderDialogOpen(true)
+                      }}
+                      sx={{
+                        textTransform: 'none',
+                        borderColor: '#3399FF44',
+                        color: '#7FBFFF',
+                        '&:hover': { borderColor: '#3399FF99', bgcolor: '#3399FF12' },
+                      }}
+                    >
+                      Uploader
+                    </Button>
+                  </span>
+                </Tooltip>
                 <Tooltip title="Rename selected images">
                   <span>
                     <Button
@@ -1695,6 +1758,55 @@ export default function ImageFileManager({ setAlert }) {
           </Button>
         </DialogActions>
       </Dialog>
+
+      {/* ── Set Uploader modal ── */}
+      <Dialog
+        open={uploaderDialogOpen}
+        onClose={() => !actionLoading && setUploaderDialogOpen(false)}
+        fullWidth
+        maxWidth="xs"
+        PaperProps={{ sx: dialogPaperSx }}
+      >
+        <DialogTitle sx={dialogTitleSx}>Set uploader</DialogTitle>
+        <DialogContent>
+          <DialogContentText sx={{ color: '#FFFFFFAA', fontSize: 13.5, mb: 2 }}>
+            Attribute {selected.size} selected image{selected.size === 1 ? '' : 's'} to an account.
+            This is how library content indexed from disk gets an owner, so it appears on their
+            profile and comes under their edit and delete permissions.
+          </DialogContentText>
+          <Select
+            options={[
+              { value: null, label: 'No uploader (unattributed)' },
+              ...uploaderOptions.map((u) => ({
+                value: u.username,
+                label: u.name === u.username ? `@${u.username}` : `${u.name} (@${u.username})`,
+              })),
+            ]}
+            value={
+              uploaderChoice === null
+                ? { value: null, label: 'No uploader (unattributed)' }
+                : uploaderOptions
+                    .filter((u) => u.username === uploaderChoice)
+                    .map((u) => ({
+                      value: u.username,
+                      label: u.name === u.username ? `@${u.username}` : `${u.name} (@${u.username})`,
+                    }))[0] || null
+            }
+            onChange={(opt) => setUploaderChoice(opt ? opt.value : null)}
+            styles={selectFolderTheme}
+            menuPortalTarget={document.body}
+            placeholder="Choose an account..."
+          />
+        </DialogContent>
+        <DialogActions sx={{ px: 3, pb: 2, gap: 1 }}>
+          <Button onClick={() => setUploaderDialogOpen(false)} disabled={actionLoading} sx={{ color: '#B2BAC2' }}>
+            Cancel
+          </Button>
+          <Button onClick={handleSetUploader} variant="contained" disabled={actionLoading}>
+            {actionLoading ? 'Applying...' : 'Apply'}
+          </Button>
+        </DialogActions>
+      </Dialog>
     </Box>
   )
 }
diff --git a/app/client/src/components/admin/VideoFileManager.js b/app/client/src/components/admin/VideoFileManager.js
index 714b4387..866f3a9c 100644
--- a/app/client/src/components/admin/VideoFileManager.js
+++ b/app/client/src/components/admin/VideoFileManager.js
@@ -636,7 +636,7 @@ export default function VideoFileManager({ setAlert }) {
       setActionLoading(true)
       try {
         const { data } = await Api().post(endpoint, body)
-        const updatedCount = (data.updated ?? data.moved ?? data.deleted ?? []).length
+        const updatedCount = data.updated_videos ?? (data.updated ?? data.moved ?? data.deleted ?? []).length
         const errorCount = (data.errors ?? []).length
         if (errorCount > 0) {
           setAlert({

From 3af788d98986bba4a426e035cb21a1ab2dafa31f Mon Sep 17 00:00:00 2001
From: Shane Israel <shanemisrael@gmail.com>
Date: Mon, 14 Sep 2026 10:30:14 -0600
Subject: [PATCH 2/5] security tightening
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Findings from an external review, each confirmed against the code before
changing anything.

The example SECRET_KEY shipped uncommented in docker-compose.yml, so every
instance that never edited that line signed its session and remember-me
cookies with a key published in this repo — enough to compute an admin
cookie offline and present it without ever logging in. The line is now
commented out, the entrypoint generates a key on first start and keeps it
in /data so restarts do not sign everyone out, and both the entrypoint and
the app refuse the old placeholder if it is still set.

The three "move to folder" endpoints joined a client-supplied folder onto
the media root with pathlib, which drops the root entirely when the folder
is absolute, and "../" walked out of it just as easily. The new path was
then stored on the row and reused verbatim by delete, so a move could put
a file anywhere the process could write and the ordinary delete endpoint
would then unlink it. edit_own was enough to reach this. Folder names are
now resolved against the root and rejected if they land outside it, and
the normalised form is what gets stored.

PUT /api/video/details bulk-updated whatever remained in the request body
onto VideoInfo, which reached video_id — no uniqueness constraint, so a
row could be repointed at another user's video — and password_hash,raw,
side-stepping the hashing a few lines below that the surrounding code
comments describe as guaranteed. Only title, description and private are
the client's to set, matching what the image endpoint already did.

The password step of login had no limit of any kind, so a known username
could be guessed at as fast as the server would answer. Failures are now
counted per source address and per address/account in memory. The MFA cap
resets on every fresh password round, so failed codes count against the
same budget. Keying includes the address on purpose: a global per-account
lockout would let anyone lock a known username out of their own instance.

Also: the SteamGridDB search and asset routes had no authentication at all
while the routes either side of them require a permission, so anonymous
callers could spend the operator's API quota, and the search term went
into the request path unescaped; CORS was enabled with credentials and no
origin list, which flask-cors reads as "any origin" and answers by
reflecting the caller's own Origin, so it is now opt-in via CORS_ORIGINS
with SameSite stated explicitly on both cookies rather than left to the
browser default; and the webhook test routes, which make the server issue
an arbitrary outbound request, used the admin check that deliberately
admits any authenticated user under DEMO_MODE.
---
 app/client/src/components/forms/LoginForm.js |   8 +-
 app/server/fireshare/__init__.py             |  44 +++++++-
 app/server/fireshare/api/__init__.py         |   2 -
 app/server/fireshare/api/admin.py            |  28 +++--
 app/server/fireshare/api/game.py             |   3 +
 app/server/fireshare/api/helpers.py          |  28 +++++
 app/server/fireshare/api/misc.py             |   6 +-
 app/server/fireshare/api/video.py            |  25 ++++-
 app/server/fireshare/auth.py                 |  30 +++++-
 app/server/fireshare/login_throttle.py       | 106 +++++++++++++++++++
 app/server/fireshare/main.py                 |   2 -
 app/server/fireshare/steamgrid.py            |   5 +-
 docker-compose.yml                           |   6 +-
 entrypoint.sh                                |  27 ++++-
 14 files changed, 290 insertions(+), 30 deletions(-)
 create mode 100644 app/server/fireshare/login_throttle.py

diff --git a/app/client/src/components/forms/LoginForm.js b/app/client/src/components/forms/LoginForm.js
index 11fdfcff..6d2a7656 100644
--- a/app/client/src/components/forms/LoginForm.js
+++ b/app/client/src/components/forms/LoginForm.js
@@ -74,10 +74,12 @@ const LoginForm = function () {
       await completeLogin()
     } catch (err) {
       const status = err.response?.status
+      // 429 carries the throttle's own "try again in N seconds" text, which is the
+      // only way the user finds out why a correct password is being refused.
+      const showsServerMessage = status === 401 || status === 403 || status === 429
       setAlert({
-        type: status === 401 ? 'warning' : 'error',
-        message:
-          status === 401 || status === 403 ? errorMessage(err) : 'An unknown error occurred while trying to log in.',
+        type: status === 401 || status === 429 ? 'warning' : 'error',
+        message: showsServerMessage ? errorMessage(err) : 'An unknown error occurred while trying to log in.',
         open: true,
       })
       setLoading(false)
diff --git a/app/server/fireshare/__init__.py b/app/server/fireshare/__init__.py
index 3af5a2d4..ce7d026c 100644
--- a/app/server/fireshare/__init__.py
+++ b/app/server/fireshare/__init__.py
@@ -124,7 +124,24 @@ def create_app(init_schedule=False):
     ldap_retired.abort_if_ldap_configured(logger)
 
     app = Flask(__name__, static_url_path='', static_folder='build', template_folder='build')
-    CORS(app, supports_credentials=True)
+
+    # Cross-origin access is off unless an operator names the origins that need it.
+    # It used to be CORS(app, supports_credentials=True) with no origins, which
+    # flask-cors reads as "any origin": it echoed whatever Origin arrived back as
+    # Access-Control-Allow-Origin next to Access-Control-Allow-Credentials: true,
+    # so any site a signed-in user visited could call the API as them. Fireshare
+    # serves its frontend from this same origin, so nothing needs this by default.
+    cors_origins = [o.strip() for o in os.getenv('CORS_ORIGINS', '').split(',') if o.strip()]
+    if '*' in cors_origins:
+        logger.warning(
+            "CORS_ORIGINS=* cannot be combined with credentialed requests and has been "
+            "ignored. List the origins that need access explicitly."
+        )
+        cors_origins = [o for o in cors_origins if o != '*']
+    if cors_origins:
+        CORS(app, supports_credentials=True, origins=cors_origins)
+        logger.info(f"CORS enabled for: {', '.join(cors_origins)}")
+
     if 'DATA_DIRECTORY' not in os.environ:
         raise Exception("DATA_DIRECTORY not found in environment")
 
@@ -132,11 +149,34 @@ def create_app(init_schedule=False):
     app.config['DOMAIN'] = os.getenv('DOMAIN')
     app.config['THUMBNAIL_VIDEO_LOCATION'] = int(os.getenv('THUMBNAIL_VIDEO_LOCATION') or 0)
 
-    app.config['SECRET_KEY'] = os.getenv('SECRET_KEY', secrets.token_hex(32))
+    # The example value shipped uncommented in docker-compose.yml, so instances that
+    # never edited it were all signing cookies with a key published in this repo —
+    # enough to forge an admin remember-me cookie. Treat it as if it were unset.
+    _secret_key = os.getenv('SECRET_KEY') or ''
+    if _secret_key == 'replace_this_with_some_random_string':
+        logger.warning(
+            "SECRET_KEY is set to the example value from docker-compose.yml. That key is "
+            "public, so it is being ignored in favour of a generated one. Remove the line "
+            "from your compose file; sessions will not survive a restart until you do."
+        )
+        _secret_key = ''
+    app.config['SECRET_KEY'] = _secret_key or secrets.token_hex(32)
 
     from datetime import timedelta
     app.config['PERMANENT_SESSION_LIFETIME'] = timedelta(hours=1)
 
+    # SameSite was never set, leaving both cookies on whatever the browser happened
+    # to default to. Lax is stated explicitly so a cross-site request cannot carry
+    # them regardless of that default. Secure is opt-in because plenty of instances
+    # are reached over plain HTTP on a LAN, where it would lock users out entirely.
+    secure_cookies = env_bool('SECURE_COOKIES')
+    app.config['SESSION_COOKIE_HTTPONLY'] = True
+    app.config['SESSION_COOKIE_SAMESITE'] = 'Lax'
+    app.config['SESSION_COOKIE_SECURE'] = secure_cookies
+    app.config['REMEMBER_COOKIE_HTTPONLY'] = True
+    app.config['REMEMBER_COOKIE_SAMESITE'] = 'Lax'
+    app.config['REMEMBER_COOKIE_SECURE'] = secure_cookies
+
     app.config['DATA_DIRECTORY'] = os.getenv('DATA_DIRECTORY')
     app.config['VIDEO_DIRECTORY'] = os.getenv('VIDEO_DIRECTORY')
     app.config['PROCESSED_DIRECTORY'] = os.getenv('PROCESSED_DIRECTORY')
diff --git a/app/server/fireshare/api/__init__.py b/app/server/fireshare/api/__init__.py
index 44aebdae..05597a83 100644
--- a/app/server/fireshare/api/__init__.py
+++ b/app/server/fireshare/api/__init__.py
@@ -1,9 +1,7 @@
 import os
 from flask import Blueprint
-from flask_cors import CORS
 
 templates_path = os.environ.get('TEMPLATE_PATH') or 'templates'
 api = Blueprint('api', __name__, template_folder=templates_path)
-CORS(api, supports_credentials=True)
 
 from . import transcoding, scan, misc, admin, video, upload, game, tag, image, folder, profile, users  # noqa: E402,F401
diff --git a/app/server/fireshare/api/admin.py b/app/server/fireshare/api/admin.py
index 1e06f9a7..9f960821 100644
--- a/app/server/fireshare/api/admin.py
+++ b/app/server/fireshare/api/admin.py
@@ -18,7 +18,7 @@
 from ..models import Video, VideoInfo, VideoView, GameMetadata, VideoGameLink, VideoTagLink, Image, ImageInfo, ImageGameLink, ImageTagLink, ImageView, TranscodeJob, MediaFolder
 from .. import permissions as perms
 from . import api
-from .helpers import cancel_pending_transcode_jobs, delete_video_files
+from .helpers import cancel_pending_transcode_jobs, delete_video_files, resolve_media_subfolder
 from .transcoding import _is_pid_running
 from .scan import _game_scan_state
 from .decorators import admin_required, demo_restrict
@@ -462,7 +462,10 @@ def bulk_move_files():
 
     paths = current_app.config['PATHS']
     video_path = paths['video']
-    target_folder_path = video_path / target_folder
+    resolved = resolve_media_subfolder(video_path, target_folder)
+    if not resolved:
+        return Response(status=400, response=f"Folder '{target_folder}' is not inside the video directory.")
+    target_folder_path, target_folder = resolved
 
     if not target_folder_path.is_dir():
         return Response(status=400, response=f"Folder '{target_folder}' does not exist.")
@@ -477,7 +480,7 @@ def bulk_move_files():
 
         old_file_path = video_path / video.path
         filename = Path(video.path).name
-        new_path = f"{target_folder}/{filename}"
+        new_path = f"{target_folder}/{filename}" if target_folder else filename
         new_file_path = video_path / new_path
 
         if old_file_path.resolve() == new_file_path.resolve():
@@ -497,7 +500,12 @@ def bulk_move_files():
             os.symlink(new_file_path.absolute(), link_path)
 
             video.path = new_path
-            video.folder_id = _get_or_create_media_folder(target_folder.split('/')[0], "video").id
+            # Media sitting directly in the root carries no folder row, matching how
+            # the disk scan records it.
+            video.folder_id = (
+                _get_or_create_media_folder(target_folder.split('/')[0], "video").id
+                if target_folder else None
+            )
 
             from ..models import FolderRule
             folder_rule = FolderRule.query.filter_by(folder_path=target_folder).first()
@@ -1045,7 +1053,10 @@ def bulk_move_images():
         return Response(status=503, response='IMAGE_DIRECTORY is not configured.')
 
     image_path = Path(image_directory)
-    target_folder_path = image_path / target_folder
+    resolved = resolve_media_subfolder(image_path, target_folder)
+    if not resolved:
+        return Response(status=400, response=f"Folder '{target_folder}' is not inside the image directory.")
+    target_folder_path, target_folder = resolved
     paths = current_app.config['PATHS']
 
     if not target_folder_path.is_dir():
@@ -1061,7 +1072,7 @@ def bulk_move_images():
 
         old_file_path = image_path / img.path
         filename = Path(img.path).name
-        new_path = f"{target_folder}/{filename}"
+        new_path = f"{target_folder}/{filename}" if target_folder else filename
         new_file_path = image_path / new_path
 
         if old_file_path.resolve() == new_file_path.resolve():
@@ -1081,7 +1092,10 @@ def bulk_move_images():
             os.symlink(new_file_path.absolute(), link_path)
 
             img.path = new_path
-            img.folder_id = _get_or_create_media_folder(target_folder.split('/')[0], "image").id
+            img.folder_id = (
+                _get_or_create_media_folder(target_folder.split('/')[0], "image").id
+                if target_folder else None
+            )
             db.session.commit()
             results['moved'].append(img_id)
         except Exception as e:
diff --git a/app/server/fireshare/api/game.py b/app/server/fireshare/api/game.py
index 4d168297..487fe753 100644
--- a/app/server/fireshare/api/game.py
+++ b/app/server/fireshare/api/game.py
@@ -53,6 +53,7 @@ def game_json_with_assets(game):
 
 
 @api.route('/api/steamgrid/search', methods=["GET"])
+@login_required
 def search_steamgrid():
     query = request.args.get('query')
     if not query:
@@ -69,6 +70,7 @@ def search_steamgrid():
 
 
 @api.route('/api/steamgrid/game/<int:game_id>/assets', methods=["GET"])
+@login_required
 def get_steamgrid_assets(game_id):
     api_key = get_steamgriddb_api_key()
     if not api_key:
@@ -81,6 +83,7 @@ def get_steamgrid_assets(game_id):
 
 
 @api.route('/api/steamgrid/game/<int:game_id>/assets/options', methods=["GET"])
+@login_required
 def get_steamgrid_asset_options(game_id):
     api_key = get_steamgriddb_api_key()
     if not api_key:
diff --git a/app/server/fireshare/api/helpers.py b/app/server/fireshare/api/helpers.py
index 4e122897..094eb9d5 100644
--- a/app/server/fireshare/api/helpers.py
+++ b/app/server/fireshare/api/helpers.py
@@ -5,6 +5,7 @@
 import shutil
 import time
 from functools import wraps
+from pathlib import Path
 from flask import current_app
 from .. import db, logger
 from ..models import TranscodeJob, Video
@@ -35,6 +36,33 @@ def sanitize_upload_folder(name):
     return folder or None
 
 
+def resolve_media_subfolder(root, folder):
+    """Join a client-supplied folder onto a media root without letting it escape.
+
+    The move endpoints accept nested folders, so the single-level
+    sanitize_upload_folder() above is too strict for them; what has to hold is only
+    that the result stays inside the root. Both ways out need closing: pathlib's `/`
+    operator discards the root entirely when the right-hand side is absolute
+    ("/etc"), and a relative "../" walks out of it just as effectively.
+
+    The comparison is deliberately lexical. Resolving symlinks would also reject a
+    folder the operator symlinked into their media directory, which is a supported
+    way to lay a library out, and nothing reachable over the API can create a
+    symlink inside the root for an attacker to aim at.
+
+    Returns (absolute_path, folder_relative_to_root) with the folder normalised, or
+    None when it escapes the root.
+    """
+    if folder is None:
+        return None
+    root_str = os.path.normpath(str(root))
+    candidate = os.path.normpath(os.path.join(root_str, str(folder)))
+    if candidate != root_str and not candidate.startswith(root_str + os.sep):
+        return None
+    relative = os.path.relpath(candidate, root_str)
+    return Path(candidate), ('' if relative == '.' else Path(relative).as_posix())
+
+
 def remove_derived_dir(derived_path, attempts=4, delay=0.25):
     """Remove a derived/<id> directory, tolerating jobs that are still writing into it.
 
diff --git a/app/server/fireshare/api/misc.py b/app/server/fireshare/api/misc.py
index 9f67c17c..920069ad 100644
--- a/app/server/fireshare/api/misc.py
+++ b/app/server/fireshare/api/misc.py
@@ -11,7 +11,7 @@
 from ..models import Video, VideoInfo
 from ..cli import send_discord_webhook, send_generic_webhook
 from . import api
-from .decorators import admin_required, demo_restrict
+from .decorators import admin_required, demo_restrict, strict_admin_required
 
 
 # Cache for local app version and release list (persists until server restart)
@@ -253,7 +253,7 @@ def rss_feed():
 
 
 @api.route('/api/test-discord-webhook', methods=['POST'])
-@admin_required
+@strict_admin_required
 @demo_restrict
 def test_discord_webhook():
     data = request.get_json()
@@ -277,7 +277,7 @@ def test_discord_webhook():
 
 
 @api.route('/api/test-webhook', methods=['POST'])
-@admin_required
+@strict_admin_required
 @demo_restrict
 def test_webhook():
     data = request.get_json()
diff --git a/app/server/fireshare/api/video.py b/app/server/fireshare/api/video.py
index e370510e..4130370b 100644
--- a/app/server/fireshare/api/video.py
+++ b/app/server/fireshare/api/video.py
@@ -28,6 +28,7 @@
     cancel_pending_transcode_jobs,
     delete_video_files,
     get_video_path,
+    resolve_media_subfolder,
     viewer_sees_private,
 )
 from .decorators import demo_restrict, require_perm
@@ -501,13 +502,16 @@ def move_video(id):
     paths = current_app.config['PATHS']
     video_path = paths['video']
 
-    target_folder_path = video_path / target_folder
+    resolved = resolve_media_subfolder(video_path, target_folder)
+    if not resolved:
+        return Response(status=400, response=f"Folder '{target_folder}' is not inside the video directory.")
+    target_folder_path, target_folder = resolved
     if not target_folder_path.is_dir():
         return Response(status=400, response=f"Folder '{target_folder}' does not exist.")
 
     old_file_path = video_path / video.path
     filename = Path(video.path).name
-    new_path = f"{target_folder}/{filename}"
+    new_path = f"{target_folder}/{filename}" if target_folder else filename
     new_file_path = video_path / new_path
 
     if old_file_path.resolve() == new_file_path.resolve():
@@ -589,9 +593,20 @@ def handle_video_details(id):
             new_start = data.pop('start_time', _UNSET)
             new_end   = data.pop('end_time',   _UNSET)
 
-            # Update remaining VideoInfo fields generically
-            if data:
-                db.session.query(VideoInfo).filter_by(video_id=id).update(data)
+            # Only these are the client's to set. The previous blanket update of
+            # whatever remained in the body also reached video_id (which carries no
+            # uniqueness constraint, so a row could be repointed at someone else's
+            # video) and password_hash (writable as a raw string, side-stepping the
+            # hashing directly below).
+            editable = {
+                field: data[field]
+                for field in ('title', 'description', 'private')
+                if field in data
+            }
+            if 'private' in editable:
+                editable['private'] = bool(editable['private'])
+            if editable:
+                db.session.query(VideoInfo).filter_by(video_id=id).update(editable)
 
             # Handle password changes
             generated_password = None
diff --git a/app/server/fireshare/auth.py b/app/server/fireshare/auth.py
index 47074adc..e9548f67 100644
--- a/app/server/fireshare/auth.py
+++ b/app/server/fireshare/auth.py
@@ -6,7 +6,6 @@
 import qrcode
 from flask import Blueprint, redirect, request, Response, jsonify, current_app, session
 from flask_login import login_user, logout_user, current_user, login_required
-from flask_cors import CORS
 from werkzeug.security import generate_password_hash, check_password_hash
 from .models import User
 from . import db
@@ -14,10 +13,10 @@
 from .api.misc import _get_local_version, _fetch_release_notes
 from .api.decorators import demo_restrict
 from .ip_whitelist import login_ip_required, get_client_ip, is_ip_permitted
+from . import login_throttle
 from datetime import datetime, timezone
 
 auth = Blueprint('auth', __name__)
-CORS(auth, supports_credentials=True)
 
 MFA_PENDING_MAX_AGE = 300
 MFA_MAX_ATTEMPTS = 5
@@ -26,6 +25,7 @@ def _clear_mfa_pending():
     session.pop('mfa_pending_user_id', None)
     session.pop('mfa_pending_at', None)
     session.pop('mfa_attempts', None)
+    session.pop('mfa_username', None)
 
 def _verify_totp(user, code):
     """
@@ -62,6 +62,17 @@ def login():
     if not isinstance(username, str) or not isinstance(password, str):
         return Response(response="Invalid username or password", status=401)
 
+    client_ip = get_client_ip()
+    wait = login_throttle.retry_after(client_ip, username)
+    if wait:
+        # The hash comparison below is deliberately skipped while throttled, so a
+        # blocked caller cannot keep the server doing pbkdf2 work for them.
+        return Response(
+            response=f"Too many failed sign-in attempts. Try again in {wait} seconds.",
+            status=429,
+            headers={'Retry-After': str(wait)},
+        )
+
     user = User.query.filter_by(username=username).first()
 
     # A user awaiting an invite has no password hash, and a disabled account must
@@ -72,12 +83,15 @@ def login():
             session['mfa_pending_user_id'] = user.id
             session['mfa_pending_at'] = time.time()
             session['mfa_attempts'] = 0
+            session['mfa_username'] = user.username
             return jsonify({'mfa_required': True})
         _clear_mfa_pending()
+        login_throttle.clear(client_ip, username)
         login_user(user, remember=True)
         _record_login(user)
         return Response(status=200)
 
+    login_throttle.record_failure(client_ip, username)
     return Response(response="Invalid username or password", status=401)
 
 @auth.route('/api/login/mfa', methods=['POST'])
@@ -92,6 +106,16 @@ def login_mfa():
         _clear_mfa_pending()
         return jsonify({'error': 'Login session expired. Please sign in again.', 'restart': True}), 401
 
+    # The per-session cap above resets whenever the password step is passed again,
+    # so on its own it only ever costs an attacker who already holds the password a
+    # fresh login round per five guesses. Failed codes are therefore counted against
+    # the same address/account budget as failed passwords.
+    client_ip = get_client_ip()
+    pending_username = session.get('mfa_username')
+    wait = login_throttle.retry_after(client_ip, pending_username)
+    if wait:
+        return jsonify({'error': f'Too many failed attempts. Try again in {wait} seconds.'}), 429
+
     user = db.session.get(User, pending_user_id)
     if not user or user.disabled or not user.mfa_enabled or not user.totp_secret:
         _clear_mfa_pending()
@@ -101,11 +125,13 @@ def login_mfa():
 
     matched_step = _verify_totp(user, (request.json or {}).get('code'))
     if matched_step is None:
+        login_throttle.record_failure(client_ip, pending_username)
         return jsonify({'error': 'Invalid authentication code.'}), 401
 
     user.totp_last_used = matched_step
     user.last_login_at = datetime.utcnow()
     db.session.commit()
+    login_throttle.clear(client_ip, pending_username)
     _clear_mfa_pending()
     login_user(user, remember=True)
     return jsonify({'authenticated': True})
diff --git a/app/server/fireshare/login_throttle.py b/app/server/fireshare/login_throttle.py
new file mode 100644
index 00000000..ab4dc9bf
--- /dev/null
+++ b/app/server/fireshare/login_throttle.py
@@ -0,0 +1,106 @@
+"""Throttling for the password step of login.
+
+The MFA step already caps attempts per pending session, but the password check in
+front of it had none, so a known username — most usefully the default `admin` this
+application itself warns operators to change — could be guessed at as fast as the
+server would answer.
+
+Counters live in process memory. Fireshare runs as a single server process per
+instance, so that is enough here and keeps both a rate-limiting dependency and the
+shared store it would normally want out of the deployment. The cost is that
+counters reset if the process restarts, which an attacker cannot force.
+
+Two limits apply together:
+
+* per source IP, which stops the ordinary case of one host working through a
+  password list, and also catches it spraying many usernames at once;
+* per source IP *and* username, which trips sooner on a single targeted account.
+
+Neither is keyed on the username alone, deliberately. A global per-account lockout
+would let anyone on the internet lock a known username — again, most usefully
+`admin` — out of their own instance by failing logins on purpose.
+"""
+
+import threading
+import time
+
+WINDOW_SECONDS = 300
+MAX_FAILURES_PER_IP = 30
+MAX_FAILURES_PER_ACCOUNT = 10
+
+# Bounds the memory an attacker rotating source addresses can cause us to hold.
+# Entries older than the window are dropped first, so this only bites under an
+# active distributed attempt.
+_MAX_TRACKED_KEYS = 4096
+
+_lock = threading.Lock()
+_failures = {}
+
+
+def _ip_key(ip):
+    return f"ip:{ip}"
+
+
+def _account_key(ip, username):
+    return f"account:{ip}|{(username or '').strip().lower()}"
+
+
+def _recent(key, now):
+    """Timestamps for a key inside the window, pruned in place."""
+    stamps = [t for t in _failures.get(key, ()) if t > now - WINDOW_SECONDS]
+    if stamps:
+        _failures[key] = stamps
+    else:
+        _failures.pop(key, None)
+    return stamps
+
+
+def _evict(now):
+    for key in [k for k in _failures if not any(t > now - WINDOW_SECONDS for t in _failures[k])]:
+        del _failures[key]
+    if len(_failures) > _MAX_TRACKED_KEYS:
+        # Keep the most recently active keys; an attacker churning through source
+        # addresses should not be able to push a real offender's counter out.
+        for key in sorted(_failures, key=lambda k: _failures[k][-1])[: len(_failures) - _MAX_TRACKED_KEYS]:
+            del _failures[key]
+
+
+def retry_after(ip, username):
+    """Seconds the caller must wait, or 0 when the attempt may proceed."""
+    now = time.time()
+    with _lock:
+        _evict(now)
+        wait = 0
+        for key, limit in ((_ip_key(ip), MAX_FAILURES_PER_IP),
+                           (_account_key(ip, username), MAX_FAILURES_PER_ACCOUNT)):
+            stamps = _recent(key, now)
+            if len(stamps) >= limit:
+                wait = max(wait, int(stamps[0] + WINDOW_SECONDS - now) + 1)
+        return wait
+
+
+def record_failure(ip, username):
+    now = time.time()
+    with _lock:
+        for key, limit in ((_ip_key(ip), MAX_FAILURES_PER_IP),
+                           (_account_key(ip, username), MAX_FAILURES_PER_ACCOUNT)):
+            stamps = _recent(key, now)
+            stamps.append(now)
+            # A blocked caller that keeps hammering should not grow this without
+            # bound; everything past the limit tells us nothing extra.
+            del stamps[: max(0, len(stamps) - limit)]
+            _failures[key] = stamps
+        _evict(now)
+
+
+def clear(ip, username):
+    """Forget the failures for an address/account pair after a success."""
+    with _lock:
+        _failures.pop(_account_key(ip, username), None)
+        _failures.pop(_ip_key(ip), None)
+
+
+def reset():
+    """Drop all state. For tests."""
+    with _lock:
+        _failures.clear()
diff --git a/app/server/fireshare/main.py b/app/server/fireshare/main.py
index ef341341..1d67d18a 100644
--- a/app/server/fireshare/main.py
+++ b/app/server/fireshare/main.py
@@ -1,13 +1,11 @@
 import os
 from flask import Blueprint, render_template, current_app, redirect
 from flask_login import current_user
-from flask_cors import CORS
 
 templates_path = os.environ.get('TEMPLATE_PATH') or 'templates'
 
 main = Blueprint('main', __name__, template_folder=templates_path)
 
-CORS(main, supports_credentials=True)
 
 
 @main.route('/', defaults={'path': ''})
diff --git a/app/server/fireshare/steamgrid.py b/app/server/fireshare/steamgrid.py
index 5f6ebe9c..00227118 100644
--- a/app/server/fireshare/steamgrid.py
+++ b/app/server/fireshare/steamgrid.py
@@ -6,6 +6,7 @@
 import logging
 from typing import Optional, List, Dict
 from pathlib import Path
+from urllib.parse import quote
 from PIL import Image as PILImage
 
 logger = logging.getLogger(__name__)
@@ -39,7 +40,9 @@ def search_games(self, query: str) -> List[Dict]:
             List of game dictionaries with id, name, release_date
         """
         try:
-            url = f"{self.BASE_URL}/search/autocomplete/{query}"
+            # Escaped: the query reaches here straight from a request parameter, and
+            # unescaped "/" or ".." in it would address a different API path.
+            url = f"{self.BASE_URL}/search/autocomplete/{quote(query, safe='')}"
             response = requests.get(url, headers=self.headers, timeout=10)
             response.raise_for_status()
 
diff --git a/docker-compose.yml b/docker-compose.yml
index daa8725f..7cfd2693 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -16,7 +16,11 @@ services:
       # If you need to reset your username and password after the first run, you can set these variables again and restart the container, then log in with the new credentials and remove the variables again.
       - ADMIN_USERNAME=admin
       - ADMIN_PASSWORD=admin
-      - SECRET_KEY=replace_this_with_some_random_string
+      # Signs the login session and remember-me cookies. Leave this unset: a random
+      # key is generated on first start and kept in /data so it survives restarts.
+      # Only set it yourself if you run several Fireshare containers that must share
+      # sessions, and if you do, use a long random value unique to your deployment.
+      # - SECRET_KEY=
       # Optional: only allow logins from these IPs/CIDR ranges (comma separated, IPv4/IPv6). Empty or unset disables the whitelist. See docs/Security.md
       # - LOGIN_IP_WHITELIST=203.0.113.5,10.0.0.0/8
       # Number of trusted reverse-proxy hops used to determine the real client IP. The bundled nginx counts as 1; set to 2 when behind an additional reverse proxy (Traefik, NPM, Cloudflare, ...).
diff --git a/entrypoint.sh b/entrypoint.sh
index c9452f5c..aa3a067b 100755
--- a/entrypoint.sh
+++ b/entrypoint.sh
@@ -120,10 +120,33 @@ log "Nginx ready"
 export PATH=/opt/python3.14/bin:/usr/local/bin:$PATH
 export LD_LIBRARY_PATH=/usr/local/nvidia/lib:/usr/local/nvidia/lib64:/usr/local/lib:/usr/local/cuda/lib64:${LD_LIBRARY_PATH}
 
+# The placeholder that shipped uncommented in docker-compose.yml counts as unset.
+# It signs the session and remember-me cookies, so anyone who had read it in the
+# public repo could forge an admin cookie against an instance still carrying it.
+if [ "$SECRET_KEY" = "replace_this_with_some_random_string" ]; then
+    warn "SECRET_KEY is still the example value from docker-compose.yml — ignoring it and using a generated key instead."
+    warn "Remove that line from your compose file; a key is generated and kept in /data automatically."
+    SECRET_KEY=""
+fi
+
+# Kept in the data directory rather than regenerated per boot, so a restart does
+# not sign every existing session out.
+SECRET_KEY_FILE="$DATA_DIRECTORY/.secret_key"
 if [ -z "$SECRET_KEY" ]; then
-    export SECRET_KEY=$(python3 -c "import secrets; print(secrets.token_hex(32))")
-    log "SECRET_KEY not set — generated ephemeral key for this session"
+    if [ -s "$SECRET_KEY_FILE" ]; then
+        SECRET_KEY=$(cat "$SECRET_KEY_FILE")
+        log "Loaded persisted SECRET_KEY from $SECRET_KEY_FILE"
+    else
+        SECRET_KEY=$(python3 -c "import secrets; print(secrets.token_hex(32))")
+        if (umask 077 && printf '%s' "$SECRET_KEY" > "$SECRET_KEY_FILE") 2>/dev/null; then
+            chown appuser:appuser "$SECRET_KEY_FILE" 2>/dev/null || true
+            log "SECRET_KEY not set — generated one and saved it to $SECRET_KEY_FILE"
+        else
+            warn "SECRET_KEY not set and $SECRET_KEY_FILE is not writable — using an ephemeral key; sessions will not survive a restart."
+        fi
+    fi
 fi
+export SECRET_KEY
 
 # ── Database ──────────────────────────────────────────────────────────────────
 section "Database"

From 1dd88b9af49fe8bec0c889c6b57fceb30b0263b7 Mon Sep 17 00:00:00 2001
From: Shane Israel <shanemisrael@gmail.com>
Date: Mon, 14 Sep 2026 12:48:52 -0600
Subject: [PATCH 3/5] fix: tell games apart that differ only in case
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

"RUMBLE" and "rumble" are both real games, and clips of the first kept being
suggested as the second.

Two faults behind it. The local match built its rapidfuzz choices as a list of
(name, game) tuples, so the query was scored against the tuple rather than the
name and every candidate came back 0 — nothing could clear the cutoff, so no
filename ever matched a game already in the library and every lookup fell
through to a SteamGridDB search. (Had one ever scored, the game was read out of
result[2], which for a list of choices is the index, not the element.) The
search it fell through to was handed a filename that had been lowercased for
cleaning, and took whichever hit SteamGridDB returned first — between two names
differing only in case, that is a coin flip.

Matching now scores case-insensitively, which is what the lowercasing was
reaching for, and the filename keeps its original case so an exact hit can still
be recognised. An exact, case-sensitive match wins outright, both against the
local library and among the search results. Where the library holds several
games whose names differ only in case and none matches exactly, no suggestion is
offered rather than guessing.

Fixes #728
---
 app/server/fireshare/util.py | 108 +++++++++++++++++++++++++++--------
 1 file changed, 83 insertions(+), 25 deletions(-)

diff --git a/app/server/fireshare/util.py b/app/server/fireshare/util.py
index fd44edaa..1facee2a 100755
--- a/app/server/fireshare/util.py
+++ b/app/server/fireshare/util.py
@@ -1167,6 +1167,74 @@ def seconds_to_dur_string(sec):
     else:
         return ':'.join([str(mins), str(s).zfill(2)])
 
+def _match_game_by_name(query, games, score_cutoff):
+    """Pick the local game a name refers to, preferring an exact match to a fuzzy one.
+
+    Two things this has to get right, both of which the previous inline
+    process.extractOne() call did not:
+
+    * It was handed a list of (name, game) tuples as the choices, so rapidfuzz
+      scored the query against the tuple rather than the name and returned 0 for
+      everything — no local match could ever clear the cutoff, and every lookup
+      fell through to a SteamGridDB search. It also read the game back out of
+      result[2], which for a list of choices is the index, not the element.
+    * Scoring is case-insensitive, because a filename's casing rarely matches the
+      publisher's. But an exact, case-sensitive hit is taken first, so two games
+      whose names differ only in case ("RUMBLE" and "rumble" are both real, and
+      different, games) stay distinguishable instead of being decided by whichever
+      the scorer happened to reach first.
+
+    Returns (game, score_out_of_100), or (None, 0) when nothing is a safe answer.
+    """
+    from rapidfuzz import fuzz, process
+
+    stripped = (query or '').strip()
+    if not stripped or not games:
+        return None, 0
+
+    for game in games:
+        if game.name == stripped:
+            return game, 100
+
+    same_but_for_case = [g for g in games if (g.name or '').lower() == stripped.lower()]
+    if len(same_but_for_case) == 1:
+        return same_but_for_case[0], 100
+    if same_but_for_case:
+        # Several games differ from each other only in case and none of them is an
+        # exact hit, so there is nothing left to choose on. Offering a coin flip is
+        # worse than offering nothing.
+        return None, 0
+
+    names = [g.name or '' for g in games]
+    result = process.extractOne(
+        stripped,
+        names,
+        scorer=fuzz.token_set_ratio,
+        processor=str.lower,
+        score_cutoff=score_cutoff,
+    )
+    if not result:
+        return None, 0
+    return games[result[2]], result[1]
+
+
+def _pick_steamgrid_result(query, results):
+    """Choose among SteamGridDB hits, preferring an exact name match to the top hit.
+
+    The autocomplete endpoint orders by its own relevance, which does not separate
+    two games whose names differ only in case, so taking results[0] on faith is how
+    a clip of "RUMBLE" ends up labelled "rumble".
+    """
+    stripped = (query or '').strip()
+    for result in results:
+        if (result.get('name') or '') == stripped:
+            return result
+    for result in results:
+        if (result.get('name') or '').lower() == stripped.lower():
+            return result
+    return results[0]
+
+
 def detect_game_from_filename(filename: str, steamgriddb_api_key: str = None, path: str = None):
     """
     Fuzzy match a video filename against existing games in database using RapidFuzz.
@@ -1180,7 +1248,6 @@ def detect_game_from_filename(filename: str, steamgriddb_api_key: str = None, pa
     Returns:
         dict with 'game_id', 'game_name', 'steamgriddb_id', 'confidence', 'source' or None
     """
-    from rapidfuzz import fuzz, process
     from fireshare.models import GameMetadata
     import re
 
@@ -1203,16 +1270,11 @@ def detect_game_from_filename(filename: str, steamgriddb_api_key: str = None, pa
                 # Try matching folder name against local game database
                 games = GameMetadata.query.all()
                 if games:
-                    game_choices = [(game.name, game) for game in games]
-                    result = process.extractOne(
-                        folder_name,
-                        game_choices,
-                        scorer=fuzz.token_set_ratio,
-                        score_cutoff=80  # Higher threshold for folder match
+                    matched_game, score = _match_game_by_name(
+                        folder_name, games, score_cutoff=80  # Higher threshold for folder match
                     )
 
-                    if result:
-                        matched_name, score, matched_game = result[0], result[1], result[2]
+                    if matched_game:
                         best_match = {
                             'game_id': matched_game.id,
                             'game_name': matched_game.name,
@@ -1232,7 +1294,7 @@ def detect_game_from_filename(filename: str, steamgriddb_api_key: str = None, pa
                     try:
                         results = client.search_games(folder_name)
                         if results and len(results) > 0:
-                            top_result = results[0]
+                            top_result = _pick_steamgrid_result(folder_name, results)
                             # Use higher confidence for folder-based SteamGridDB match
                             detected = {
                                 'game_id': None,
@@ -1249,8 +1311,10 @@ def detect_game_from_filename(filename: str, steamgriddb_api_key: str = None, pa
             else:
                 logger.debug(f"Skipping folder-based detection for upload folder: '{folder_name}'")
 
-    # Clean filename for better matching
-    clean_name = filename.lower()
+    # Clean filename for better matching. The original casing is kept: it is what
+    # tells "RUMBLE" from "rumble" further down, and the only pattern below that
+    # cares about case already asks for re.IGNORECASE.
+    clean_name = filename
     # Remove common patterns: dates, numbers, "gameplay", etc.
     clean_name = re.sub(r'\d{4}-\d{2}-\d{2}', '', clean_name)  # Remove dates like 2024-01-14
     clean_name = re.sub(r'\d{8}', '', clean_name)  # Remove YYYYMMDD format
@@ -1269,19 +1333,12 @@ def detect_game_from_filename(filename: str, steamgriddb_api_key: str = None, pa
     if not games:
         logger.debug("No games in database to match against")
     else:
-        # Create list of (game_name, game_object) tuples for rapidfuzz
-        game_choices = [(game.name, game) for game in games]
-
-        # Use token_set_ratio - ignores word order and extra words
-        result = process.extractOne(
-            clean_name,
-            game_choices,
-            scorer=fuzz.token_set_ratio,
-            score_cutoff=65  # Minimum confidence (0-100 scale)
+        # token_set_ratio ignores word order and extra words
+        matched_game, score = _match_game_by_name(
+            clean_name, games, score_cutoff=65  # Minimum confidence (0-100 scale)
         )
 
-        if result:
-            matched_name, score, matched_game = result[0], result[1], result[2]
+        if matched_game:
             best_match = {
                 'game_id': matched_game.id,
                 'game_name': matched_game.name,
@@ -1301,8 +1358,9 @@ def detect_game_from_filename(filename: str, steamgriddb_api_key: str = None, pa
         try:
             results = client.search_games(clean_name)
             if results and len(results) > 0:
-                # Take the first result (SteamGridDB returns best matches first)
-                top_result = results[0]
+                # SteamGridDB returns best matches first, but cannot tell two names
+                # apart that differ only in case, so prefer an exact hit if there is one.
+                top_result = _pick_steamgrid_result(clean_name, results)
                 detected = {
                     'game_id': None,  # Not in our DB yet
                     'game_name': top_result.get('name'),

From c55540ac5a7f7efa191b180010c5fd8f25c6bcb5 Mon Sep 17 00:00:00 2001
From: Shane Israel <shanemisrael@gmail.com>
Date: Mon, 14 Sep 2026 12:53:37 -0600
Subject: [PATCH 4/5] fix: break game-name ties on case instead of row order
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Follow-up to 1dd88b9. That commit only separated names that were equal but for
case, and declined to answer when it could not tell them apart. Two gaps.

A name reaches the fuzzy matcher far more often than expected: "RUMBLE_<date>_clip"
cleans to "RUMBLE clip", not "RUMBLE", because the word-stripping pattern needs a
word boundary and an underscore is a word character. So it was not an exact hit,
and token_set_ratio — scoring case-folded — put "RUMBLE" and "rumble" at 100
apiece. extractOne answers a tie with whichever it reached first, so the game
suggested depended on which of the two had been added to the library first. The
earlier test only looked right because of the order the rows happened to go in.

Ties are now settled on how far each candidate's own casing is echoed by the
query, which is the only signal left once case has been folded away, and the
result no longer varies with row order. That also gives the ambiguous case a
nearest answer rather than no answer, so the no-suggestion path is gone.
---
 app/server/fireshare/util.py | 62 +++++++++++++++++++++++-------------
 1 file changed, 39 insertions(+), 23 deletions(-)

diff --git a/app/server/fireshare/util.py b/app/server/fireshare/util.py
index 1facee2a..21ac49a1 100755
--- a/app/server/fireshare/util.py
+++ b/app/server/fireshare/util.py
@@ -1167,11 +1167,24 @@ def seconds_to_dur_string(sec):
     else:
         return ':'.join([str(mins), str(s).zfill(2)])
 
+def _case_affinity(candidate, query):
+    """How strongly a candidate's own casing is echoed by the query.
+
+    Only ever used to break a tie. Folding case away is what lets a filename match
+    a game at all, but it also makes "RUMBLE" and "rumble" — two different games —
+    score identically against a clip named "RUMBLE clip". The casing the query
+    itself used is the only signal left to separate them.
+    """
+    if candidate and candidate in query:
+        return len(candidate)
+    return sum(1 for a, b in zip(candidate, query) if a == b)
+
+
 def _match_game_by_name(query, games, score_cutoff):
     """Pick the local game a name refers to, preferring an exact match to a fuzzy one.
 
-    Two things this has to get right, both of which the previous inline
-    process.extractOne() call did not:
+    Three things this has to get right, none of which the previous inline
+    process.extractOne() call did:
 
     * It was handed a list of (name, game) tuples as the choices, so rapidfuzz
       scored the query against the tuple rather than the name and returned 0 for
@@ -1179,12 +1192,14 @@ def _match_game_by_name(query, games, score_cutoff):
       fell through to a SteamGridDB search. It also read the game back out of
       result[2], which for a list of choices is the index, not the element.
     * Scoring is case-insensitive, because a filename's casing rarely matches the
-      publisher's. But an exact, case-sensitive hit is taken first, so two games
-      whose names differ only in case ("RUMBLE" and "rumble" are both real, and
-      different, games) stay distinguishable instead of being decided by whichever
-      the scorer happened to reach first.
-
-    Returns (game, score_out_of_100), or (None, 0) when nothing is a safe answer.
+      publisher's. An exact, case-sensitive hit is still taken first, so a name
+      that matches outright is never talked out of by a fuzzy score.
+    * Once case is folded away, names differing only in case tie. extractOne
+      resolves a tie by returning whichever it reached first, which is row order —
+      so which of two real games got suggested came down to which was added first.
+      Ties are broken on case instead.
+
+    Returns (game, score_out_of_100), or (None, 0) when nothing clears the cutoff.
     """
     from rapidfuzz import fuzz, process
 
@@ -1196,26 +1211,22 @@ def _match_game_by_name(query, games, score_cutoff):
         if game.name == stripped:
             return game, 100
 
-    same_but_for_case = [g for g in games if (g.name or '').lower() == stripped.lower()]
-    if len(same_but_for_case) == 1:
-        return same_but_for_case[0], 100
-    if same_but_for_case:
-        # Several games differ from each other only in case and none of them is an
-        # exact hit, so there is nothing left to choose on. Offering a coin flip is
-        # worse than offering nothing.
-        return None, 0
-
     names = [g.name or '' for g in games]
-    result = process.extractOne(
+    scored = process.extract(
         stripped,
         names,
         scorer=fuzz.token_set_ratio,
         processor=str.lower,
         score_cutoff=score_cutoff,
+        limit=None,
     )
-    if not result:
+    if not scored:
         return None, 0
-    return games[result[2]], result[1]
+
+    best_score = max(entry[1] for entry in scored)
+    tied = [entry for entry in scored if entry[1] == best_score]
+    best = max(tied, key=lambda entry: (_case_affinity(entry[0], stripped), entry[0]))
+    return games[best[2]], best_score
 
 
 def _pick_steamgrid_result(query, results):
@@ -1229,9 +1240,14 @@ def _pick_steamgrid_result(query, results):
     for result in results:
         if (result.get('name') or '') == stripped:
             return result
-    for result in results:
-        if (result.get('name') or '').lower() == stripped.lower():
-            return result
+    case_variants = [r for r in results if (r.get('name') or '').lower() == stripped.lower()]
+    if case_variants:
+        # Same tie-break as the local lookup: nearest on case, rather than trusting
+        # an ordering that does not distinguish these at all.
+        return max(
+            case_variants,
+            key=lambda r: (_case_affinity(r.get('name') or '', stripped), r.get('name') or ''),
+        )
     return results[0]
 
 

From 1e3f50012bc6636de40ce4f23876f7683499df01 Mon Sep 17 00:00:00 2001
From: Shane Israel <shanemisrael@gmail.com>
Date: Mon, 14 Sep 2026 13:06:56 -0600
Subject: [PATCH 5/5] docs: document CORS_ORIGINS and SECURE_COOKIES
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Both were added without documentation. Security.md gains a section covering
them, leading with the fact that a normal deployment needs neither: Fireshare
serves its own frontend, so nothing is cross-origin, and Secure cookies are only
correct once HTTPS is actually in front of the instance. The failure mode for
each is the part worth writing down — an origin that does not match is silently
not allowed, and a Secure cookie on a plain-HTTP instance is discarded by the
browser after a login that otherwise looks like it worked.

The same section takes over describing the session signing key, which several
places still described as regenerated on every restart. It is now generated once
and persisted, so the standing advice to set one yourself, the troubleshooting
entry for being logged out on restart, and the environment variable table were
all telling operators to fix something that no longer happens.

Also drops the placeholder SECRET_KEY from the README's compose example, which
was still handing out a value to paste in. That example used a different
placeholder from the one docker-compose.yml carried, and only the latter was
refused on startup; both are now.
---
 README.md                        |   3 +-
 app/server/fireshare/__init__.py |  17 ++++--
 docs/EnvironmentVariables.md     |   6 +-
 docs/Security.md                 | 101 ++++++++++++++++++++++++++++++-
 docs/TROUBLESHOOTING.md          |  21 ++++---
 entrypoint.sh                    |  18 +++---
 6 files changed, 136 insertions(+), 30 deletions(-)

diff --git a/README.md b/README.md
index 0844c2b1..60ad72ee 100644
--- a/README.md
+++ b/README.md
@@ -131,7 +131,8 @@ services:
     environment:
       - ADMIN_USERNAME=your-admin-username
       - ADMIN_PASSWORD=your-admin-password
-      - SECRET_KEY=replace_with_random_string_can_be_anything
+      # A key for signing login cookies is generated on first start and kept in
+      # /data, so there is nothing to set here. See docs/Security.md
       # The domain your instance is hosted at. e.x: demo.fireshare.net
       # this is required for opengraph to work correctly for shared links.
       - DOMAIN=
diff --git a/app/server/fireshare/__init__.py b/app/server/fireshare/__init__.py
index ce7d026c..d865b0f9 100644
--- a/app/server/fireshare/__init__.py
+++ b/app/server/fireshare/__init__.py
@@ -149,14 +149,19 @@ def create_app(init_schedule=False):
     app.config['DOMAIN'] = os.getenv('DOMAIN')
     app.config['THUMBNAIL_VIDEO_LOCATION'] = int(os.getenv('THUMBNAIL_VIDEO_LOCATION') or 0)
 
-    # The example value shipped uncommented in docker-compose.yml, so instances that
-    # never edited it were all signing cookies with a key published in this repo —
-    # enough to forge an admin remember-me cookie. Treat it as if it were unset.
+    # Both of these shipped filled in — one in docker-compose.yml, one in the README's
+    # compose example — so instances that never edited the line were signing cookies
+    # with a key published in this repo. A signing key is worth nothing once public,
+    # so treat either as if it were unset.
+    PUBLISHED_SECRET_KEYS = {
+        'replace_this_with_some_random_string',
+        'replace_with_random_string_can_be_anything',
+    }
     _secret_key = os.getenv('SECRET_KEY') or ''
-    if _secret_key == 'replace_this_with_some_random_string':
+    if _secret_key in PUBLISHED_SECRET_KEYS:
         logger.warning(
-            "SECRET_KEY is set to the example value from docker-compose.yml. That key is "
-            "public, so it is being ignored in favour of a generated one. Remove the line "
+            "SECRET_KEY is set to an example value published in the Fireshare docs. That key "
+            "is public, so it is being ignored in favour of a generated one. Remove the line "
             "from your compose file; sessions will not survive a restart until you do."
         )
         _secret_key = ''
diff --git a/docs/EnvironmentVariables.md b/docs/EnvironmentVariables.md
index 33e96647..5ab3f9d2 100644
--- a/docs/EnvironmentVariables.md
+++ b/docs/EnvironmentVariables.md
@@ -20,14 +20,16 @@
 | `DEMO_UPLOAD_LIMIT_MB`        | Maximum upload size in MB when `DEMO_MODE` is enabled. Files over the limit are rejected before upload begins. `0` disables the limit.                                                                                   | `0`                           |
 | `DEMO_MODE_DELETE_ALL`        | Set to `true` to wipe all data, processed, video, and image directories on container startup. Only takes effect when `DEMO_MODE` is also `true`. Useful for resetting a demo instance to a clean state on every restart. | `false`                       |
 | **Security**                  |                                                                                                                                                                                                                          |                               |
-| `SECRET_KEY`                  | Flask session encryption key. If not set, a random key is generated on each restart, which invalidates all active sessions.                                                                                              | some random string or phrase  |
+| `SECRET_KEY`                  | Signs the login cookies. **You do not need to set this** — a random key is generated on first start and persisted to `/data/.secret_key`, so sessions survive restarts. Set it only when several containers must share sessions, and never to a value published anywhere. [See Docs](./Security.md#the-session-signing-key) | *(generated)*                 |
 | `ADMIN_USERNAME`              | The username for the initial administrative account.                                                                                                                                                                     | `admin`                       |
 | `ADMIN_PASSWORD`              | The password for the initial administrative account.                                                                                                                                                                     | `admin`                       |
 | `DISABLE_ADMINCREATE`         | Set to `true` to prevent automatic admin account creation on first run.                                                                                                                                                  | `false`                       |
 | `LOGIN_IP_WHITELIST`          | Comma-separated list of IP addresses and/or CIDR ranges (IPv4 and IPv6) allowed to log in, e.g. `203.0.113.5,10.0.0.0/8,2001:db8::/32`. When set, login requests from any other IP are rejected and the login page is hidden. Empty/unset disables the whitelist. The container fails to start if an entry is malformed. [See Docs](./Security.md#login-ip-whitelist) |                               |
 | `LOGIN_IP_WHITELIST_TRUSTED_PROXIES` | Number of trusted reverse-proxy hops in front of the app, used to determine the real client IP. The bundled nginx counts as one hop. Set to `2` when running behind an additional reverse proxy (Traefik, Nginx Proxy Manager, Cloudflare, ...). [See Docs](./Security.md#how-the-client-ip-is-determined) | `1`                           |
 | ~~LDAP~~                      | **Removed.** LDAP authentication is no longer supported. Fireshare refuses to start while any `LDAP_*` variable is still set — see [Users.md](./Users.md#ldap-has-been-removed).                                          |                               |
-| MFA / 2FA                     | Authenticator-app two-factor authentication requires no environment variables — enable it per account in Settings → Security. See [Security.md](./Security.md#two-factor-authentication-mfa). A persistent `SECRET_KEY` is recommended so logins survive restarts.  |                               |
+| MFA / 2FA                     | Authenticator-app two-factor authentication requires no environment variables — enable it per account in Settings → Security. See [Security.md](./Security.md#two-factor-authentication-mfa).                              |                               |
+| `CORS_ORIGINS`                | Comma-separated origins allowed to call the API from a different origin, with cookies, e.g. `https://app.example.com,http://192.168.1.50:3000`. Unset means same-origin only, which is what a normal deployment wants — set it only if the frontend is served separately. Each entry is a full origin (scheme, host, port) matched exactly; `*` is rejected. [See Docs](./Security.md#cross-origin-requests-cors_origins) | *(unset)*                     |
+| `SECURE_COOKIES`              | Set to `true` to mark the login cookies `Secure` so browsers only send them over HTTPS. Leave `false` if you reach Fireshare over plain HTTP, or logging in will silently fail. The cookies are always `HttpOnly` and `SameSite=Lax` regardless. [See Docs](./Security.md#cookie-flags-secure_cookies) | `false`                       |
 | **Transcoding**               |                                                                                                                                                                                                                          |                               |
 | `ENABLE_TRANSCODING`          | Set to `true` to enable video transcoding. See [README](./README.md#transcoding-optional) for details.                                                                                                                   | `false`                       |
 | `TRANSCODE_GPU`               | Set to `true` to use NVIDIA GPU (NVENC) for transcoding instead of CPU. Requires an NVIDIA GPU with NVENC support.                                                                                                       | `false`                       |
diff --git a/docs/Security.md b/docs/Security.md
index 9f2df99e..7b15a41c 100644
--- a/docs/Security.md
+++ b/docs/Security.md
@@ -6,6 +6,11 @@ can be used together.
 - [Login IP Whitelist](#login-ip-whitelist) — restrict which IPs may log in.
 - [Two-Factor Authentication (MFA)](#two-factor-authentication-mfa) — require a TOTP code after the password.
 
+Separate from those, [Cookies and cross-origin access](#cookies-and-cross-origin-access) covers the
+browser-facing defaults and the two variables that change them. The defaults suit a normal deployment;
+you only need that section if you serve the frontend from a different origin, or you terminate HTTPS
+and want to say so.
+
 ---
 
 ## Login IP Whitelist
@@ -148,11 +153,101 @@ with its password alone, and MFA can be set up again from Settings.
 ### Notes and limitations
 
 - **The demo account is excluded.**
-- **Set a persistent `SECRET_KEY`.** Sessions, including the short-lived state between the password and
-  code steps, are signed with it; without one, every restart invalidates all sessions. See
-  [EnvironmentVariables.md](./EnvironmentVariables.md).
+- **Sessions are signed with the instance's session key**, including the short-lived state between the
+  password and code steps. Fireshare generates and persists one for you — see
+  [The session signing key](#the-session-signing-key).
 - Codes validate with a ±30 second tolerance, so keep the server and phone clocks reasonably accurate.
 
+---
+
+## Cookies and cross-origin access
+
+Fireshare serves its own frontend, so the browser calls the API from the same origin it loaded the page
+from. The defaults assume exactly that, and **a normal deployment needs nothing here.**
+
+| Variable         | Description                                                                                                     | Default     |
+| ---------------- | --------------------------------------------------------------------------------------------------------------- | ----------- |
+| `CORS_ORIGINS`   | Comma-separated origins allowed to call the API from a *different* origin, with cookies. Unset means same-origin only. | *(unset)* |
+| `SECURE_COOKIES` | Set to `true` to mark the login cookies `Secure`, so browsers only ever send them over HTTPS.                     | `false`     |
+
+### Cross-origin requests (`CORS_ORIGINS`)
+
+Unset, the API answers no cross-origin request. This is what you want when Fireshare serves its own
+frontend: the page and the API share an origin, so nothing is cross-origin in the first place.
+
+Set it only if the frontend is served from somewhere else — a separate dev server, or a frontend hosted
+apart from the backend:
+
+```yaml
+# docker-compose.yml
+environment:
+  - CORS_ORIGINS=https://fireshare.example.com,http://192.168.1.50:3000
+```
+
+Each entry is a full origin — scheme, host, and port if it isn't the default — matched exactly:
+
+| Entry                       | Matches                                             |
+| --------------------------- | --------------------------------------------------- |
+| `https://app.example.com`   | ✅ `https://app.example.com`                         |
+|                             | ❌ `http://app.example.com` — different scheme       |
+|                             | ❌ `https://app.example.com:8443` — different port   |
+| `http://192.168.1.50:3000`  | ✅ only that host **and** port                       |
+
+No trailing slash, and no paths — `https://app.example.com/` is not an origin and matches nothing. On
+startup, an active list logs:
+
+```
+CORS enabled for: https://fireshare.example.com
+```
+
+> **`*` is rejected.** Allowing any origin while also allowing cookies means any site your users visit
+> could call the API as them, which browsers refuse to do in the literal `*` form for that exact reason.
+> A `*` entry is dropped with a warning in the logs; list the origins you actually need.
+
+### Cookie flags (`SECURE_COOKIES`)
+
+The login cookies are always `HttpOnly` (unreadable from JavaScript) and always `SameSite=Lax`, so
+another site's scripts cannot cause a browser to attach them to a background request aimed at your
+instance. (`Lax` still allows them on an ordinary top-level link click, which is what keeps shared
+links working when you are already signed in.)
+
+`Secure` is the one part left to you, because it depends on how you reach your instance. It defaults to
+off: plenty of instances are reached over plain HTTP on a LAN, and a `Secure` cookie is simply never
+sent over HTTP, so defaulting it on would leave those users unable to log in at all.
+
+**Set it to `true` if you reach Fireshare over HTTPS** — directly, or through a reverse proxy that
+terminates TLS:
+
+```yaml
+environment:
+  - SECURE_COOKIES=true
+```
+
+> **Turn this on only once HTTPS actually works.** With `SECURE_COOKIES=true` on a plain-HTTP instance,
+> the login request succeeds and the browser then discards the cookie, so you land back on the login
+> page with no error. If that happens, set it back to `false` and restart.
+
+### The session signing key
+
+Login cookies are signed with a per-instance key. You do not need to set one: Fireshare generates a
+random key on first start and saves it to `/data/.secret_key`, so it survives restarts and upgrades and
+sessions stay valid across them.
+
+Set `SECRET_KEY` yourself only if several Fireshare containers have to share sessions, in which case
+give them all the same long random value:
+
+```sh
+python3 -c "import secrets; print(secrets.token_hex(32))"
+```
+
+> **Don't paste an example value from any documentation, including this repo's.** A signing key is only
+> worth anything while it is secret to your instance — a value published anywhere is a value anyone can
+> sign a cookie with. Older compose files and README examples shipped with a placeholder filled in; if
+> yours still has one, delete the line and let Fireshare generate its own. Those published placeholders
+> are refused on startup and replaced with a generated key, which signs out existing sessions once.
+
+---
+
 ## User accounts and permissions
 
 Account creation, per-user permissions, password setup links, and the guardrails that keep an instance from losing its last administrator are documented in [Users, Permissions, and Profiles](./Users.md).
diff --git a/docs/TROUBLESHOOTING.md b/docs/TROUBLESHOOTING.md
index 9907b3c8..fbbc59d1 100644
--- a/docs/TROUBLESHOOTING.md
+++ b/docs/TROUBLESHOOTING.md
@@ -166,19 +166,20 @@ only valid within a ±30 second window.
 
 ## Sessions Expire on Every Restart
 
-If users are logged out every time the container restarts, `SECRET_KEY` is not set.
+Current versions generate a signing key on first start and persist it to `/data/.secret_key`, so
+sessions survive restarts on their own. If everyone is still logged out on every restart, that file is
+not surviving:
 
-Without `SECRET_KEY`, a random key is generated on each startup, invalidating all existing session cookies.
+- **`/data` isn't a persistent volume**, or is mounted read-only. Check the mount, then look for
+  `generated one and saved it to` in the startup logs. If instead you see `not writable — using an
+  ephemeral key`, the container cannot write to `/data`.
+- **`SECRET_KEY` is set to a different value on each start.** Either leave it unset and let Fireshare
+  manage it, or set one fixed value.
 
-**Fix:** Set a stable, random value in your environment:
-```yaml
-SECRET_KEY=some-long-random-string-here
-```
+A single sign-out after upgrading is expected if your compose file still carries the old example
+`SECRET_KEY`: that published value is refused and replaced with a generated one. Delete the line.
 
-Generate one with:
-```sh
-python3 -c "import secrets; print(secrets.token_hex(32))"
-```
+See [Security.md](./Security.md#the-session-signing-key).
 
 ---
 
diff --git a/entrypoint.sh b/entrypoint.sh
index aa3a067b..e0767ef7 100755
--- a/entrypoint.sh
+++ b/entrypoint.sh
@@ -120,14 +120,16 @@ log "Nginx ready"
 export PATH=/opt/python3.14/bin:/usr/local/bin:$PATH
 export LD_LIBRARY_PATH=/usr/local/nvidia/lib:/usr/local/nvidia/lib64:/usr/local/lib:/usr/local/cuda/lib64:${LD_LIBRARY_PATH}
 
-# The placeholder that shipped uncommented in docker-compose.yml counts as unset.
-# It signs the session and remember-me cookies, so anyone who had read it in the
-# public repo could forge an admin cookie against an instance still carrying it.
-if [ "$SECRET_KEY" = "replace_this_with_some_random_string" ]; then
-    warn "SECRET_KEY is still the example value from docker-compose.yml — ignoring it and using a generated key instead."
-    warn "Remove that line from your compose file; a key is generated and kept in /data automatically."
-    SECRET_KEY=""
-fi
+# Both placeholders shipped filled in — one in docker-compose.yml, one in the
+# README's compose example — so an instance that never edited the line signs its
+# login cookies with a key published in the repo. Either counts as unset.
+case "$SECRET_KEY" in
+    replace_this_with_some_random_string|replace_with_random_string_can_be_anything)
+        warn "SECRET_KEY is still an example value from the Fireshare docs — ignoring it and using a generated key instead."
+        warn "Remove that line from your compose file; a key is generated and kept in /data automatically."
+        SECRET_KEY=""
+        ;;
+esac
 
 # Kept in the data directory rather than regenerated per boot, so a restart does
 # not sign every existing session out.