Releases: Rudloff/alltube
3.2.0-alpha: Switched to yt-dlp instead of youtube-dl
PHP 7.4+ is now required
3.1.1
3.1.0
3.0.3
This release fixes a vulnerability that could be used to trigger either an open redirect attack or a Server-Side Request Forgery attack (see GHSA-75p7-527p-w8wp).
The fix requires applying a patch to youtube-dl to disable its generic extractor. If you are using the version of youtube-dl bundled with 3.0.3, it is already patched.
However, if you are using your own unpatched version of youtube-dl you might still be vulnerable.
3.0.2
This release fixes a Server-Side Request Forgery vulnerability that could be used to send a request to an internal hostname (see GHSA-r5hc-wm3g-hjw6).
Part of the fix requires applying a patch to youtube-dl to prevent it from following HTTP redirects. If you are using the version of youtube-dl bundled with 3.0.2, it is already patched.
However, if you are using your own unpatched version of youtube-dl you might still be vulnerable.
3.0.1
This release fixes an open redirect vulnerability that could be used to construct a URL redirecting to an arbitrary domain (see GHSA-jmhf-9fj8-88gh).
3.0.0: This release contains several breaking changes:
The Video class is now available as a separate Composer package (rudloff/alltube-library) The release package and Docker image now contain only production dependencies youtube-dl is now a production dependency Composer does not install ffmpeg or phantomjs anymore The "avconv" and "avconvVerbosity" options are now respectively "ffmpeg" and "ffmpegVerbosity" Other changes: Setting the "stream" option to "ask" now works correctly New locales are automatically detected New Italian translation (thanks to @holoitsme) If the "best" format does not exist, it will fall back to "bestvideo" Composer 2 compatibility youtube-dl and ffmpeg commands are now logged when debug mode is enabled 404 and 405 error pages now have the same style as the other pages The new "defaultAudio" option allows converting to audio by default (thanks to @bellington3) The Heroku build now uses Python 3 (thanks to @telegrambotdev) The app now supports the container Heroku stack (thanks to @telegrambotdev) The new "convertSeek" option allows disabling seeking when converting to audio (thanks to @bellington3) Exceptions are now logged AllTube can now run correctly behind a reverse proxy with a custom path or port (thanks to @bellington3)
3.0.0-beta5
Composer 2 compatibility Updated youtube-dl to 2020.11.12 Make sure locale is always set, even on first request
3.0.0-beta4
Fixed the CSP because it was breaking downloads on Chrome (#327) Upgraded youtube-dl to 2020.11.01.1 (#326)
3.0.0-beta3
We now temporarily get youtube-dl from PyPI (because their GitHub rep…