[1.30.0] Update ampache to 8.1.0 Full Changelog Proof of work checks in front of the endpoints bots hammer Database 810011: New album.enabled and artist.enabled, so a release can be withdrawn without deleting it and losing its playlist entries, ratings and play history New album_grouping_fields option controlling which fields decide whether two songs share an album row Drawn cover art for items that have none: an album gets a record, an artist a medallion, an orphaned song a waveform, a playlist a tracklist The OPML export of podcast subscriptions read every podcast in the system regardless of the caller's catalog filter, letting a restricted user enumerate the subscriptions of catalogs they cannot browse A username was used raw as an upload folder name, so ../.. escaped the catalog. Path segments are no longer allowed in username A disabled user account could still authenticate through Subsonic and an RSS feed token Password/token comparisons in the API handshake, the session_remember cookie MAC, and API key/stream token lookups used ===/!= instead of hash_equals() Ldap::auth() concatenated the raw username into the LDAP search filter and group-membership regex with no escaping Private playlists and searches leaked through several endpoints: web smartlist, Subsonic getPlaylist/getPlaylists