Bump version to 4.0.17

Closes #8270

.github/workflows/build.yml

@@ -22,7 +22,7 @@ env:
   FRAMEWORK: net6.0
   RAW_BRANCH_NAME: ${{ github.head_ref || github.ref_name }}
   SONARR_MAJOR_VERSION: 4
-  VERSION: 4.0.15
+  VERSION: 4.0.17
 
 jobs:
   backend:

frontend/src/Components/Modal/Modal.css

@@ -19,6 +19,7 @@
 .modal {
   position: relative;
   display: flex;
+  max-width: 90%;
   max-height: 90%;
   border-radius: 6px;
   opacity: 1;

src/NzbDrone.Common/Http/HttpRequestBuilder.cs

@@ -390,5 +390,12 @@ namespace NzbDrone.Common.Http
 
             return this;
         }
+
+        public virtual HttpRequestBuilder AllowRedirect(bool allowAutoRedirect = true)
+        {
+            AllowAutoRedirect = allowAutoRedirect;
+
+            return this;
+        }
     }
 }

src/NzbDrone.Common/Utf8StringWriter.cs

@@ -0,0 +1,9 @@
+using System.IO;
+using System.Text;
+
+namespace NzbDrone.Common;
+
+public class Utf8StringWriter : StringWriter
+{
+    public override Encoding Encoding => Encoding.UTF8;
+}

src/NzbDrone.Core.Test/MediaFiles/EpisodeImport/DetectSampleFixture.cs

@@ -213,5 +213,16 @@ namespace NzbDrone.Core.Test.MediaFiles.EpisodeImport
 
             Subject.IsSample(_localEpisode).Should().Be(DetectSampleResult.Sample);
         }
+
+        [Test]
+        public void should_default_to_45_minutes_if_runtime_is_zero()
+        {
+            GivenRuntime(120);
+
+            _localEpisode.Series.Runtime = 0;
+            _localEpisode.Episodes.First().Runtime = 0;
+
+            Subject.IsSample(_localEpisode).Should().Be(DetectSampleResult.Sample);
+        }
     }
 }

src/NzbDrone.Core/Download/Clients/QBittorrent/QBittorrentProxyV2.cs

@@ -425,8 +425,8 @@ namespace NzbDrone.Core.Download.Clients.QBittorrent
                 }
                 catch (HttpException ex)
                 {
-                    _logger.Debug("qbitTorrent authentication failed.");
-                    if (ex.Response.StatusCode == HttpStatusCode.Forbidden)
+                    _logger.Debug(ex, "qbitTorrent authentication failed.");
+                    if (ex.Response.StatusCode is HttpStatusCode.Unauthorized or HttpStatusCode.Forbidden)
                     {
                         throw new DownloadClientAuthenticationException("Failed to authenticate with qBittorrent.", ex);
                     }
@@ -438,7 +438,7 @@ namespace NzbDrone.Core.Download.Clients.QBittorrent
                     throw new DownloadClientUnavailableException("Failed to connect to qBittorrent, please check your settings.", ex);
                 }
 
-                if (response.Content != "Ok.")
+                if (response.Content.IsNotNullOrWhiteSpace() && response.Content != "Ok.")
                 {
                     // returns "Fails." on bad login
                     _logger.Debug("qbitTorrent authentication failed.");

src/NzbDrone.Core/Extras/Metadata/Consumers/Plex/PlexMetadata.cs

@@ -73,7 +73,7 @@ namespace NzbDrone.Core.Extras.Metadata.Consumers.Plex
 
                     if (episodeFile.SeasonNumber == 0)
                     {
-                        episodeFormat = $"SP{episodesInFile.First():00}";
+                        episodeFormat = $"SP{episodesInFile.First().EpisodeNumber:00}";
                     }
 
                     content.AppendLine($"Episode: {episodeFormat}: {episodeFile.RelativePath}");

src/NzbDrone.Core/Extras/Metadata/Consumers/Xbmc/XbmcMetadata.cs

@@ -8,6 +8,7 @@ using System.Text.RegularExpressions;
 using System.Xml;
 using System.Xml.Linq;
 using NLog;
+using NzbDrone.Common;
 using NzbDrone.Common.Disk;
 using NzbDrone.Common.Extensions;
 using NzbDrone.Common.Serializer;
@@ -149,110 +150,116 @@ namespace NzbDrone.Core.Extras.Metadata.Consumers.Xbmc
             if (Settings.SeriesMetadata)
             {
                 _logger.Debug("Generating Series Metadata for: {0}", series.Title);
-                var sb = new StringBuilder();
-                var xws = new XmlWriterSettings();
-                xws.OmitXmlDeclaration = true;
-                xws.Indent = false;
 
-                using (var xw = XmlWriter.Create(sb, xws))
+                var tvShow = new XElement("tvshow");
+
+                tvShow.Add(new XElement("title", series.Title));
+
+                if (series.Ratings != null && series.Ratings.Votes > 0)
                 {
-                    var tvShow = new XElement("tvshow");
-
-                    tvShow.Add(new XElement("title", series.Title));
-
-                    if (series.Ratings != null && series.Ratings.Votes > 0)
-                    {
-                        tvShow.Add(new XElement("rating", series.Ratings.Value));
-                    }
-
-                    tvShow.Add(new XElement("plot", series.Overview));
-                    tvShow.Add(new XElement("mpaa", series.Certification));
-                    tvShow.Add(new XElement("id", series.TvdbId));
-
-                    var uniqueId = new XElement("uniqueid", series.TvdbId);
-                    uniqueId.SetAttributeValue("type", "tvdb");
-                    uniqueId.SetAttributeValue("default", true);
-                    tvShow.Add(uniqueId);
-
-                    if (series.ImdbId.IsNotNullOrWhiteSpace())
-                    {
-                        var imdbId = new XElement("uniqueid", series.ImdbId);
-                        imdbId.SetAttributeValue("type", "imdb");
-                        tvShow.Add(imdbId);
-                    }
-
-                    if (series.TmdbId > 0)
-                    {
-                        var tmdbId = new XElement("uniqueid", series.TmdbId);
-                        tmdbId.SetAttributeValue("type", "tmdb");
-                        tvShow.Add(tmdbId);
-                    }
-
-                    if (series.TvMazeId > 0)
-                    {
-                        var tvMazeId = new XElement("uniqueid", series.TvMazeId);
-                        tvMazeId.SetAttributeValue("type", "tvmaze");
-                        tvShow.Add(tvMazeId);
-                    }
-
-                    foreach (var genre in series.Genres)
-                    {
-                        tvShow.Add(new XElement("genre", genre));
-                    }
-
-                    if (series.Tags.Any())
-                    {
-                        var tags = _tagRepo.GetTags(series.Tags);
-
-                        foreach (var tag in tags)
-                        {
-                            tvShow.Add(new XElement("tag", tag.Label));
-                        }
-                    }
-
-                    tvShow.Add(new XElement("status", series.Status));
-
-                    if (series.FirstAired.HasValue)
-                    {
-                        tvShow.Add(new XElement("premiered", series.FirstAired.Value.ToString("yyyy-MM-dd")));
-                    }
-
-                    // Add support for Jellyfin's "enddate" tag
-                    if (series.Status == SeriesStatusType.Ended && series.LastAired.HasValue)
-                    {
-                        tvShow.Add(new XElement("enddate", series.LastAired.Value.ToString("yyyy-MM-dd")));
-                    }
-
-                    tvShow.Add(new XElement("studio", series.Network));
-
-                    foreach (var actor in series.Actors)
-                    {
-                        var xmlActor = new XElement("actor",
-                            new XElement("name", actor.Name),
-                            new XElement("role", actor.Character));
-
-                        if (actor.Images.Any())
-                        {
-                            xmlActor.Add(new XElement("thumb", actor.Images.First().RemoteUrl));
-                        }
-
-                        tvShow.Add(xmlActor);
-                    }
-
-                    if (Settings.SeriesMetadataEpisodeGuide)
-                    {
-                        var episodeGuide = new KodiEpisodeGuide(series);
-                        var serializerSettings = STJson.GetSerializerSettings();
-                        serializerSettings.WriteIndented = false;
-
-                        tvShow.Add(new XElement("episodeguide", JsonSerializer.Serialize(episodeGuide, serializerSettings)));
-                    }
-
-                    var doc = new XDocument(tvShow);
-                    doc.Save(xw);
-
-                    xmlResult += doc.ToString();
+                    tvShow.Add(new XElement("rating", series.Ratings.Value));
                 }
+
+                tvShow.Add(new XElement("plot", series.Overview));
+                tvShow.Add(new XElement("mpaa", series.Certification));
+                tvShow.Add(new XElement("id", series.TvdbId));
+
+                var uniqueId = new XElement("uniqueid", series.TvdbId);
+                uniqueId.SetAttributeValue("type", "tvdb");
+                uniqueId.SetAttributeValue("default", true);
+                tvShow.Add(uniqueId);
+
+                if (series.ImdbId.IsNotNullOrWhiteSpace())
+                {
+                    var imdbId = new XElement("uniqueid", series.ImdbId);
+                    imdbId.SetAttributeValue("type", "imdb");
+                    tvShow.Add(imdbId);
+                }
+
+                if (series.TmdbId > 0)
+                {
+                    var tmdbId = new XElement("uniqueid", series.TmdbId);
+                    tmdbId.SetAttributeValue("type", "tmdb");
+                    tvShow.Add(tmdbId);
+                }
+
+                if (series.TvMazeId > 0)
+                {
+                    var tvMazeId = new XElement("uniqueid", series.TvMazeId);
+                    tvMazeId.SetAttributeValue("type", "tvmaze");
+                    tvShow.Add(tvMazeId);
+                }
+
+                foreach (var genre in series.Genres)
+                {
+                    tvShow.Add(new XElement("genre", genre));
+                }
+
+                if (series.Tags.Any())
+                {
+                    var tags = _tagRepo.GetTags(series.Tags);
+
+                    foreach (var tag in tags)
+                    {
+                        tvShow.Add(new XElement("tag", tag.Label));
+                    }
+                }
+
+                tvShow.Add(new XElement("status", series.Status));
+
+                if (series.FirstAired.HasValue)
+                {
+                    tvShow.Add(new XElement("premiered", series.FirstAired.Value.ToString("yyyy-MM-dd")));
+                }
+
+                // Add support for Jellyfin's "enddate" tag
+                if (series.Status == SeriesStatusType.Ended && series.LastAired.HasValue)
+                {
+                    tvShow.Add(new XElement("enddate", series.LastAired.Value.ToString("yyyy-MM-dd")));
+                }
+
+                tvShow.Add(new XElement("studio", series.Network));
+
+                foreach (var actor in series.Actors)
+                {
+                    var xmlActor = new XElement("actor",
+                        new XElement("name", actor.Name),
+                        new XElement("role", actor.Character));
+
+                    if (actor.Images.Any())
+                    {
+                        xmlActor.Add(new XElement("thumb", actor.Images.First().RemoteUrl));
+                    }
+
+                    tvShow.Add(xmlActor);
+                }
+
+                if (Settings.SeriesMetadataEpisodeGuide)
+                {
+                    var episodeGuide = new KodiEpisodeGuide(series);
+                    var serializerSettings = STJson.GetSerializerSettings();
+                    serializerSettings.WriteIndented = false;
+
+                    tvShow.Add(new XElement("episodeguide", JsonSerializer.Serialize(episodeGuide, serializerSettings)));
+                }
+
+                var doc = new XDocument(tvShow)
+                {
+                    Declaration = new XDeclaration("1.0", "UTF-8", "yes"),
+                };
+
+                var sb = new StringBuilder();
+                using var sw = new Utf8StringWriter();
+                using var xw = XmlWriter.Create(sw, new XmlWriterSettings
+                {
+                    Encoding = Encoding.UTF8,
+                    Indent = true
+                });
+
+                doc.Save(xw);
+                xw.Flush();
+
+                xmlResult += sw.ToString();
             }
 
             if (Settings.SeriesMetadataUrl)
@@ -279,116 +286,117 @@ namespace NzbDrone.Core.Extras.Metadata.Consumers.Xbmc
 
             var watched = GetExistingWatchedStatus(series, episodeFile.RelativePath);
 
-            var xmlResult = string.Empty;
+            var xws = new XmlWriterSettings
+            {
+                Encoding = Encoding.UTF8,
+                Indent = true,
+                ConformanceLevel =  ConformanceLevel.Fragment
+            };
+
+            using var sw = new Utf8StringWriter();
+            using var xw = XmlWriter.Create(sw, xws);
+
+            xw.WriteProcessingInstruction("xml", "version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"");
+
             foreach (var episode in episodeFile.Episodes.Value)
             {
-                var sb = new StringBuilder();
-                var xws = new XmlWriterSettings();
-                xws.OmitXmlDeclaration = true;
-                xws.Indent = false;
+                var image = episode.Images.SingleOrDefault(i => i.CoverType == MediaCoverTypes.Screenshot);
 
-                using (var xw = XmlWriter.Create(sb, xws))
+                var details = new XElement("episodedetails");
+                details.Add(new XElement("title", episode.Title));
+                details.Add(new XElement("season", episode.SeasonNumber));
+                details.Add(new XElement("episode", episode.EpisodeNumber));
+                details.Add(new XElement("aired", episode.AirDate));
+                details.Add(new XElement("plot", episode.Overview));
+
+                if (episode.SeasonNumber == 0 && episode.AiredAfterSeasonNumber.HasValue)
                 {
-                    var doc = new XDocument();
-                    var image = episode.Images.SingleOrDefault(i => i.CoverType == MediaCoverTypes.Screenshot);
-
-                    var details = new XElement("episodedetails");
-                    details.Add(new XElement("title", episode.Title));
-                    details.Add(new XElement("season", episode.SeasonNumber));
-                    details.Add(new XElement("episode", episode.EpisodeNumber));
-                    details.Add(new XElement("aired", episode.AirDate));
-                    details.Add(new XElement("plot", episode.Overview));
-
-                    if (episode.SeasonNumber == 0 && episode.AiredAfterSeasonNumber.HasValue)
-                    {
-                        details.Add(new XElement("displayafterseason", episode.AiredAfterSeasonNumber));
-                    }
-                    else if (episode.SeasonNumber == 0 && episode.AiredBeforeSeasonNumber.HasValue)
-                    {
-                        details.Add(new XElement("displayseason", episode.AiredBeforeSeasonNumber));
-                        details.Add(new XElement("displayepisode", episode.AiredBeforeEpisodeNumber ?? -1));
-                    }
-
-                    var tvdbId = new XElement("uniqueid", episode.TvdbId);
-                    tvdbId.SetAttributeValue("type", "tvdb");
-                    tvdbId.SetAttributeValue("default", true);
-                    details.Add(tvdbId);
-
-                    var sonarrId = new XElement("uniqueid", episode.Id);
-                    sonarrId.SetAttributeValue("type", "sonarr");
-                    details.Add(sonarrId);
-
-                    if (image == null)
-                    {
-                        details.Add(new XElement("thumb"));
-                    }
-                    else if (Settings.EpisodeImageThumb)
-                    {
-                        details.Add(new XElement("thumb", image.RemoteUrl));
-                    }
-
-                    details.Add(new XElement("watched", watched));
-
-                    if (episode.Ratings != null && episode.Ratings.Votes > 0)
-                    {
-                        details.Add(new XElement("rating", episode.Ratings.Value));
-                    }
-
-                    if (episodeFile.MediaInfo != null)
-                    {
-                        var sceneName = episodeFile.GetSceneOrFileName();
-
-                        var fileInfo = new XElement("fileinfo");
-                        var streamDetails = new XElement("streamdetails");
-
-                        var video = new XElement("video");
-                        video.Add(new XElement("aspect", (float)episodeFile.MediaInfo.Width / (float)episodeFile.MediaInfo.Height));
-                        video.Add(new XElement("bitrate", episodeFile.MediaInfo.VideoBitrate));
-                        video.Add(new XElement("codec", MediaInfoFormatter.FormatVideoCodec(episodeFile.MediaInfo, sceneName)));
-                        video.Add(new XElement("framerate", episodeFile.MediaInfo.VideoFps));
-                        video.Add(new XElement("height", episodeFile.MediaInfo.Height));
-                        video.Add(new XElement("scantype", episodeFile.MediaInfo.ScanType));
-                        video.Add(new XElement("width", episodeFile.MediaInfo.Width));
-
-                        video.Add(new XElement("duration", episodeFile.MediaInfo.RunTime.TotalMinutes));
-                        video.Add(new XElement("durationinseconds", Math.Round(episodeFile.MediaInfo.RunTime.TotalSeconds)));
-
-                        streamDetails.Add(video);
-
-                        var audio = new XElement("audio");
-                        var audioChannelCount = episodeFile.MediaInfo.AudioChannels;
-                        audio.Add(new XElement("bitrate", episodeFile.MediaInfo.AudioBitrate));
-                        audio.Add(new XElement("channels", audioChannelCount));
-                        audio.Add(new XElement("codec", MediaInfoFormatter.FormatAudioCodec(episodeFile.MediaInfo, sceneName)));
-                        audio.Add(new XElement("language", episodeFile.MediaInfo.AudioLanguages));
-                        streamDetails.Add(audio);
-
-                        if (episodeFile.MediaInfo.Subtitles != null && episodeFile.MediaInfo.Subtitles.Count > 0)
-                        {
-                            foreach (var s in episodeFile.MediaInfo.Subtitles)
-                            {
-                                var subtitle = new XElement("subtitle");
-                                subtitle.Add(new XElement("language", s));
-                                streamDetails.Add(subtitle);
-                            }
-                        }
-
-                        fileInfo.Add(streamDetails);
-                        details.Add(fileInfo);
-                    }
-
-                    // Todo: get guest stars, writer and director
-                    // details.Add(new XElement("credits", tvdbEpisode.Writer.FirstOrDefault()));
-                    // details.Add(new XElement("director", tvdbEpisode.Directors.FirstOrDefault()));
-
-                    doc.Add(details);
-                    doc.Save(xw);
-
-                    xmlResult += doc.ToString();
-                    xmlResult += Environment.NewLine;
+                    details.Add(new XElement("displayafterseason", episode.AiredAfterSeasonNumber));
                 }
+                else if (episode.SeasonNumber == 0 && episode.AiredBeforeSeasonNumber.HasValue)
+                {
+                    details.Add(new XElement("displayseason", episode.AiredBeforeSeasonNumber));
+                    details.Add(new XElement("displayepisode", episode.AiredBeforeEpisodeNumber ?? -1));
+                }
+
+                var tvdbId = new XElement("uniqueid", episode.TvdbId);
+                tvdbId.SetAttributeValue("type", "tvdb");
+                tvdbId.SetAttributeValue("default", true);
+                details.Add(tvdbId);
+
+                var sonarrId = new XElement("uniqueid", episode.Id);
+                sonarrId.SetAttributeValue("type", "sonarr");
+                details.Add(sonarrId);
+
+                if (image == null)
+                {
+                    details.Add(new XElement("thumb"));
+                }
+                else if (Settings.EpisodeImageThumb)
+                {
+                    details.Add(new XElement("thumb", image.RemoteUrl));
+                }
+
+                details.Add(new XElement("watched", watched));
+
+                if (episode.Ratings != null && episode.Ratings.Votes > 0)
+                {
+                    details.Add(new XElement("rating", episode.Ratings.Value));
+                }
+
+                if (episodeFile.MediaInfo != null)
+                {
+                    var sceneName = episodeFile.GetSceneOrFileName();
+
+                    var fileInfo = new XElement("fileinfo");
+                    var streamDetails = new XElement("streamdetails");
+
+                    var video = new XElement("video");
+                    video.Add(new XElement("aspect", (float)episodeFile.MediaInfo.Width / (float)episodeFile.MediaInfo.Height));
+                    video.Add(new XElement("bitrate", episodeFile.MediaInfo.VideoBitrate));
+                    video.Add(new XElement("codec", MediaInfoFormatter.FormatVideoCodec(episodeFile.MediaInfo, sceneName)));
+                    video.Add(new XElement("framerate", episodeFile.MediaInfo.VideoFps));
+                    video.Add(new XElement("height", episodeFile.MediaInfo.Height));
+                    video.Add(new XElement("scantype", episodeFile.MediaInfo.ScanType));
+                    video.Add(new XElement("width", episodeFile.MediaInfo.Width));
+
+                    video.Add(new XElement("duration", episodeFile.MediaInfo.RunTime.TotalMinutes));
+                    video.Add(new XElement("durationinseconds", Math.Round(episodeFile.MediaInfo.RunTime.TotalSeconds)));
+
+                    streamDetails.Add(video);
+
+                    var audio = new XElement("audio");
+                    var audioChannelCount = episodeFile.MediaInfo.AudioChannels;
+                    audio.Add(new XElement("bitrate", episodeFile.MediaInfo.AudioBitrate));
+                    audio.Add(new XElement("channels", audioChannelCount));
+                    audio.Add(new XElement("codec", MediaInfoFormatter.FormatAudioCodec(episodeFile.MediaInfo, sceneName)));
+                    audio.Add(new XElement("language", episodeFile.MediaInfo.AudioLanguages));
+                    streamDetails.Add(audio);
+
+                    if (episodeFile.MediaInfo.Subtitles != null && episodeFile.MediaInfo.Subtitles.Count > 0)
+                    {
+                        foreach (var s in episodeFile.MediaInfo.Subtitles)
+                        {
+                            var subtitle = new XElement("subtitle");
+                            subtitle.Add(new XElement("language", s));
+                            streamDetails.Add(subtitle);
+                        }
+                    }
+
+                    fileInfo.Add(streamDetails);
+                    details.Add(fileInfo);
+                }
+
+                // Todo: get guest stars, writer and director
+                // details.Add(new XElement("credits", tvdbEpisode.Writer.FirstOrDefault()));
+                // details.Add(new XElement("director", tvdbEpisode.Directors.FirstOrDefault()));
+
+                details.WriteTo(xw);
             }
 
+            xw.Flush();
+            var xmlResult = sw.ToString();
+
             return new MetadataFileResult(GetEpisodeMetadataFilename(episodeFile.RelativePath), xmlResult.Trim(Environment.NewLine.ToCharArray()));
         }
 

src/NzbDrone.Core/ImportLists/Custom/CustomImportProxy.cs

@@ -72,7 +72,7 @@ namespace NzbDrone.Core.ImportLists.Custom
             }
 
             var baseUrl = settings.BaseUrl.TrimEnd('/');
-            var request = new HttpRequestBuilder(baseUrl).Accept(HttpAccept.Json).Build();
+            var request = new HttpRequestBuilder(baseUrl).Accept(HttpAccept.Json).AllowRedirect().Build();
             var response = _httpClient.Get(request);
             var results = JsonConvert.DeserializeObject<List<TResource>>(response.Content);
 

src/NzbDrone.Core/MediaFiles/EpisodeImport/DetectSample.cs

@@ -66,6 +66,12 @@ namespace NzbDrone.Core.MediaFiles.EpisodeImport
                 return DetectSampleResult.Indeterminate;
             }
 
+            if (runtime == 0)
+            {
+                _logger.Debug("Series runtime is 0, defaulting runtime to 45 minutes");
+                runtime = 45;
+            }
+
             return IsSample(localEpisode.Path, localEpisode.MediaInfo.RunTime, runtime);
         }
 

src/NzbDrone.Core/Sonarr.Core.csproj

@@ -20,7 +20,7 @@
     <PackageReference Include="Servarr.FluentMigrator.Runner.SQLite" Version="3.3.2.9" />
     <PackageReference Include="Servarr.FluentMigrator.Runner.Postgres" Version="3.3.2.9" />
     <PackageReference Include="FluentValidation" Version="9.5.4" />
-    <PackageReference Include="SixLabors.ImageSharp" Version="3.1.7" />
+    <PackageReference Include="SixLabors.ImageSharp" Version="3.1.12" />
     <PackageReference Include="Newtonsoft.Json" Version="13.0.3" />
     <PackageReference Include="NLog" Version="5.3.4" />
     <PackageReference Include="MonoTorrent" Version="2.0.7" />

src/NzbDrone.Host/Startup.cs

@@ -1,6 +1,7 @@
 using System;
 using System.Collections.Generic;
 using System.IO;
+using System.Net;
 using DryIoc;
 using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Builder;
@@ -59,8 +60,11 @@ namespace NzbDrone.Host
             services.Configure<ForwardedHeadersOptions>(options =>
             {
                 options.ForwardedHeaders = ForwardedHeaders.XForwardedFor | ForwardedHeaders.XForwardedProto | ForwardedHeaders.XForwardedHost;
-                options.KnownNetworks.Clear();
-                options.KnownProxies.Clear();
+                options.KnownNetworks.Add(new IPNetwork(IPAddress.Parse("10.0.0.0"), 8));
+                options.KnownNetworks.Add(new IPNetwork(IPAddress.Parse("172.16.0.0"), 12));
+                options.KnownNetworks.Add(new IPNetwork(IPAddress.Parse("192.168.0.0"), 16));
+                options.KnownNetworks.Add(new IPNetwork(IPAddress.Parse("fc00::"), 7));
+                options.KnownNetworks.Add(new IPNetwork(IPAddress.Parse("fe80::"), 10));
             });
 
             services.AddRouting(options => options.LowercaseUrls = true);

src/Sonarr.Http/Frontend/Mappers/BackupFileMapper.cs

@@ -15,11 +15,13 @@ namespace Sonarr.Http.Frontend.Mappers
             _backupService = backupService;
         }
 
-        public override string Map(string resourceUrl)
+        protected override string FolderPath => _backupService.GetBackupFolder();
+
+        protected override string MapPath(string resourceUrl)
         {
             var path = resourceUrl.Replace("/backup/", "").Replace('/', Path.DirectorySeparatorChar);
 
-            return Path.Combine(_backupService.GetBackupFolder(), path);
+            return Path.Combine(FolderPath, path);
         }
 
         public override bool CanHandle(string resourceUrl)

src/Sonarr.Http/Frontend/Mappers/BrowserConfig.cs

@@ -8,13 +8,20 @@ namespace Sonarr.Http.Frontend.Mappers
 {
     public class BrowserConfig : UrlBaseReplacementResourceMapperBase
     {
+        private readonly IAppFolderInfo _appFolderInfo;
+        private readonly IConfigFileProvider _configFileProvider;
+
         public BrowserConfig(IAppFolderInfo appFolderInfo, IDiskProvider diskProvider, IConfigFileProvider configFileProvider, Logger logger)
             : base(diskProvider, configFileProvider, logger)
         {
-            FilePath = Path.Combine(appFolderInfo.StartUpFolder, configFileProvider.UiFolder, "Content", "browserconfig.xml");
+            _appFolderInfo = appFolderInfo;
+            _configFileProvider = configFileProvider;
         }
 
-        public override string Map(string resourceUrl)
+        protected override string FolderPath => Path.Combine(_appFolderInfo.StartUpFolder, _configFileProvider.UiFolder);
+        protected override string FilePath => Path.Combine(FolderPath, "Content", "browserconfig.xml");
+
+        protected override string MapPath(string resourceUrl)
         {
             return FilePath;
         }

src/Sonarr.Http/Frontend/Mappers/CacheBreakerProvider.cs

@@ -37,6 +37,12 @@ namespace Sonarr.Http.Frontend.Mappers
 
             var mapper = _diskMappers.Single(m => m.CanHandle(resourceUrl));
             var pathToFile = mapper.Map(resourceUrl);
+
+            if (pathToFile == null)
+            {
+                return resourceUrl;
+            }
+
             var hash = _hashProvider.ComputeMd5(pathToFile).ToBase64();
 
             return resourceUrl + "?h=" + hash.Trim('=');

src/Sonarr.Http/Frontend/Mappers/FaviconMapper.cs

@@ -18,7 +18,9 @@ namespace Sonarr.Http.Frontend.Mappers
             _configFileProvider = configFileProvider;
         }
 
-        public override string Map(string resourceUrl)
+        protected override string FolderPath => Path.Combine(_appFolderInfo.StartUpFolder, _configFileProvider.UiFolder);
+
+        protected override string MapPath(string resourceUrl)
         {
             var fileName = "favicon.ico";
 
@@ -29,7 +31,7 @@ namespace Sonarr.Http.Frontend.Mappers
 
             var path = Path.Combine("Content", "Images", "Icons", fileName);
 
-            return Path.Combine(_appFolderInfo.StartUpFolder, _configFileProvider.UiFolder, path);
+            return Path.Combine(FolderPath, path);
         }
 
         public override bool CanHandle(string resourceUrl)

src/Sonarr.Http/Frontend/Mappers/HtmlMapperBase.cs

@@ -4,6 +4,7 @@ using System.Text.RegularExpressions;
 using NLog;
 using NzbDrone.Common.Disk;
 using NzbDrone.Common.EnvironmentInfo;
+using NzbDrone.Core.Configuration;
 
 namespace Sonarr.Http.Frontend.Mappers
 {
@@ -13,19 +14,22 @@ namespace Sonarr.Http.Frontend.Mappers
         private readonly Lazy<ICacheBreakerProvider> _cacheBreakProviderFactory;
         private static readonly Regex ReplaceRegex = new Regex(@"(?:(?<attribute>href|src)=\"")(?<path>.*?(?<extension>css|js|png|ico|ics|svg|json))(?:\"")(?:\s(?<nohash>data-no-hash))?", RegexOptions.Compiled | RegexOptions.IgnoreCase);
 
+        private string _urlBase;
         private string _generatedContent;
 
         protected HtmlMapperBase(IDiskProvider diskProvider,
+                                 IConfigFileProvider configFileProvider,
                                  Lazy<ICacheBreakerProvider> cacheBreakProviderFactory,
                                  Logger logger)
             : base(diskProvider, logger)
         {
             _diskProvider = diskProvider;
             _cacheBreakProviderFactory = cacheBreakProviderFactory;
+
+            _urlBase = configFileProvider.UrlBase;
         }
 
-        protected string HtmlPath;
-        protected string UrlBase;
+        protected abstract string HtmlPath { get; }
 
         protected override Stream GetContentStream(string filePath)
         {
@@ -62,10 +66,10 @@ namespace Sonarr.Http.Frontend.Mappers
                     url = cacheBreakProvider.AddCacheBreakerToPath(match.Groups["path"].Value);
                 }
 
-                return $"{match.Groups["attribute"].Value}=\"{UrlBase}{url}\"";
+                return $"{match.Groups["attribute"].Value}=\"{_urlBase}{url}\"";
             });
 
-            text = text.Replace("__URL_BASE__", UrlBase);
+            text = text.Replace("__URL_BASE__", _urlBase);
 
             _generatedContent = text;
 

src/Sonarr.Http/Frontend/Mappers/IndexHtmlMapper.cs

@@ -9,6 +9,7 @@ namespace Sonarr.Http.Frontend.Mappers
 {
     public class IndexHtmlMapper : HtmlMapperBase
     {
+        private readonly IAppFolderInfo _appFolderInfo;
         private readonly IConfigFileProvider _configFileProvider;
 
         public IndexHtmlMapper(IAppFolderInfo appFolderInfo,
@@ -16,15 +17,16 @@ namespace Sonarr.Http.Frontend.Mappers
                                IConfigFileProvider configFileProvider,
                                Lazy<ICacheBreakerProvider> cacheBreakProviderFactory,
                                Logger logger)
-            : base(diskProvider, cacheBreakProviderFactory, logger)
+            : base(diskProvider, configFileProvider, cacheBreakProviderFactory, logger)
         {
+            _appFolderInfo = appFolderInfo;
             _configFileProvider = configFileProvider;
-
-            HtmlPath = Path.Combine(appFolderInfo.StartUpFolder, _configFileProvider.UiFolder, "index.html");
-            UrlBase = configFileProvider.UrlBase;
         }
 
-        public override string Map(string resourceUrl)
+        protected override string FolderPath => Path.Combine(_appFolderInfo.StartUpFolder, _configFileProvider.UiFolder);
+        protected override string HtmlPath => Path.Combine(FolderPath, "index.html");
+
+        protected override string MapPath(string resourceUrl)
         {
             return HtmlPath;
         }

src/Sonarr.Http/Frontend/Mappers/LogFileMapper.cs

@@ -16,12 +16,14 @@ namespace Sonarr.Http.Frontend.Mappers
             _appFolderInfo = appFolderInfo;
         }
 
-        public override string Map(string resourceUrl)
+        protected override string FolderPath => _appFolderInfo.GetLogFolder();
+
+        protected override string MapPath(string resourceUrl)
         {
             var path = resourceUrl.Replace('/', Path.DirectorySeparatorChar);
             path = Path.GetFileName(path);
 
-            return Path.Combine(_appFolderInfo.GetLogFolder(), path);
+            return Path.Combine(FolderPath, path);
         }
 
         public override bool CanHandle(string resourceUrl)

src/Sonarr.Http/Frontend/Mappers/LoginHtmlMapper.cs

@@ -9,6 +9,7 @@ namespace Sonarr.Http.Frontend.Mappers
 {
     public class LoginHtmlMapper : HtmlMapperBase
     {
+        private readonly IAppFolderInfo _appFolderInfo;
         private readonly IConfigFileProvider _configFileProvider;
 
         public LoginHtmlMapper(IAppFolderInfo appFolderInfo,
@@ -16,14 +17,16 @@ namespace Sonarr.Http.Frontend.Mappers
                                Lazy<ICacheBreakerProvider> cacheBreakProviderFactory,
                                IConfigFileProvider configFileProvider,
                                Logger logger)
-            : base(diskProvider, cacheBreakProviderFactory, logger)
+            : base(diskProvider, configFileProvider, cacheBreakProviderFactory, logger)
         {
+            _appFolderInfo = appFolderInfo;
             _configFileProvider = configFileProvider;
-            HtmlPath = Path.Combine(appFolderInfo.StartUpFolder, configFileProvider.UiFolder, "login.html");
-            UrlBase = configFileProvider.UrlBase;
         }
 
-        public override string Map(string resourceUrl)
+        protected override string FolderPath => Path.Combine(_appFolderInfo.StartUpFolder, _configFileProvider.UiFolder);
+        protected override string HtmlPath => Path.Combine(FolderPath, "login.html");
+
+        protected override string MapPath(string resourceUrl)
         {
             return HtmlPath;
         }

src/Sonarr.Http/Frontend/Mappers/ManifestMapper.cs

@@ -8,6 +8,7 @@ namespace Sonarr.Http.Frontend.Mappers
 {
     public class ManifestMapper : UrlBaseReplacementResourceMapperBase
     {
+        private readonly IAppFolderInfo _appFolderInfo;
         private readonly IConfigFileProvider _configFileProvider;
 
         private string _generatedContent;
@@ -15,11 +16,14 @@ namespace Sonarr.Http.Frontend.Mappers
         public ManifestMapper(IAppFolderInfo appFolderInfo, IDiskProvider diskProvider, IConfigFileProvider configFileProvider, Logger logger)
             : base(diskProvider, configFileProvider, logger)
         {
+            _appFolderInfo = appFolderInfo;
             _configFileProvider = configFileProvider;
-            FilePath = Path.Combine(appFolderInfo.StartUpFolder, configFileProvider.UiFolder, "Content", "manifest.json");
         }
 
-        public override string Map(string resourceUrl)
+        protected override string FolderPath => Path.Combine(_appFolderInfo.StartUpFolder, _configFileProvider.UiFolder);
+        protected override string FilePath => Path.Combine(FolderPath, "Content", "manifest.json");
+
+        protected override string MapPath(string resourceUrl)
         {
             return FilePath;
         }

src/Sonarr.Http/Frontend/Mappers/MediaCoverMapper.cs

@@ -22,7 +22,9 @@ namespace Sonarr.Http.Frontend.Mappers
             _diskProvider = diskProvider;
         }
 
-        public override string Map(string resourceUrl)
+        protected override string FolderPath => Path.Combine(_appFolderInfo.GetAppDataPath(), "MediaCover");
+
+        protected override string MapPath(string resourceUrl)
         {
             var path = resourceUrl.Replace('/', Path.DirectorySeparatorChar);
             path = path.Trim(Path.DirectorySeparatorChar);

src/Sonarr.Http/Frontend/Mappers/RobotsTxtMapper.cs

@@ -18,11 +18,13 @@ namespace Sonarr.Http.Frontend.Mappers
             _configFileProvider = configFileProvider;
         }
 
-        public override string Map(string resourceUrl)
+        protected override string FolderPath => Path.Combine(_appFolderInfo.StartUpFolder, _configFileProvider.UiFolder);
+
+        protected override string MapPath(string resourceUrl)
         {
             var path = Path.Combine("Content", "robots.txt");
 
-            return Path.Combine(_appFolderInfo.StartUpFolder, _configFileProvider.UiFolder, path);
+            return Path.Combine(FolderPath, path);
         }
 
         public override bool CanHandle(string resourceUrl)

src/Sonarr.Http/Frontend/Mappers/StaticResourceMapper.cs

@@ -18,12 +18,14 @@ namespace Sonarr.Http.Frontend.Mappers
             _configFileProvider = configFileProvider;
         }
 
-        public override string Map(string resourceUrl)
+        protected override string FolderPath => Path.Combine(_appFolderInfo.StartUpFolder, _configFileProvider.UiFolder);
+
+        protected override string MapPath(string resourceUrl)
         {
             var path = resourceUrl.Replace('/', Path.DirectorySeparatorChar);
             path = path.Trim(Path.DirectorySeparatorChar);
 
-            return Path.Combine(_appFolderInfo.StartUpFolder, _configFileProvider.UiFolder, path);
+            return Path.Combine(FolderPath, path);
         }
 
         public override bool CanHandle(string resourceUrl)

src/Sonarr.Http/Frontend/Mappers/StaticResourceMapperBase.cs

@@ -27,14 +27,28 @@ namespace Sonarr.Http.Frontend.Mappers
             _caseSensitive = RuntimeInfo.IsProduction ? DiskProviderBase.PathStringComparison : StringComparison.OrdinalIgnoreCase;
         }
 
-        public abstract string Map(string resourceUrl);
+        protected abstract string FolderPath { get; }
+        protected abstract string MapPath(string resourceUrl);
 
         public abstract bool CanHandle(string resourceUrl);
 
+        public string Map(string resourceUrl)
+        {
+            var filePath = Path.GetFullPath(MapPath(resourceUrl));
+            var parentPath = Path.GetFullPath(FolderPath) + Path.DirectorySeparatorChar;
+
+            return filePath.StartsWith(parentPath) ? filePath : null;
+        }
+
         public Task<IActionResult> GetResponse(string resourceUrl)
         {
             var filePath = Map(resourceUrl);
 
+            if (filePath == null)
+            {
+                return Task.FromResult<IActionResult>(null);
+            }
+
             if (_diskProvider.FileExists(filePath, _caseSensitive))
             {
                 if (!_mimeTypeProvider.TryGetContentType(filePath, out var contentType))

src/Sonarr.Http/Frontend/Mappers/UpdateLogFileMapper.cs

@@ -16,12 +16,14 @@ namespace Sonarr.Http.Frontend.Mappers
             _appFolderInfo = appFolderInfo;
         }
 
-        public override string Map(string resourceUrl)
+        protected override string FolderPath => _appFolderInfo.GetUpdateLogFolder();
+
+        protected override string MapPath(string resourceUrl)
         {
             var path = resourceUrl.Replace('/', Path.DirectorySeparatorChar);
             path = Path.GetFileName(path);
 
-            return Path.Combine(_appFolderInfo.GetUpdateLogFolder(), path);
+            return Path.Combine(FolderPath, path);
         }
 
         public override bool CanHandle(string resourceUrl)

src/Sonarr.Http/Frontend/Mappers/UrlBaseReplacementResourceMapperBase.cs

@@ -20,9 +20,9 @@ namespace Sonarr.Http.Frontend.Mappers
             _urlBase = configFileProvider.UrlBase;
         }
 
-        protected string FilePath;
+        protected abstract string FilePath { get; }
 
-        public override string Map(string resourceUrl)
+        protected override string MapPath(string resourceUrl)
         {
             return FilePath;
         }

src/Sonarr.Http/Frontend/StaticResourceController.cs

@@ -1,5 +1,6 @@
 using System.Collections.Generic;
 using System.Linq;
+using System.Text.RegularExpressions;
 using System.Threading.Tasks;
 using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Cors;
@@ -16,6 +17,7 @@ namespace Sonarr.Http.Frontend
     {
         private readonly IEnumerable<IMapHttpRequestsToDisk> _requestMappers;
         private readonly Logger _logger;
+        private static readonly Regex InvalidPathRegex = new (@"([\/\\]|%2f|%5c)\.\.|\.\.([\/\\]|%2f|%5c)", RegexOptions.IgnoreCase | RegexOptions.Compiled);
 
         public StaticResourceController(IEnumerable<IMapHttpRequestsToDisk> requestMappers,
             Logger logger)
@@ -50,6 +52,11 @@ namespace Sonarr.Http.Frontend
         {
             path = "/" + (path ?? "");
 
+            if (InvalidPathRegex.IsMatch(path))
+            {
+                return NotFound();
+            }
+
             var mapper = _requestMappers.SingleOrDefault(m => m.CanHandle(path));
 
             if (mapper != null)