qBittorrent

Recent Commits

• Vladimir Golovnev(02 Sept 26)

  Fix/improve Response Writer implementation * Implement async file sender class in order to better encapsulate single "stream file" job. * Make async worker a subclass of QThread. It doesn't actually need an event loop and therefore a separate QThread. * Implement DataPipe class in order to improve transmitting the data from async worker. * Improve/unify I/O error handling. * Improve notifying about end of data in async worker communication channel. Now it is done simultaneously with the data fetching. PR #24851. Supersedes #24796.

• Piotr(30 Aug 26)

  WebUI: Add support for pausing and resuming BitTorrent session Closes #24267. PR #24269.

• Vladimir Golovnev(30 Aug 26)

  Fix case-only renaming isn't applied PR #24852. Closes #24800.

• Chocobo1(29 Aug 26)

  Expose libtorrent setting for WebTorrent STUN server PR #24837.

• Uğur Gümüşhan(29 Aug 26)

  WebUI: Prevent in-place corruption in `DynamicTable.loadColumnsOrder()` Closes #24808. PR #24809. Co-authored-by: Chocobo1 <[email protected]>

• thalieht(24 Aug 26)

  Add option to toggle closing search tabs with middle-click Closes #24265. PR #24776.

• Chocobo1(24 Aug 26)

  WebUI: hide element properly Avoid using `opacity: 0;` because screen readers should not access the `img` element when it is supposed to be hidden. PR #24838.

• Mark Yu(24 Aug 26)

  WebUI: Use exponential backoff for RSS refresh interval Currently, the WebUI RSS refresh interval is a constant of 1.5 seconds. That means the browser is constantly fetching RSS data from the server for every 1.5 seconds. This PR Implements exponential backoff for RSS refresh interval so refresh interval doubles if there is no change in the RSS feed JSON data. Closes #20440. PR #24686.

• Tom Piccirello(22 Aug 26)

  Prevent SMTP injection from unsanitized mail content Control characters in a header value (e.g. a torrent name containing CRLF) could inject MIME headers, and a body line beginning with a dot could end the DATA phase early. Replace characters below 0x20 with a space per RFC 5322 2.2, and dot-stuff the body per RFC 5321 4.5.2. Also discard bytes buffered before STARTTLS instead of parsing them as protected server responses, per RFC 3207 4.2. PR #24793.

• Tom Piccirello(22 Aug 26)

  WebUI: Detect cross-site requests using `Sec-Fetch-Site` header When both `Origin` and `Referer` headers were absent the request was always accepted, so an attacker page could opt out of the Referer check by setting `Referrer-Policy: no-referrer`. `Sec-Fetch-Site` is set by the browser and cannot be suppressed or forged by the initiating page. Browsers only send it to secure origins, so this covers HTTPS and localhost deployments. Clients that don't send it keep the previous permissive path. PR #24792.

• Chocobo1(22 Aug 26)

  WebUI: tweak software version table layout PR #24816.

• Tom Piccirello(17 Aug 26)

  Store WebUI search tabs between app restarts and across sessions * Rename search preference settings Rename preference methods and keys for clarity and reuse between GUI and WebAPI. * Share search jobs across sessions This allows users to access their search jobs across different web sessions. Switching to a different browser/device will now show the same search jobs. * Store WebUI search tabs between app restarts This was inspired by the GUI version implemented in e644a91de9f29a71aa8c93614832c7e2a592aee4. PR #23784.

• Vladimir Golovnev(17 Aug 26)

  WebAPI: Fix editCategory overwrites unrelated options PR #24798. Closes #24787.

• Chocobo1(17 Aug 26)

  Update Uncrustify config file It still doesn't perfectly match our coding style but it is very close. PR #24815.

• Chocobo1(17 Aug 26)

  Suppress useless gcc warning Otherwise gcc 16+ will emit the following during compilation: ``` /home/user/qBittorrent/src/base/bittorrent/torrentdescriptor.h:52:11: warning: defining ‘BitTorrent::TorrentDescriptor’, which previously failed to be complete in a SFINAE context [-Wsfinae-incomplete=] 52 | class TorrentDescriptor ``` Upstream issue: https://qt-project.atlassian.net/browse/QTBUG-143470 PR #24814.

• tehcneko(17 Aug 26)

  WebUI: Remove indentation if no subcategory exists Related #23619. PR #24804.

• Tom Piccirello(17 Aug 26)

  WebUI: Only open http(s) URLs from RSS articles and search results Opening a malicious URI (e.g. `javascript:`) via Search or RSS can result in running arbitrary JS in the same origin as the WebUI session. This would allow modifying settings, including "run external program on torrent completion". This PR ensures that only http and https URLs are opened. PR #24790.

• Vladimir Golovnev(16 Aug 26)

  Fix inappropriate use of QReadWriteLock PR #24811.

• stalkerok(16 Aug 26)

  GHA CI: Raise the libtorrent versions The WebTorrent flag has also been removed: this feature is enabled by default. PR #24799.

• Vladimir Golovnev(16 Aug 26)

  Update Changelog PR #24801.

• Tom Piccirello(15 Aug 26)

  WebAPI: Require POST for search/downloadTorrent and rss/setFeedRefreshInterval Both of these requests change state and should require a POST. PR #24791.

• Steven Kreitzer(12 Aug 26)

  Implement 'max_allowed_in_request_queue' libtorrent setting PR #24253.

• Preston M(10 Aug 26)

  Update man pages to document all command-line options Closes #12141. PR #24771.

• tehcneko(09 Aug 26)

  Fix encoding of error messages from libtorrent 2.1 PR #24778.

• dependabot[bot](03 Aug 26)

  GHA CI: Bump pre-commit hook versions Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> PR #24768.

• Chocobo1(03 Aug 26)

  GHA CI: Bump action versions Due to the following upstream issue, we couldn't use the PR from dependabot for now. https://github.com/dependabot/dependabot-core/issues/15738 https://github.com/qbittorrent/qBittorrent/pull/24767 PR #24770.

• Chocobo1(03 Aug 26)

  WebUI: use safe property for setting element title Normally, this would be monkey-patched, but the functions are too large in this case. PR #24766.

• Chocobo1(03 Aug 26)

  Improve build script for Lua plugin * Use platform defines for Lua This prevents using outdated system calls on each platform. Addresses the following warning from the CI: https://github.com/qbittorrent/qBittorrent/actions/runs/30277287206/job/90014446818#step:9:597 ``` /home/runner/work/qBittorrent/qBittorrent/src/base/3rdparty/lua/src/loslib.c:175:(.text+0x424): warning: the use of `tmpnam' is dangerous, better use `mkstemp' ``` * Restrict Lua targets to `PRIVATE` Ideally, only `base` target should interact with Lua directly. PR #24765.

• Chocobo1(03 Aug 26)

  GHA CI: switch back to `ubuntu-latest` runner for WebUI The slim runner was too weak and frequently timed out, so revert to the normal runner. Partially reverts eb593aa8464a7dcce363789525a4ce31896f5495. PR #24764.

• ValdikSS(03 Aug 26)

  Close file descriptors when starting file manager Opening a directory containing a file resulted in the file manager inheriting sockets opened by qbittorrent. This a regression introduced in commit e78b392. Ensure that all executed processes are run with `CloseFileDescriptors` flag. Closes #24760. PR #24761.