v1.127.0

[alextran1502]

v1.127.0

Security fix

The HTML for the shared link page (/share/<token>) is built on the server, and was previously susceptible to cross-site scripting (XSS). In short, this means you could do stuff like this.

This issue has been mitigated by sanitizing the data prior to including it in the resulting HTML.

Highlights

Welcome to the release v1.127.0 of Immich. As we were using the legendary salt gun to collect bugs into our inventory, the RNG god blessed us with a critical hit to a security bug. We encourage you to update to the latest version as soon as possible.

Some new features and enhancements also make it into this release, and we are excited to share them with you from the highlights below.

• Manual face tagging and deletion
• Persistent memories
• Search by rating (web)

Manual face tagging and deletion

This release introduces the ability to manually tag a face to a photo or video that the machine learning model failed to detect. You can also remove any existing faces for incorrect automatic tagging by the clustering algorithm.

You can start tagging by clicking on the “+” button under the people section of the detail panel.

A box will appear for the adjustment and selection of the person you want to tag

Click the pencil icon to access the editing view to remove existing faces. You can find a trash icon to remove a face from the photo.

Persistent memories

The Memories feature has received its first round of functional enhancements. Before, memories were generated on the fly, but they are now pre-generated, resulting in a faster timeline. You can interact with memories, such as liking and modifying their content. This change will allow us to deliver more complex memory features in the future.

Search by star rating

On the web, with the star rating feature enabled, you can use the search filter to select it as a search criteria.

External Library interface tweaks

The management page for external libraries now shows both photo and video counts. When creating a new external library, it will now ask for an import path immediately, making onboarding easier.

Support Immich

If you find the project helpful, you can support Immich by purchasing a product key at https://buy.immich.app or purchase our merchandise at https://immich.store

Cheers! 🍻

What's Changed

🚨 Breaking Changes

• chore: removed unused endpoint by @jrasm91 in chore: removed unused endpoint #16167

🔒 Security

• fix: cross-site scripting issue on /share pages by @jrasm91 in fix: cross site scripting issue on /share pages #16255

🚀 Features

• feat: sync implementation for the user entity by @zackpollard in feat: sync implementation for the user entity #16234
• feat(web): manual face tagging and deletion by @alextran1502 in feat(web): manual face tagging and deletion #16062
• feat: persistent memories by @jrasm91 in feat: persistent memories #15953

🌟 Enhancements

• feat(mobile): Made Map Bottom Sheet extendable higher by @YarosMallorca in feat(mobile): Made Map Bottom Sheet extendable higher #16056
• feat(web): use thumbhash as a cache key by @jrasm91 in feat(web): use thumbhash as a cache key #16106
• fix(web): improve memories layout on small screens by @lukashass in fix(web): improve memories layout on small screens #16162
• feat(server): search by partial asset path by @kvalev in feat(server): search by partial asset path #16173
• fix(server): don't warn about missing timezone by @etnoy in fix(server): don't warn about missing timezone #16211
• feat(web): show memories in portrait on small screens by @lukashass in feat(web): show memories in portrait on small screens #16213
• feat(web): library import path onboarding by @etnoy in feat(web): library import path onboarding #16229
• feat(server): add path to metadata logging by @etnoy in feat(server): add path to metadata logging #16212
• feat(web): support searching by EXIF rating by @jasonappah in feat(web): support searching by EXIF rating #16208
• feat(web): remove library type column by @etnoy in feat(web): remove library type column #16254
• feat(mobile): photos grouped by date in album page view by @ExceptionsOccur in feat(mobile): photos group by date in album page view #16272

🐛 Bug fixes

• fix(web): Update shared link Exif capitalization to match existing capitalization by @Snowknight26 in fix(web): Update shared link Exif capitalization to match existing capitalization #16010
• fix(web): properly project profile picture by @immangat in fix(web): properly project profile picture #16095
• fix: place suggestions not clickable in the asset set location modal by @zackpollard in fix: place suggestions not clickable in asset set location modal #16104
• fix(mobile): failed to load gl-ES locale by @pablopunk in fix(mobile): failed to load gl-ES locale #16123
• fix: include live images in-person view count by @immangat in fix: include live images in person view count #16116
• fix: limit the logo’s width in email templates to 100% by @NickOveracker in fix: limit width of logo in emails to 100% #16164
• fix(mobile): server endpoint on the login screen always include /api. by @jpros in fix(mobile): Server endpoint on the login screen.  #16149
• fix(server): flaky library e2e tests by @etnoy in fix(server): flaky library e2e tests #16174
• fix(server): more e2e library flakiness cleanup by @etnoy in fix(server): more e2e library flakiness cleanup #16176
• fix: pgvectors docs link by @bo0tzz in fix: pgvectors docs link #16187
• fix(server): set modifydate by @etnoy in fix(server): set modifydate #16225
• fix(server): assets in multiple albums duplicated in map view by @mertalev in fix(server): assets in multiple albums duplicated in map view #16245
• fix(web): use an anonymous function in setTimeout in polyfill of requestIdelCallback by @ykzts in fix(web): use anonymous function in setTimeout in ponyfill of requestIdelCallback #16264
• fix(web): thumbnail playback stops when hovering over the icon, then video by @NicholasFlamy in fix(web): thumbnail playback stops when hovering over icon then video #16302

📚 Documentation

• docs: put Windows restore command on one line by @Mraedis in docs: put Windows restore command on one line #16074
• chore(docs): Synology set-up guide by @JasonMAnderson in chore(docs): Synology set-up guide #16179
• docs: clarify custom locations guide by @bo0tzz in docs: clarify custom locations guide #16122
• chore(docs): access Immich using meshnet nordvpn by @RoseyWasTaken in chore(docs): access Immich using meshnet nordvpn #16316

🌐 Translations

• chore(web): update italian translations by @IGOLz in chore(web): update italian translations #15695
• chore(web): update translations by @weblate in chore(web): update translations #15559

New Contributors

• @HelloMihai made their first contribution in fix: broken html id #16084
• @pablopunk made their first contribution in fix(mobile): failed to load gl-ES locale #16123
• @NickOveracker made their first contribution in fix: limit width of logo in emails to 100% #16164
• @IGOLz made their first contribution in chore(web): update italian translations #15695
• @jpros made their first contribution in fix(mobile): Server endpoint on the login screen.  #16149
• @JasonMAnderson made their first contribution in chore(docs): Synology set-up guide #16179
• @jasonappah made their first contribution in feat(web): support searching by EXIF rating #16208
• @ykzts made their first contribution in fix(web): use anonymous function in setTimeout in ponyfill of requestIdelCallback #16264
• @ExceptionsOccur made their first contribution in feat(mobile): photos group by date in album page view #16272
• @RoseyWasTaken made their first contribution in chore(docs): access Immich using meshnet nordvpn #16316

Full Changelog: v1.126.1...v1.127.0

---

This discussion was created from the release v1.127.0.

[DavidAremaCarretero]

What an amazing feature to manually tag!
Two things I realized using it:

• Modal for choosing who to tag would be even better with a searchbox. Is a bit hard when you have plenty of faces to find the one you are looking for.
• On videos, plus button appears but doesn't work.

Thanks a lot and big kudos!

[alextran1502]

Thanks for the feedback! will work on those improvements

[mrjackwills]

Would it be possible to create a new person, rather than adding a missed face to a previously known person, with this feature?

[NicholasFlamy]

Would it be possible to create a new person

That's a bit more complex.

You might try lowering Min recognized faces in some cases to help with people who don't show up in more than 1-2 pics.

[IoSonoAndreaZ]

I'm one of the victims of this problem, thanks for the update!

[NicholasFlamy]

You did not just do that. 🤣

[Complexicon]

thats a good one, got me!

[simulot]

@alextran1502
As a GO language fan myself, I like the photo you've chosen!

[alextran1502]

I was thinking you would like that 😄

[lukashass]

Web doesn't show memories anymore. Does it take a while to generate them?

[lukashass]

"Create job" on the top right on /admin/jobs-status.

Didn't know that this existed till just now either.

[alextran1502]

Yes, the job will run nightly and generates a few days in advanced. So it will start kick in tonight. You can also run the "generate memory" in the create job modal to start now

[YarosMallorca]

Just upgraded, but when I try to add the job, it says that it does add, but it doesn't appear in the list of jobs.

[etnoy]

Just upgraded, but when I try to add the job, it says that it does add, but it doesn't appear in the list of jobs.

It doesn't show up in the job queues in the user interface but runs in the background

[YarosMallorca]

@etnoy interesting, because the interface lets me infinitely add it using the "create task" dialog,

[mirisbowring]

Thank you very much for the nice work!

Big Question:
Could you please start creating github security advisories?
Many people are using immich in a "productive" way and publishing this security problems (like you fixed in this release) as a github security advisory would be great! :)

[NicholasFlamy]

using immich in a "productive" way

Keep in mind that it's not stable.

github security advisories

Seems like a good idea.

[danieldietzler]

We do in fact use Github advisories for anything that has a broader impact. It's just that in this case it wasn't really an issue. (Immich links to albums are shared among friends & family, where we don't expect such an issue to be abused)

[mirisbowring]

Still this is a vulnerability. Probability would be low but still it would be one.

[jrasm91]

We could make and publish an advisory. I've never done that, but I assume it's simple enough.

[unusualevent]

<3 lovely work

[trop1kal]

Manual Tagging! TY!! Can't wait to update and try this feature out.

[AnasSecurity]

Hey guys,

Thanks for this amazing project! I set up my home server with Immich just a week ago, and today I got a Google notification saying I’m out of space. 😅

God bless you all for your hard work and dedication! I’m currently learning JavaScript, and I hope to contribute to the project’s improvement in the future. However, as a beginner in programming, I find it quite challenging.

Thanks a lot!!!

[qqAys]

The cross-site attack(XSS) demo you gave is incorrect, it should look like this.