User can access to block content in Jellyfin with jellyseerr

[Monirzadeh]

Description

Jellyfin has an option to block content for user by tag if you login with Jellyfin account. User can access to that item with jellyseerr.

Version

1.1.1

Steps to Reproduce

1. create a user test in Jellyfin for example testuser
2. go to dashboard > Users > username testuser > parental control > Block items with tags
3. add a tag, for example blockcontenttag
4. select a movie or tv show from the library, go to edit metadata for that movie or tvshow. (for example Spider-Man: No Way Home)
5. add blockcontenttag to tag section
6. login to jellyseerr with testuser
7. search for movie Spider-Man: No Way Home
8. you have access to play in Jellyfin bottom
9. click on that there is multiple problem :
10. It shows available status. (it should hide from user with block content)
11. user can open in Jellyfin (should send an access request at least or act like unavailable and send request for approve)
12. user should not see availability of content for block content.
13. it shows block content in Recently Added section too

Screenshots

No response

Logs

No response

Platform

desktop

Device

other

Operating System

linux

Browser

Chrome

Additional Context

No response

Code of Conduct

• [X] I agree to follow Overseerr's Code of Conduct

[Fallenbagel]

#180 duplicate?

But im curious, does it like play the media on that user when you press play of jellyfin? What I meant is if in the browser that user is logged in to jellyfin and they go to jellyseerr and open that media and press play on jellyfin, does it play from that users account?

[Monirzadeh]

#180 duplicate?

#180 is not completely the same, but similar. It is content that restrict with tag.

But im curious, does it like play the media on that user when you press play of jellyfin? What I meant is if in the browser that user is logged in to jellyfin and they go to jellyseerr and open that media and press play on jellyfin, does it play from that users account?

Yes, Jellyfin just hide content, not limiting access to the content (Jellyfin fault). If you have URL of the page, you can open the page of any media or even play them. jellyseerr get that URL to the user, so user can open the page and play content with that account when you want to setup jellyseerr you can login with your Jellyfin account.(I test with this setup and not test on separate jellyseerr account)

[Fallenbagel]

Ah damn. I thought jellyfin restricted and not just hide. That's a really bad way to handle it but I guess its easier (probably left over from emby)

[cremonies]

Does the same happen for age restricted content?

[Monirzadeh]

Does the same happen for age restricted content?

yes.

[Salpertio]

Yes, Jellyfin just hide content, not limiting access to the content (Jellyfin fault). If you have URL of the page, you can open the page of any media or even play them. jellyseerr get that URL to the user, so user can open the page and play content with that account when you want to setup jellyseerr you can login with your Jellyfin account.(I test with this setup and not test on separate jellyseerr account)

how i tested this with different users on pressing the "watch on JF" button.

Jellyseer -> Jellyfin

|admin| - test (lowest rating) = content accessible |test| - test (lowest rating) = content accessible |jellyseer account| - test (lowest rating) = content accessible

other finds.

when that user goes where they shouldn't jellyfin freezes/disallows the user from certain parts of the ui until a refresh of the webpage occurs.

ex. cannot go back, home until refreshing the page (though this is finicky)

the sync play feature in JF however goes through with the intended blocking behavior. if a user is in a party that attempts to play content above that users rating it will not play until they leave.

[Fallenbagel]

Duplicate of #180