v2.2.1

Release Date: November 17, 2025

Bug Fixes

Fixed: Container Restart Causes Web UI to Hang

Reported by: @yellowcooln

After the initial setup, restarting the Docker container would cause the web UI to never load again. The root cause was that if any channel failed to generate during the 7-day schedule creation, the entire app initialization would silently crash, preventing Flask from starting.

Solution: Added comprehensive error handling at multiple levels (per-day, per-genre, per-holiday channel) with detailed logging and graceful degradation. The app now starts successfully even if some channels fail to generate, with clear warnings logged about any errors encountered.

Fixed: Environment Variables Don't Enable Plex OAuth Login

Reported by: @Pdaddy29, @popcorn2024ok

Users configuring Plex via Docker environment variables (PLEX_URL and PLEX_TOKEN) would see "Plex server not configured. Contact administrator." when attempting to log in with Plex.

Root Cause: The plex_machine_identifier (required for Plex OAuth verification) was never auto-populated when using environment variables for configuration.

Solution: When Plex connects successfully via environment variables, the app now automatically saves:

    plex_url
    plex_token
    plex_machine_identifier

Users no longer need to manually configure Plex in the web UI before OAuth login works.
Improvements
Real-Time FFmpeg Installation Progress

The one-click FFmpeg installer now shows real-time progress with:

1. Actual download size in MB
2. Extraction status updates
3. Verification steps
4. Animated progress bar (0-100%)

FFmpeg is immediately available after installation without requiring a container restart.
Enhanced Client Discovery

• Devices actively playing content now show a ▶ icon with "Now playing: [title]"

• Active devices are prioritized at the top of the device list

• Added helper text: "For instant detection, start playing any movie on your device first"

Technical Notes

• Volume Mapping: Only /data is required. There is no /config directory.

• Startup Logs: You should now see "Auto-saved Plex machine identifier" on startup when using environment variables

• Error Logging: Schedule generation errors are now logged with counters showing how many channels succeeded/failed

Upgrade Instructions

docker pull netpersona/popcorn:latest
docker restart Popcorn

v2.1.4

🔒 Security Hardened:

22 Information Exposure Vulnerabilities fixed across 4 files:

• app.py (15 fixes)
• theme_service.py (3 fixes)
• plex_api.py (3 fixes)
• updater.py (1 fix)

✅ Bugs Fixed:

• Client Discovery - Fixed r.provides string parsing (was treating comma-separated string as list)
• Web Player URLs - Restored proper %2F encoding and context parameters
• Keyboard Shortcuts - Search bar now works with J and M keys
• Scroll Wheel - Now works anywhere on the guide page, not just time slots

v2.1.3

🎉 What's New

Custom Domain Support for Plex Web Player

• Web player URLs now work with custom Plex domains (e.g., https://plex.yourdomain.com)
• Automatically detects custom domains vs localhost and generates the correct URL format
• Uses /web/index.html format with proper URL encoding (%2F) for custom domains
• Falls back to app.plex.tv/desktop for localhost installations
• Fixes "Not found" errors when using reverse proxies, Cloudflare tunnels, or custom domains

Database Integrity Improvements

• Fixed cascade delete relationships to prevent 500 errors when deselecting libraries
• Schedules, movie overrides, and favorites are automatically cleaned up when movies are removed
• Watch history is preserved with NULL movie references (keeps your viewing stats safe)
• Added proper SQLAlchemy relationship configurations to eliminate startup warnings

🐛 Bug Fixes

Plex OAuth & Authentication

• Fixed critical external access bug - OAuth now uses machine identifier verification instead of URL matching
• Works seamlessly with both internal network and external access (Cloudflare/reverse proxy)
• Plex.tv server discovery API ensures users are properly authorized

Library Management

• Fixed library selection UI - Discovered libraries now auto-save to database on first sync
• Fixed settings save error - Corrected attribute name from plex_api.plex_server to plex_api.plex
• Libraries properly deselect without database constraint errors

🔧 Technical Changes

Files Modified:

• plex_api.py - Custom domain detection and URL generation
• models.py - Cascade delete relationships with proper back_populates
• app.py - Settings handling fixes

Database Schema:

• Added ondelete='SET NULL' to WatchHistory.movie_id
• Added cascade='all, delete-orphan' to Movie relationships (schedules, overrides, favorites)
• All relationships now have bidirectional back_populates configuration

❤️ Thank you very much to the contributors of Popcorn! Your work is very much appreciated!

v.2.1.2

Larger, More Visible Movie Cards

• Card size increased from 120×180px to 200×240px on mobile
• Bigger movie posters - much easier to see what's playing
• Increased font sizes for better readability
• More padding and spacing for easier tapping

Better Performance on Tablets

• Auto-disables CRT effects and film grain on mobile devices
• These visual effects were causing lag - now automatically turned off on phones/tablets
• Stored in browser so it remembers your preference
• Optimized animations and scrolling for smoother performance

Smart Image Loading

• Native browser lazy loading keeps working
• Posters load progressively as you scroll
• Reduces initial page load and network usage

Performance-Optimized CSS

• Passive scroll listeners for smoother scrolling
• Hardware acceleration for animations
• Reduced rendering overhead

v2.1.1

What's Changed

• deps: bump sqlalchemy from 2.0.43 to 2.0.44 by @dependabot[bot] in #13
• deps: bump charset-normalizer from 3.4.3 to 3.4.4 by @dependabot[bot] in #12
• deps: bump idna from 3.10 to 3.11 by @dependabot[bot] in #10
• Potential fix for code scanning alert no. 11: Information exposure through an exception by @netpersona in #14
• Potential fix for code scanning alert no. 2: Information exposure through an exception by @netpersona in #15
• Potential fix for code scanning alert no. 5: Information exposure through an exception by @netpersona in #16
• Potential fix for code scanning alert no. 7: Information exposure through an exception by @netpersona in #17
• Potential fix for code scanning alert no. 10: Information exposure through an exception by @netpersona in #18
• deps: bump certifi from 2025.8.3 to 2025.10.5 by @dependabot[bot] in #11
• deps: bump python-dotenv from 1.1.1 to 1.2.1 by @dependabot[bot] in #20

Full Changelog: v2.1.0...v2.1.1

v2.1.0

plex_api.py Now safely handles None values
profile.html Safely handles null/undefined with fallback to empty string
Server configurations should now be consistent across upgrades by migrating database to /data and updating /app only.
Find Devices now shows active Plex instances, allowing non-advanced users to locate their devices for playback
Users may save multiple playback devices and choose which ones to play to

v2.0.2

Overlooked a small bug that had been included in previous versions:
Application would not check version against newly published version.

v2.0.1

Added multi-device playback support for users
Adding new devices is now easier; the Popcorn system will automatically generate the list of available devices, allowing a user to select which devices they own and play movies on any of those devices later; no longer requires a user to know the UUID of their device (that was impossible for them to do, anyway)
Added support for mobile devices; Popcorn should now be more viable on smaller screens.
The plan is to make Popcorn compatible with kiosk-style devices

v2.0.0

Popcorn Release Notes

Version 2.0.0 - October 13, 2025

🎉 Major Release: Demo-Ready Deployment & Security Enhancements

This major release focuses on making Popcorn deployment-ready with public demo access, enhanced security features, and a streamlined first-time user experience.

---

🆕 New Features

Default Demo Accounts

• Automatic Account Creation: On first startup, Popcorn now automatically creates two default accounts:
  • Admin Account: admin / admin - Full administrator privileges
  • Demo Account: demo / demo - Standard user access
• Instant Access: Users can immediately explore Popcorn without registration barriers
• Production Ready: Perfect for public deployments and demo environments

Security Warning System

• Password Security Banners: Users with default passwords see a prominent red warning banner on every page
• Visual Indicators:
  • Animated pulsing effect to grab attention
  • Shaking warning icon
  • Clear security message
• Actionable: Direct link to profile page for immediate password changes
• Persistent Reminder: Banner remains until password is changed

Password Change Functionality

• Self-Service Password Management: Users can now change their passwords directly from the profile page
• Comprehensive Validation:
  • Current password verification
  • Password confirmation matching
  • Minimum 4-character length enforcement
• Security Features:
  • Server-side password validation
  • Secure password hashing with Werkzeug
  • CSRF protection on all forms
• Clear Feedback: Detailed flash messages for all error cases and successful changes
• Auto-Warning Removal: Security warning banner automatically disappears after password change

---

🔧 Technical Improvements

Database Schema Updates

• New User Field: Added using_default_password boolean flag to Users table
• Migration System: Idempotent migrations ensure safe schema updates
• Backward Compatible: Existing installations upgrade automatically

User Interface Enhancements

• Account Information Section: Redesigned profile page with password change form
• Accessibility: Added autocomplete attributes for password fields
• Form Validation: Client and server-side validation for all password inputs
• Error Handling: User-friendly error messages for common issues

Routing Updates

• New Route: /profile/password POST endpoint for password changes
• Security: Current password verification prevents unauthorized changes
• State Management: Automatic flag updates and session handling

---

📝 Documentation Updates

User Guide Enhancements

• Added section on default accounts and first-time setup
• Documented password security features
• Step-by-step password change instructions
• Security best practices for default credentials

Technical Documentation

• Updated architecture documentation
• Documented new database fields and migrations
• Added security system details
• Updated deployment preparation notes

---

🚀 Deployment Improvements

Production-Ready Features

• Demo Mode: Out-of-the-box demo accounts for public testing
• Security Prompts: Automatic warnings for weak credentials
• Easy Deployment: Configured for autoscale deployment
• Clean Project: Removed unnecessary development files and migrations

Autoscale Configuration

• Deployment target set to autoscale for optimal performance
• Automatic scaling based on traffic
• Cost-effective for varying usage patterns

---

🔒 Security Enhancements

Password Security

• Default Password Detection: System tracks which accounts use default credentials
• Visual Warnings: Impossible to miss security warnings for default passwords
• Forced Updates: Strong encouragement to change default passwords
• Secure Hashing: All passwords stored with industry-standard hashing

Authentication Improvements

• Dual Auth Support: Plex OAuth and local login remain available
• Session Security: Enhanced session management with secure cookies
• CSRF Protection: All forms protected against cross-site request forgery

---

🐛 Bug Fixes

Database Issues

• Fixed: SQLAlchemy AttributeError when creating default accounts on startup
• Fixed: Missing using_default_password field in User model causing initialization errors
• Resolved: Database migration synchronization issues

UI/UX Fixes

• Improved: Password field accessibility with autocomplete attributes
• Enhanced: Error messaging for password validation failures
• Polished: Flash message styling and positioning

---

📦 Installation & Upgrade

New Installations

1. Deploy Popcorn using your preferred method (Docker, native Python)
2. Access the application
3. Log in with admin/admin or demo/demo
4. Important: Change default passwords immediately via Profile → Change Password

Upgrading from Previous Versions

Docker:

docker pull netpersona/popcorn:latest
docker stop popcorn && docker rm popcorn
docker run -d --name popcorn -p 5000:5000 \
  -e SESSION_SECRET="your-secret" \
  -e PLEX_URL="http://your-plex:32400" \
  -e PLEX_TOKEN="your-token" \
  -v popcorn-data:/app \
  --restart unless-stopped \
  netpersona/popcorn:latest

Native:

1. Pull latest code from repository
2. Install updated dependencies: pip install -r requirements.txt
3. Restart the application
4. Database migrations run automatically on startup
5. Default accounts created if they don't exist

Post-Upgrade Actions

1. Review default accounts: Check Settings → User Management
2. Update default passwords: Change admin and demo passwords
3. Test password change: Verify the new password functionality works
4. Clear browser cache: Ensure UI changes load properly

---

🎯 What's Next

Upcoming Features

• Email verification for user registration
• Password reset via email
• Two-factor authentication (2FA)
• Advanced user permissions
• Activity logging and audit trails

---

📚 Documentation

• User Guide: See USER_GUIDE.md for complete documentation
• Unraid Setup: See UNRAID_SETUP.md for Unraid-specific instructions
• Technical Docs: See README.md for architecture and development details

---

📊 Version History

v2.0.0 (October 13, 2025)

• Default demo accounts
• Password security warnings
• Password change functionality
• Enhanced deployment readiness

v1.x (Previous)

• Cable-style TV guide interface
• 28+ genre-based channels
• Holiday channel system
• Plex integration
• Theme customization
• Auto-update system
• User management