Music Assistant restricts its Home Assistant picture loader after finding that a client could use it to read other Home Assistant API responses. The loader previously fetched any path registered as an image with Music Assistant’s Home Assistant access token and returned the response.
Marvin Schenkel limits requests to the paths used for entity pictures, rejects attempts to traverse into other paths, and requires an image response no larger than 10 MiB. OzGav reviewed the correction.