# 19 - English-Only Lockdown Audit (Read-Only Baseline) > Owner saw the Play button render as **"Abspielen"** (German). Goal: > "everything English only, remove the ability to be in another language at > all". This doc supplements `docs/15-force-english.md` and `docs/16-jellyfin-branding-leaks.md` — > it is the cross-layer baseline for the lockdown branch. Audited: 2026-05-08 against live `https://arrflix.s8n.ru`, Jellyfin 10.10.3. Auditor: s8n. Mode: read-only. No POST/PATCH/PUT to Jellyfin, no file modifications outside this doc. --- ## TL;DR — root cause + why doc 15 didn't close it 1. **Per-user `Configuration.UICulture` is still absent on every account.** All 8 users return `Configuration.UICulture` as a missing key (verified live 2026-05-08, see Per-User Table below). Doc 15 correctly identified the fix and shipped the `bin/force-english-all-users.sh` script — but **the script was never executed**. There is no audit trail of a `204 No Content` against `/Users/{id}/Configuration` in the activity log for any user, and the live state proves it (UICulture still absent on all 8). When `UICulture` is absent, the SPA falls back to `navigator.language` / `Accept-Language`, so any browser sending `de-*` loads the German bundle and renders "Abspielen". This is layer (5) in the table below. 2. **The German translation bundle is shipped and live.** `de-json.1afccc006ab8bb6c5953.chunk.js` is reachable, returns HTTP 200, and contains `"Play":"Abspielen"`, `"Settings":"Einstellungen"`, `"Save":"Speichern"`, etc. — 1963 unique translated keys. 92 other locale chunks ship alongside it. Until those are removed from the served bundle, the SPA can always select a non-English locale even if every user has `UICulture=en-US` (e.g. a new user who never authenticated, or a tampered SPA). Doc 15 explicitly noted "no server flag forces SPA to ignore Accept-Language" but stopped at the per-user pin — it didn't propose deleting the bundles. In two sentences: **The Play button renders "Abspielen" because every user has `Configuration.UICulture` absent so the SPA defers to the browser's `Accept-Language: de-*`, and `bin/force-english-all-users.sh` (the doc-15 fix) was authored but never run. Even after running it, 92 non-English locale chunks remain reachable on the bind-mounted web bundle, leaving pre-auth and edge-case surfaces still German-capable.** --- ## Per-Layer Findings | # | Layer | Current Value | Desired | How to Fix | Owner | |---|---|---|---|---|---| | 1 | Server `/System/Configuration.UICulture` | `en-US` | `en-US` | Already correct (admin dashboard locale; does NOT cascade to users — see doc 15 §3) | server (none — already correct) | | 2 | Server `/System/Configuration.PreferredMetadataLanguage` | `en` | `en` | Already correct | server (none) | | 3 | Server `/System/Configuration.MetadataCountryCode` | `US` | `US` | Already correct | server (none) | | 4 | Server `/Branding/Configuration.LoginDisclaimer` | "Welcome to ARRFLIX - Private invite only service" | English already | OK | server (none) | | 5 | **Per-user `Configuration.UICulture` (8/8 absent)** | **all absent** | `en-US` on every user | **Run `bin/force-english-all-users.sh`** with admin token; idempotent. Endpoint: `POST /Users/{userId}/Configuration` with full Configuration block + `UICulture:"en-US"`. | **server agent — primary fix** | | 6 | Per-user `Configuration.AudioLanguagePreference` (8/8) | `eng` | `eng` | Already correct | server (none) | | 7 | Per-user `Configuration.SubtitleLanguagePreference` (8/8) | `eng` | `eng` | Already correct | server (none) | | 8 | Per-user `Configuration.PlayDefaultAudioTrack` (8/8) | `true` | `true` | Already correct | server (none) | | 9 | Per-user `Configuration.SubtitleMode` (8/8) | `Default` | `Default` | Already correct | server (none) | | 10 | Per-user `DisplayPreferences.CustomPrefs.language` | (key not present for any user) | (still not present) | Confirmed read-only of all 8 users via `GET /DisplayPreferences/usersettings?userId=...&client=emby` — no `language` key in `CustomPrefs`. Locale is NOT stored here. Layer is non-issue. | none | | 11 | Plugin-shipped UI strings | 6 plugins (AudioDB, MusicBrainz, OMDb, Open Subtitles, Studio Images, TMDb); none ship locale UI strings | None | No action — these are metadata-source plugins, not UI string sources. | none | | 12 | Available `/Localization/Cultures` | 191 | 191 (cosmetic — admin-only) | API returns the full ISO list regardless of disk content. Cannot be trimmed via API. Admin-only. Defer. | docs (no action) | | 13 | Available `/Localization/Options` (display lang) | 71 | 1 (en-US only, ideally) | Same as 12 — API list is hardcoded in Jellyfin. Cannot be trimmed via API. **But the user-facing dropdown that uses this list is on `mypreferencesmenu.html` which is already hidden by the inject-shim.** Non-issue for non-admins; admin keeps full list. | none — already gated by shim | | 14 | Available `/Localization/Countries` | 139 | 139 | Cosmetic; admin-only. No action. | none | | 15 | SPA `index.html` HTML response | identical for `Accept-Language: de-DE` and `en-US` | identical | Confirmed: `curl -H 'Accept-Language: de-*'` and `en-US` return byte-identical 59757-byte HTML. **Locale selection happens client-side in JS**, not server-side. So there is no server header rewrite to add. | web (none) | | 16 | **Web bundle locale chunks `-json..chunk.js`** | **93 locale chunks served (de, fr, es, ru, zh-cn, ja, ko, ...)** including `de-json.1afccc006ab8bb6c5953.chunk.js` containing `"Play":"Abspielen"` | only `en-us-json..chunk.js` reachable; all others 404 | **Override 92 non-English chunks** to empty/redirect at the bind-mount layer (see "Files to Delete" §). Compose pattern: bind-mount each as `:/jellyfin/jellyfin-web/-json..chunk.js:ro` from a 1-byte `{}` stub. Drawback: chunk hashes rotate on JF upgrade — record filenames in `web-overrides/README.md` and re-pin after each image bump. **Cleaner alternative:** add a Traefik middleware `regexReplaceHeaders` rule that 404s any `*-json.*.chunk.js` whose lang prefix isn't `en-us`. | **web agent — secondary fix (defense in depth)** | | 17 | **PWA manifest `lang`** | `"lang": "en-US"` in `fd4301fdc170fd202474.json` | `"lang": "en-US"` (and `name`/`short_name` rebranded — see doc 16 F1) | manifest `lang` is already correct, but `name`/`short_name` are still `Jellyfin`. Folded into doc 16 F1, not duplicated here. | web (doc 16 work) | | 18 | Pre-auth splash bundle strings | reads `navigator.language` before any user is authed | en-US only | Doc 15 §"What CANNOT be forced" §1 noted this is unfixable without a runtime shim that overrides `navigator.language`. **NEW PROPOSAL:** patch `bin/inject-shim.py` to inject `Object.defineProperty(navigator, 'language', { value: 'en-US' }); Object.defineProperty(navigator, 'languages', { value: ['en-US'] });` BEFORE any other JS executes. The inject-shim runs in `` before bundles load, so this is the right vehicle. | **web agent — closes pre-auth leak** | | 19 | Reverse-proxy `Accept-Language` | passed through unchanged (Traefik) | rewrite to `en-US` | doc 15 §"What CANNOT be forced" §2 already evaluated and rejected this as too aggressive for the multi-tenant Traefik. **Re-evaluation:** ARRFLIX is the only consumer of arrflix.s8n.ru via this Traefik router; rewriting Accept-Language at the router level is safe and would mean (5) and (16) and (18) are all redundant defense-in-depth. Add a `traefik.http.middlewares.arrflix-lang.headers.customrequestheaders.Accept-Language=en-US,en;q=0.9` middleware. | **web agent — alternative single-layer fix** | | 20 | New-user creation script `bin/add-jellyfin-user.sh` | does NOT set `UICulture` | sets `UICulture="en-US"` | doc 15 already documented the one-line patch in step `[3/4]`. Apply the diff. | server agent (doc 15 work) | --- ## Per-User Table (live state, 2026-05-08) | User | UserId | UICulture | Audio Pref | Subtitle Pref | needs-update | |---|---|---|---|---|---| | 5 | `571decc67cdc4ea683b4c936b0a31ff8` | **absent** | eng | eng | **Y** | | 64bitpotato | `106e347364a643fda324a7a1de3422f6` | **absent** | eng | eng | **Y** | | aloy | `5447c6246a704533a149910155d5422e` | **absent** | eng | eng | **Y** | | guest | `82dd8542915740c8ae799b6723542c63` | **absent** | eng | eng | **Y** | | house | `a4cbcdf95bb34888885af6fbf5c340d1` | **absent** | eng | eng | **Y** | | marco | `d787fbfc373a44119a247e7406b2721e` | **absent** | eng | eng | **Y** | | pet | `d60e249518264357a6072a08829d43ec` | **absent** | eng | eng | **Y** | | s8n (admin) | `2be0f0d3fe3a45dc9298138a15a01925` | **absent** | eng | eng | **Y** | **Count needing update: 8 of 8 users.** This is the entire active user roster. Doc 15 (2026-05-08) listed only 5 users (`5`, `guest`, `house`, `marco`, `s8n`); the roster has since grown to 8 (added: `64bitpotato`, `aloy`, `pet`). All 3 new users were created via `bin/add-jellyfin-user.sh` **without** the doc-15 wrapper patch (UICulture line not added), so they also inherit the bug. --- ## Remediation Checklist (concrete endpoints/bodies for sibling agents) > Do not execute from this audit doc. Sibling agents own implementation. ### Server agent — primary fix (closes layer 5, single biggest impact) ```bash # All 8 users in one go (idempotent): JELLYFIN_TOKEN='${JELLYFIN_API_TOKEN}' bin/force-english-all-users.sh # Spot-verify one user post-fix (expect "en-US"): curl -ks https://arrflix.s8n.ru/Users/d787fbfc373a44119a247e7406b2721e \ -H "Authorization: MediaBrowser Token=${JELLYFIN_API_TOKEN}" \ | jq -r '.Configuration.UICulture' ``` After this lands, every authenticated session is pinned to en-US regardless of browser. Pre-auth and chunk-bundle leaks (16, 18) remain. ### Server agent — wrapper patch (closes layer 20, prevents regression) Apply the doc-15 §"Wrapper update for future users" one-line patch to `bin/add-jellyfin-user.sh` step `[3/4]`: ```python c['UICulture'] = 'en-US' # NEW: pin UI to English regardless of browser Accept-Language ``` ### Web agent — defense-in-depth chunk lockdown (closes layer 16) Two paths, pick one: **Path A — Traefik middleware (preferred, single point of control):** ```yaml # In docker-compose.yml jellyfin labels: - "traefik.http.routers.jellyfin.middlewares=arrflix-lang" - "traefik.http.middlewares.arrflix-lang.headers.customrequestheaders.Accept-Language=en-US,en;q=0.9" ``` Pros: one line, no bind-mounts to maintain, immune to JF upgrades. Cons: doesn't help with chunk filename leak if the bundle ever fingerprints on something other than Accept-Language. **Path B — chunk bind-mount stubs (heavy but airtight):** For each non-English chunk in `web-overrides/README.md` (record list per JF image upgrade), bind a 1-byte `{}` stub: ```yaml - /opt/docker/jellyfin/web-overrides/empty-chunk.js:/jellyfin/jellyfin-web/de-json.1afccc006ab8bb6c5953.chunk.js:ro - /opt/docker/jellyfin/web-overrides/empty-chunk.js:/jellyfin/jellyfin-web/fr-json..chunk.js:ro ... (×91 more) ``` Where `empty-chunk.js` contents: ```js (self.webpackChunk=self.webpackChunk||[]).push([[XXXXX],{}]); ``` (XXXXX = chunk-id from runtime.bundle.js for that locale; chunk-ids listed in §"Files to Delete" below.) Recommended: ship Path A first as the cheap belt; defer Path B to Phase 2 unless the owner specifically wants the chunk files unreachable. ### Web agent — pre-auth splash fix (closes layer 18) Append to the IIFE in `bin/inject-shim.py`, before the `start()` block: ```js // Override navigator.language BEFORE webpack bundles read it try { Object.defineProperty(navigator, 'language', { value: 'en-US', configurable: false, writable: false }); Object.defineProperty(navigator, 'languages', { value: ['en-US', 'en'], configurable: false, writable: false }); } catch(e){} ``` Combined with Path A above (Accept-Language rewrite at proxy), pre-auth splash strings render in English on first paint. ### Docs agent — supersedes notes After the above lands, update doc 15 with a "Status: applied 2026-05-XX" header and link forward to this doc. Update doc 16 F1 cross-ref since the manifest `name`/`short_name` work overlaps with the lockdown branch. --- ## Files to Delete (locale bundles served by web SPA) > 92 non-English locale chunks served from `/jellyfin/jellyfin-web/`. > Hashes were captured from the live `runtime.bundle.js` chunk-id-to-hash > map on 2026-05-08; **these will rotate on every JF image upgrade** — > regenerate this list before each upgrade with: > > ```bash > curl -ks 'https://arrflix.s8n.ru/web/runtime.bundle.js?' | python3 -c " > import re, sys > txt = sys.stdin.read() > hashmap = dict(re.findall(r'(\d+):\"([a-f0-9]{20})\"', txt)) > namemap = dict(re.findall(r'(\d+):\"([a-zA-Z0-9_-]+-json)\"', txt)) > for cid, name in sorted(namemap.items(), key=lambda x: x[1]): > if not name.startswith('en-us'): > print(f'{name}.{hashmap[cid]}.chunk.js') > " > ``` The single chunk to **keep** is `en-us-json.667484b4a441712c7e05.chunk.js`. The 92 chunks to **drop** (current hashes — re-extract on upgrade): ``` af-json.c51579ebcde4cc473828.chunk.js ar-json.1e4d5a6f9a6acf5777ba.chunk.js as-json.c9ec5dcf74b613f34865.chunk.js be-by-json.04e26c1f665c26cef640.chunk.js bg-bg-json.8f63ff103b1093a4367b.chunk.js bn-json..chunk.js bn_BD-json..chunk.js ca-json..chunk.js ch-json..chunk.js cs-json..chunk.js cy-json..chunk.js da-json..chunk.js de-json.1afccc006ab8bb6c5953.chunk.js ← THE ONE THAT BIT US (contains "Play":"Abspielen") el-json..chunk.js en-gb-json..chunk.js ← keep? en-GB is also English; defer to owner. If owner wants only en-US, drop. eo-json..chunk.js es-ar-json..chunk.js es-json..chunk.js es-mx-json..chunk.js es_419-json..chunk.js es_DO-json..chunk.js et-json..chunk.js eu-json..chunk.js fa-json..chunk.js fi-json..chunk.js fil-json..chunk.js fo-json..chunk.js fr-ca-json..chunk.js fr-json..chunk.js ga-json..chunk.js gl-json..chunk.js gsw-json..chunk.js gu-json..chunk.js he-json..chunk.js hi-in-json..chunk.js hr-json..chunk.js hu-json..chunk.js hy-json..chunk.js id-json..chunk.js is-is-json..chunk.js it-json..chunk.js ja-json..chunk.js jbo-json..chunk.js ka-json..chunk.js kab-json..chunk.js kk-json..chunk.js kn-json..chunk.js ko-json..chunk.js lt-lt-json..chunk.js lv-json..chunk.js mk-json..chunk.js ml-json..chunk.js mn-mn-json..chunk.js mr-json..chunk.js ms-json..chunk.js nb-json..chunk.js ne-json..chunk.js nl-json..chunk.js nn-json..chunk.js pa-json..chunk.js pl-json..chunk.js pr-json..chunk.js pt-br-json..chunk.js pt-json..chunk.js pt-pt-json..chunk.js ro-json..chunk.js ru-json..chunk.js si-json..chunk.js sk-json..chunk.js sl-si-json..chunk.js so-json..chunk.js sq-json..chunk.js sr-json..chunk.js sv-json..chunk.js sw-json..chunk.js ta-json..chunk.js te-json..chunk.js th-json..chunk.js tr-json..chunk.js uk-json..chunk.js ur_PK-json..chunk.js uz-json..chunk.js vi-json.5ce142c3b4228beafe7a.chunk.js zh-cn-json.9ef4c0ef42cc04d64912.chunk.js zh-hk-json.faa0648f6b0f186e6c07.chunk.js zh-tw-json.d07cd62eb7dd68687b64.chunk.js zu-json.0c869775f5145121570c.chunk.js ... (full 92-line list saved to web-overrides/README.md when web agent regenerates) ``` The full count is 93 chunk files served at runtime; one (`en-us-json.`) is kept, 92 are dropped. Decision required from owner: drop `en-gb-json` too, or accept en-GB as a tolerable secondary English locale? Doc 15 line 19 mentioned `TARGET_LOCALE=en-GB` is an alternate option, suggesting en-GB is not categorically rejected. **Default recommendation: drop en-gb too — "English only, en-US canonical".** --- ## Cross-References - `docs/15-force-english.md` — original per-user UICulture diagnosis + `bin/force-english-all-users.sh` (script exists, **not yet run**) + wrapper patch for `bin/add-jellyfin-user.sh` (**not yet applied**). This audit confirms doc 15's diagnosis is still accurate and adds the user-count update (5 → 8). - `docs/16-jellyfin-branding-leaks.md` — covers the Jellyfin word in PWA manifest `name`/`short_name` (F1), screensaver banner (F2), i18n keys containing "Jellyfin" in en-us-json chunk (F3). The PWA manifest `lang` field is already `en-US` so no action overlap; only the `name`/`short_name` work overlaps with this doc's branding-vs-locale axis. F3's DOM text rewrite shim is orthogonal — it strips the *word* Jellyfin from English strings, while this doc strips *non-English strings entirely*. - `docs/10-spa-runtime-shim.md` — vehicle for the proposed `Object.defineProperty(navigator, 'language', …)` snippet (see Layer 18). Same `inject-shim.py` already in use; one new `try/catch` block. - `docs/04-theming-and-users.md` — CustomCss is unrelated to locale; no overlap, no action. --- ## Sign-off - **Audit run by:** s8n, 2026-05-08, admin token via `X-Emby-Token` header. - **Mode:** read-only. Zero POST/PATCH/PUT to Jellyfin. Zero file modifications outside this `docs/19-english-only-audit.md`. - **Live state:** all 8 users at UICulture-absent (root cause confirmed); 93 locale bundles served (1 keep / 92 drop); SPA index.html serves byte-identical regardless of `Accept-Language` (locale is client-side); doc-15 fix exists but unrun; doc-15 wrapper patch unapplied. - **Recommended next action:** server agent runs `bin/force-english-all-users.sh` and applies the wrapper patch (closes 80% of the leak in 30 seconds). Web agent adds the Traefik `Accept-Language` middleware (Path A) and the `navigator.language` shim (closes the remaining pre-auth leak). Defer chunk bind-mounts (Path B) to Phase 2.