starred/qBittorrent

Fork 0

mirror of https://github.com/qbittorrent/qBittorrent.git synced 2026-03-02 22:57:32 -05:00

Cannot manually add peers through WebUI #17296

New issue

Open

opened 2026-02-22 03:46:36 -05:00 by deekerman · 9 comments

deekerman commented

2026-02-22 03:46:36 -05:00

Owner

Originally created by @Flaconia on GitHub (Nov 12, 2025).

qBittorrent & operating system versions

qBittorrent: v5.1.3 WebUI (64-bit)
Qt: 6.10.0
Libtorrent: 2.0.11.0
Boost: 1.89.0
OpenSSL: 3.6.0
zlib: 1.3.1.1-motley

OS: TrueNAS Core 25.10.0 Goldeye (Debian)
Browser: Firefox 145.0 (64-bit)

What is the problem?

I can't manually add peers in the WebUI of my NAS. After I right click in the Nodes area and choose Add peers... the relative panel appears, I can fill the field but then, when trying to press the OK button, nothing happens. The button gets clicked and produces no effect whatsoever. The panel remains there intact and the peers are not added to the list, nor any message of any kind pops up.
Pressing Cancel correctly closes the panel.

Steps to reproduce

Open the WebUI of your qBittorrent from a browser (I use Firefox)
Select a torrent in the list
Right click in the nodes area, and choose Add peers...
Write an IP:port or copy and paste it from another instance of the same torrent, for example from your home PC's torrent client
Click OK

Additional context

No response

Log(s) & preferences file(s)

I'm not able to upload log and preference files cause I'm having trouble installing a File Browser on my NAS (File Browser throws me an error while installing) at the moment, if you strictly need them let me know and I'll try to provide them ASAP.

Originally created by @Flaconia on GitHub (Nov 12, 2025). ### qBittorrent & operating system versions qBittorrent: v5.1.3 WebUI (64-bit) Qt: 6.10.0 Libtorrent: 2.0.11.0 Boost: 1.89.0 OpenSSL: 3.6.0 zlib: 1.3.1.1-motley OS: TrueNAS Core 25.10.0 Goldeye (Debian) Browser: Firefox 145.0 (64-bit) ### What is the problem? I can't manually add peers in the WebUI of my NAS. After I right click in the Nodes area and choose Add peers... the relative panel appears, I can fill the field but then, when trying to press the OK button, nothing happens. The button gets clicked and produces no effect whatsoever. The panel remains there intact and the peers are not added to the list, nor any message of any kind pops up. Pressing Cancel correctly closes the panel. <img width="563" height="414" alt="Image" src="https://github.com/user-attachments/assets/01936aa9-8595-4cbc-ad71-d43d7ea10329" /> ### Steps to reproduce 1. Open the WebUI of your qBittorrent from a browser (I use Firefox) 2. Select a torrent in the list 3. Right click in the nodes area, and choose Add peers... 4. Write an IP:port or copy and paste it from another instance of the same torrent, for example from your home PC's torrent client 5. Click OK ### Additional context _No response_ ### Log(s) & preferences file(s) _I'm not able to upload log and preference files cause I'm having trouble installing a File Browser on my NAS (File Browser throws me an error while installing) at the moment, if you strictly need them let me know and I'll try to provide them ASAP._

deekerman added the

WebUI

label

2026-02-22 03:46:36 -05:00

deekerman commented

2026-02-22 03:46:39 -05:00

Author

Owner

@qBittUser commented on GitHub (Nov 22, 2025):

v5.1.3

Can you reproduce with v5.1.4?

@qBittUser commented on GitHub (Nov 22, 2025): > v5.1.3 Can you reproduce with v5.1.4?

deekerman commented

2026-02-22 03:46:41 -05:00

Author

Owner

@Flaconia commented on GitHub (Nov 24, 2025):

Can you reproduce with v5.1.4?

Yes, same behaviour.
Just to be sure, I tried to do the opposite, copy a peer's IP:port from the WebUI into my PC qB client.
In my PC what happens is I can click the OK button, I'm prompted with a message saying the peer has been added to the torrent but, checking in that torrent's peer list, the manually added IP doesn't appear.
This might indicate the issue comes from qB directly, not just from the WebUI.

Can anyone successfully add an IP whatsoever, and how do you do it?
Does the IP have to comply to certain conditions? Maybe the peer doesn't appear cause qB performs some kind of check and decides that Ip is not useful there?

@Flaconia commented on GitHub (Nov 24, 2025): > Can you reproduce with v5.1.4? Yes, same behaviour. Just to be sure, I tried to do the opposite, copy a peer's IP:port from the WebUI into my PC qB client. In my PC what happens is I can click the OK button, I'm prompted with a message saying the peer has been added to the torrent but, checking in that torrent's peer list, the manually added IP doesn't appear. This might indicate the issue comes from qB directly, not just from the WebUI. Can anyone successfully add an IP whatsoever, and how do you do it? Does the IP have to comply to certain conditions? Maybe the peer doesn't appear cause qB performs some kind of check and decides that Ip is not useful there?

deekerman commented

2026-02-22 03:46:41 -05:00

Author

Owner

@HanabishiRecca commented on GitHub (Nov 27, 2025):

Yes, same behaviour.

Can you please look if there any errors in the browser console (press Ctrl+Sift+K while on the page)?

I'm prompted with a message saying the peer has been added to the torrent but, checking in that torrent's peer list, the manually added IP doesn't appear.

That's expected behavior. Only active (transferring data) peers are shown there.

@HanabishiRecca commented on GitHub (Nov 27, 2025): > Yes, same behaviour. Can you please look if there any errors in the browser console (press `Ctrl+Sift+K` while on the page)? > I'm prompted with a message saying the peer has been added to the torrent but, checking in that torrent's peer list, the manually added IP doesn't appear. That's expected behavior. Only active (transferring data) peers are shown there.

deekerman commented

2026-02-22 03:46:41 -05:00

Author

Owner

@Flaconia commented on GitHub (Nov 27, 2025):

Can you please look if there any errors in the browser console (press Ctrl+Sift+K while on the page)?

There's one indeed:

Uncaught SyntaxError: "" string literal contains an unescaped line break
and a link to the source of the error: addpeers.html:48:65

This is the code that the link sends to:

@Flaconia commented on GitHub (Nov 27, 2025): > Can you please look if there any errors in the browser console (press `Ctrl+Sift+K` while on the page)? There's one indeed: `Uncaught SyntaxError: "" string literal contains an unescaped line break` and a link to the source of the error: `addpeers.html:48:65` This is the code that the link sends to: <img width="786" height="435" alt="Image" src="https://github.com/user-attachments/assets/270963cd-9f75-4781-8f29-371a5b03e269" />

deekerman commented

2026-02-22 03:46:41 -05:00

Author

Owner

@HanabishiRecca commented on GitHub (Nov 27, 2025):

Seems like translation has borked the source code. You could switch to english for now.

v5_1_x branch has a line break here.

github.com/qbittorrent/qBittorrent@33e5e77220/src/webui/www/translations/webui_it.ts (L328-L329)

But current master is fine.

github.com/qbittorrent/qBittorrent@a77b17e6da/src/webui/www/translations/webui_it.ts (L464)

@glassez it needs a backport.

@HanabishiRecca commented on GitHub (Nov 27, 2025): Seems like translation has borked the source code. You could switch to english for now. --- `v5_1_x` branch has a line break here. https://github.com/qbittorrent/qBittorrent/blob/33e5e772200b5e2f9d23af8870ce7436ec216faa/src/webui/www/translations/webui_it.ts#L328-L329 But current `master` is fine. https://github.com/qbittorrent/qBittorrent/blob/a77b17e6dafadca1eb0f80d4c0167c791107f787/src/webui/www/translations/webui_it.ts#L464 @glassez it needs a backport.

deekerman commented

2026-02-22 03:46:41 -05:00

Author

Owner

@HanabishiRecca commented on GitHub (Nov 27, 2025):

I actually feel a bit anxious about translations being able to inject arbitrary code, considering how they are being pulled.
Maybe some form of sanitization is required?

@Chocobo1 @glassez @Piccirello @sledgehammer999 @xavier2k6

@HanabishiRecca commented on GitHub (Nov 27, 2025): I actually feel a bit anxious about translations being able to inject arbitrary code, considering how they are being pulled. Maybe some form of sanitization is required? @Chocobo1 @glassez @Piccirello @sledgehammer999 @xavier2k6

deekerman commented

2026-02-22 03:46:41 -05:00

Author

Owner

@Piccirello commented on GitHub (Nov 27, 2025):

I actually feel a bit anxious about translations being able to inject arbitrary code, considering how they are being pulled. Maybe some form of sanitization is required?

@Chocobo1 @glassez @Piccirello @sledgehammer999 @xavier2k6

This is a really good point. I wonder if our translation injection function (QBT_TR?) should strip certain characters, like newlines. Ideally it would also sanitize the values, but the sanitization would have to be context specific. For ex, html sanitization is distinctly different from JS sanitization.

@Piccirello commented on GitHub (Nov 27, 2025): > I actually feel a bit anxious about translations being able to inject arbitrary code, considering how they are being pulled. Maybe some form of sanitization is required? > > [@Chocobo1](https://github.com/Chocobo1) [@glassez](https://github.com/glassez) [@Piccirello](https://github.com/Piccirello) [@sledgehammer999](https://github.com/sledgehammer999) [@xavier2k6](https://github.com/xavier2k6) This is a really good point. I wonder if our translation injection function (`QBT_TR`?) should strip certain characters, like newlines. Ideally it would also sanitize the values, but the sanitization would have to be context specific. For ex, html sanitization is distinctly different from JS sanitization.

deekerman commented

2026-02-22 03:46:41 -05:00

Author

Owner

@HanabishiRecca commented on GitHub (Nov 27, 2025):

I think the easiest way is to just convert all strings into Unicode escape sequences.
I.e. "foo bar" -> "\u0066\u006f\u006f\u0020\u0062\u0061\u0072".

@HanabishiRecca commented on GitHub (Nov 27, 2025): I think the easiest way is to just convert all strings into Unicode escape sequences. I.e. `"foo bar"` -> `"\u0066\u006f\u006f\u0020\u0062\u0061\u0072"`.

deekerman commented

2026-02-22 03:46:42 -05:00

Author

Owner

@Piccirello commented on GitHub (Nov 29, 2025):

The unicode escape sequences would work for escaping strings injected into JS, but I don't think they'd prevent XSS in HTML.

@Piccirello commented on GitHub (Nov 29, 2025): The unicode escape sequences would work for escaping strings injected into JS, but I don't think they'd prevent XSS in HTML.