Complete Phase 4: security hardening, player/playlist/admin UI, docs
Security: - New internal/netguard package: podcast feed/enclosure fetching now refuses to dial non-public IPs (loopback/RFC1918/link-local/cloud metadata/CGNAT), validated per-connection including across redirects, closing an SSRF gap where a malicious or compromised feed URL could probe the server's internal network. Configurable via VIBESONIC_PODCASTS_ALLOW_PRIVATE_NETWORKS for intentional LAN feeds. - Podcast episode downloads capped at 4GB (was unbounded, disk-exhaustion risk) - Cover art decoding now rejects images above a 40-megapixel budget before full decode (decompression-bomb guard) - HTTP server sets ReadHeaderTimeout (slowloris hardening) - Admin folder-scan redirect now validated as same-site instead of trusting the raw Referer header (open-redirect fix) - Legacy Subsonic token/salt auth now uses a constant-time comparison Web UI completion: - Persistent player: shuffle and repeat (off/all/one) controls, wired into queue advance/prev logic and persisted like other player state - Admin user-permissions form: adminRole toggle (with a guard against demoting the last remaining admin) and per-user music-folder access checkboxes, backed by existing schema/enforcement that was previously unreachable from the UI - Playlist M3U8 import/export Docs: added docs/client-compatibility.md (honest tracking template — no client testing has been performed), docs/deployment.md, docs/security.md, docs/backup.md; refreshed README and cross-links; added a footnote in docs/subsonic-compatibility.md distinguishing spec-standard from VibeSonic-original OpenSubsonic extensions. Also added Go fuzz tests for the external-auth CIDR/IP parser and the LRC lyrics parser. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014r98AtcBbevpscWLsfwVvv
This commit is contained in:
Claude Sonnet 5
+111
-7
@@ -26,9 +26,20 @@
|
||||
this.ui = ui;
|
||||
this.queue = [];
|
||||
this.index = -1;
|
||||
this.shuffle = false;
|
||||
this.repeat = "off"; // "off" | "all" | "one"
|
||||
this.shuffleOrder = []; // permutation of queue indices; shufflePos points into it
|
||||
this.shufflePos = -1;
|
||||
try {
|
||||
this.shuffle = localStorage.getItem("vs-shuffle") === "1";
|
||||
var storedRepeat = localStorage.getItem("vs-repeat");
|
||||
if (storedRepeat === "all" || storedRepeat === "one") this.repeat = storedRepeat;
|
||||
} catch (e) {
|
||||
/* storage may be unavailable (private browsing); state just won't persist */
|
||||
}
|
||||
this.audio.addEventListener("timeupdate", this._onTimeUpdate.bind(this));
|
||||
this.audio.addEventListener("loadedmetadata", this._onTimeUpdate.bind(this));
|
||||
this.audio.addEventListener("ended", this.next.bind(this));
|
||||
this.audio.addEventListener("ended", this._onEnded.bind(this));
|
||||
this.audio.addEventListener("play", this._syncPlayIcon.bind(this));
|
||||
this.audio.addEventListener("pause", this._syncPlayIcon.bind(this));
|
||||
}
|
||||
@@ -36,10 +47,68 @@
|
||||
VibeSonicPlayer.prototype.playQueue = function (songs, startIndex) {
|
||||
this.queue = songs;
|
||||
this.index = startIndex || 0;
|
||||
this._reshuffle();
|
||||
this._loadCurrent();
|
||||
this.audio.play().catch(function () {});
|
||||
};
|
||||
|
||||
// _reshuffle rebuilds the shuffle order (a Fisher-Yates permutation of
|
||||
// every queue index except the currently-playing one, which is pinned
|
||||
// to the front) whenever the queue changes or shuffle is toggled on,
|
||||
// so "next" has a fresh random order to draw from without immediately
|
||||
// repeating the track that's already playing.
|
||||
VibeSonicPlayer.prototype._reshuffle = function () {
|
||||
var order = [];
|
||||
for (var i = 0; i < this.queue.length; i++) {
|
||||
if (i !== this.index) order.push(i);
|
||||
}
|
||||
for (var j = order.length - 1; j > 0; j--) {
|
||||
var k = Math.floor(Math.random() * (j + 1));
|
||||
var tmp = order[j];
|
||||
order[j] = order[k];
|
||||
order[k] = tmp;
|
||||
}
|
||||
order.unshift(this.index);
|
||||
this.shuffleOrder = order;
|
||||
this.shufflePos = 0;
|
||||
};
|
||||
|
||||
VibeSonicPlayer.prototype.setShuffle = function (on) {
|
||||
this.shuffle = on;
|
||||
try {
|
||||
localStorage.setItem("vs-shuffle", on ? "1" : "0");
|
||||
} catch (e) {}
|
||||
if (on) this._reshuffle();
|
||||
if (this.ui.shuffleBtn) this.ui.shuffleBtn.classList.toggle("active", on);
|
||||
};
|
||||
|
||||
VibeSonicPlayer.prototype.cycleRepeat = function () {
|
||||
this.repeat = this.repeat === "off" ? "all" : this.repeat === "all" ? "one" : "off";
|
||||
try {
|
||||
localStorage.setItem("vs-repeat", this.repeat);
|
||||
} catch (e) {}
|
||||
this._syncRepeatButton();
|
||||
};
|
||||
|
||||
VibeSonicPlayer.prototype._syncRepeatButton = function () {
|
||||
var btn = this.ui.repeatBtn;
|
||||
if (!btn) return;
|
||||
btn.dataset.repeat = this.repeat;
|
||||
btn.classList.toggle("active", this.repeat !== "off");
|
||||
var icon = btn.querySelector("i");
|
||||
if (icon) icon.className = this.repeat === "one" ? "bi bi-repeat-1" : "bi bi-repeat";
|
||||
btn.title = this.repeat === "off" ? "Repeat: off" : this.repeat === "all" ? "Repeat: all" : "Repeat: one";
|
||||
};
|
||||
|
||||
VibeSonicPlayer.prototype._onEnded = function () {
|
||||
if (this.repeat === "one") {
|
||||
this.audio.currentTime = 0;
|
||||
this.audio.play().catch(function () {});
|
||||
return;
|
||||
}
|
||||
this.next();
|
||||
};
|
||||
|
||||
VibeSonicPlayer.prototype._loadCurrent = function () {
|
||||
var song = this.queue[this.index];
|
||||
if (!song) return;
|
||||
@@ -145,11 +214,25 @@
|
||||
};
|
||||
|
||||
VibeSonicPlayer.prototype.next = function () {
|
||||
if (this.index + 1 < this.queue.length) {
|
||||
if (!this.queue.length) return;
|
||||
if (this.shuffle) {
|
||||
if (this.shufflePos + 1 < this.shuffleOrder.length) {
|
||||
this.shufflePos++;
|
||||
} else if (this.repeat === "all") {
|
||||
this._reshuffle();
|
||||
} else {
|
||||
return;
|
||||
}
|
||||
this.index = this.shuffleOrder[this.shufflePos];
|
||||
} else if (this.index + 1 < this.queue.length) {
|
||||
this.index++;
|
||||
this._loadCurrent();
|
||||
this.audio.play().catch(function () {});
|
||||
} else if (this.repeat === "all") {
|
||||
this.index = 0;
|
||||
} else {
|
||||
return;
|
||||
}
|
||||
this._loadCurrent();
|
||||
this.audio.play().catch(function () {});
|
||||
};
|
||||
|
||||
VibeSonicPlayer.prototype.prev = function () {
|
||||
@@ -157,11 +240,17 @@
|
||||
this.audio.currentTime = 0;
|
||||
return;
|
||||
}
|
||||
if (this.index > 0) {
|
||||
if (this.shuffle) {
|
||||
if (this.shufflePos <= 0) return;
|
||||
this.shufflePos--;
|
||||
this.index = this.shuffleOrder[this.shufflePos];
|
||||
} else if (this.index > 0) {
|
||||
this.index--;
|
||||
this._loadCurrent();
|
||||
this.audio.play().catch(function () {});
|
||||
} else {
|
||||
return;
|
||||
}
|
||||
this._loadCurrent();
|
||||
this.audio.play().catch(function () {});
|
||||
};
|
||||
|
||||
VibeSonicPlayer.prototype.seekTo = function (fraction) {
|
||||
@@ -241,8 +330,23 @@
|
||||
volumeSlider: document.getElementById("vs-volume"),
|
||||
starBtn: document.getElementById("vs-now-star"),
|
||||
lyricsPanel: document.getElementById("vs-lyrics-panel"),
|
||||
shuffleBtn: document.getElementById("vs-shuffle-btn"),
|
||||
repeatBtn: document.getElementById("vs-repeat-btn"),
|
||||
};
|
||||
var player = new VibeSonicPlayer(audio, ui);
|
||||
player.setShuffle(player.shuffle);
|
||||
player._syncRepeatButton();
|
||||
|
||||
if (ui.shuffleBtn) {
|
||||
ui.shuffleBtn.addEventListener("click", function () {
|
||||
player.setShuffle(!player.shuffle);
|
||||
});
|
||||
}
|
||||
if (ui.repeatBtn) {
|
||||
ui.repeatBtn.addEventListener("click", function () {
|
||||
player.cycleRepeat();
|
||||
});
|
||||
}
|
||||
|
||||
var lyricsBtn = document.getElementById("vs-lyrics-btn");
|
||||
if (lyricsBtn && ui.lyricsPanel) {
|
||||
|
||||
Reference in New Issue
Block a user