owenandClaude Sonnet 5
789bf91eed
Security: - New internal/netguard package: podcast feed/enclosure fetching now refuses to dial non-public IPs (loopback/RFC1918/link-local/cloud metadata/CGNAT), validated per-connection including across redirects, closing an SSRF gap where a malicious or compromised feed URL could probe the server's internal network. Configurable via VIBESONIC_PODCASTS_ALLOW_PRIVATE_NETWORKS for intentional LAN feeds. - Podcast episode downloads capped at 4GB (was unbounded, disk-exhaustion risk) - Cover art decoding now rejects images above a 40-megapixel budget before full decode (decompression-bomb guard) - HTTP server sets ReadHeaderTimeout (slowloris hardening) - Admin folder-scan redirect now validated as same-site instead of trusting the raw Referer header (open-redirect fix) - Legacy Subsonic token/salt auth now uses a constant-time comparison Web UI completion: - Persistent player: shuffle and repeat (off/all/one) controls, wired into queue advance/prev logic and persisted like other player state - Admin user-permissions form: adminRole toggle (with a guard against demoting the last remaining admin) and per-user music-folder access checkboxes, backed by existing schema/enforcement that was previously unreachable from the UI - Playlist M3U8 import/export Docs: added docs/client-compatibility.md (honest tracking template — no client testing has been performed), docs/deployment.md, docs/security.md, docs/backup.md; refreshed README and cross-links; added a footnote in docs/subsonic-compatibility.md distinguishing spec-standard from VibeSonic-original OpenSubsonic extensions. Also added Go fuzz tests for the external-auth CIDR/IP parser and the LRC lyrics parser. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014r98AtcBbevpscWLsfwVvv
89 lines
2.7 KiB
Go
89 lines
2.7 KiB
Go
package web
|
|
|
|
import (
|
|
"context"
|
|
"net/http"
|
|
|
|
"git.noroutes.net/NoRoutes/vibetunes/internal/database"
|
|
"git.noroutes.net/NoRoutes/vibetunes/internal/netguard"
|
|
)
|
|
|
|
func (h *Web) handleAdminPodcasts(w http.ResponseWriter, r *http.Request) {
|
|
channels, err := database.ListPodcastChannels(h.DB)
|
|
if err != nil {
|
|
http.Error(w, "internal error", http.StatusInternalServerError)
|
|
return
|
|
}
|
|
type channelView struct {
|
|
Channel *database.PodcastChannel
|
|
Episodes []*database.PodcastEpisode
|
|
}
|
|
var views []channelView
|
|
for _, c := range channels {
|
|
episodes, _ := database.ListPodcastEpisodes(h.DB, c.ID)
|
|
views = append(views, channelView{Channel: c, Episodes: episodes})
|
|
}
|
|
h.page(w, r, "admin_podcasts", "admin_podcasts", "Podcasts", views)
|
|
}
|
|
|
|
func (h *Web) handleAdminPodcastCreate(w http.ResponseWriter, r *http.Request) {
|
|
if err := r.ParseForm(); err != nil {
|
|
http.Error(w, "bad request", http.StatusBadRequest)
|
|
return
|
|
}
|
|
feedURL := r.FormValue("url")
|
|
if feedURL == "" {
|
|
http.Redirect(w, r, "/admin/podcasts", http.StatusFound)
|
|
return
|
|
}
|
|
if err := netguard.ValidateURL(feedURL); err != nil {
|
|
http.Error(w, err.Error(), http.StatusBadRequest)
|
|
return
|
|
}
|
|
channel, err := database.CreatePodcastChannel(h.DB, feedURL)
|
|
if err != nil {
|
|
http.Error(w, "internal error", http.StatusInternalServerError)
|
|
return
|
|
}
|
|
go func() { _ = h.Podcasts.RefreshChannel(context.Background(), channel.ID) }()
|
|
http.Redirect(w, r, "/admin/podcasts", http.StatusFound)
|
|
}
|
|
|
|
func (h *Web) handleAdminPodcastRefresh(w http.ResponseWriter, r *http.Request) {
|
|
id := r.PathValue("id")
|
|
if _, err := database.GetPodcastChannel(h.DB, id); err != nil {
|
|
http.NotFound(w, r)
|
|
return
|
|
}
|
|
go func() { _ = h.Podcasts.RefreshChannel(context.Background(), id) }()
|
|
http.Redirect(w, r, "/admin/podcasts", http.StatusFound)
|
|
}
|
|
|
|
func (h *Web) handleAdminPodcastDelete(w http.ResponseWriter, r *http.Request) {
|
|
id := r.PathValue("id")
|
|
if err := database.DeletePodcastChannel(h.DB, id); err != nil {
|
|
http.Error(w, "internal error", http.StatusInternalServerError)
|
|
return
|
|
}
|
|
http.Redirect(w, r, "/admin/podcasts", http.StatusFound)
|
|
}
|
|
|
|
func (h *Web) handleAdminPodcastEpisodeDownload(w http.ResponseWriter, r *http.Request) {
|
|
id := r.PathValue("id")
|
|
if _, err := database.GetPodcastEpisode(h.DB, id); err != nil {
|
|
http.NotFound(w, r)
|
|
return
|
|
}
|
|
go func() { _ = h.Podcasts.DownloadEpisode(context.Background(), id) }()
|
|
http.Redirect(w, r, "/admin/podcasts", http.StatusFound)
|
|
}
|
|
|
|
func (h *Web) handleAdminPodcastEpisodeDelete(w http.ResponseWriter, r *http.Request) {
|
|
id := r.PathValue("id")
|
|
if err := database.DeletePodcastEpisode(h.DB, id); err != nil {
|
|
http.Error(w, "internal error", http.StatusInternalServerError)
|
|
return
|
|
}
|
|
http.Redirect(w, r, "/admin/podcasts", http.StatusFound)
|
|
}
|