owenandClaude Sonnet 5
789bf91eed
Security: - New internal/netguard package: podcast feed/enclosure fetching now refuses to dial non-public IPs (loopback/RFC1918/link-local/cloud metadata/CGNAT), validated per-connection including across redirects, closing an SSRF gap where a malicious or compromised feed URL could probe the server's internal network. Configurable via VIBESONIC_PODCASTS_ALLOW_PRIVATE_NETWORKS for intentional LAN feeds. - Podcast episode downloads capped at 4GB (was unbounded, disk-exhaustion risk) - Cover art decoding now rejects images above a 40-megapixel budget before full decode (decompression-bomb guard) - HTTP server sets ReadHeaderTimeout (slowloris hardening) - Admin folder-scan redirect now validated as same-site instead of trusting the raw Referer header (open-redirect fix) - Legacy Subsonic token/salt auth now uses a constant-time comparison Web UI completion: - Persistent player: shuffle and repeat (off/all/one) controls, wired into queue advance/prev logic and persisted like other player state - Admin user-permissions form: adminRole toggle (with a guard against demoting the last remaining admin) and per-user music-folder access checkboxes, backed by existing schema/enforcement that was previously unreachable from the UI - Playlist M3U8 import/export Docs: added docs/client-compatibility.md (honest tracking template — no client testing has been performed), docs/deployment.md, docs/security.md, docs/backup.md; refreshed README and cross-links; added a footnote in docs/subsonic-compatibility.md distinguishing spec-standard from VibeSonic-original OpenSubsonic extensions. Also added Go fuzz tests for the external-auth CIDR/IP parser and the LRC lyrics parser. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014r98AtcBbevpscWLsfwVvv
74 lines
4.2 KiB
HTML
74 lines
4.2 KiB
HTML
{{define "admin_user_permissions"}}{{template "header" .}}
|
|
<div class="card" style="max-width: 500px;">
|
|
<div class="card-body">
|
|
<h2 class="h6">{{.Data.Username}}</h2>
|
|
<form method="post" action="/admin/users/{{.Data.ID}}/permissions">
|
|
{{template "csrf_field" .CSRFToken}}
|
|
<div class="form-check">
|
|
<input class="form-check-input" type="checkbox" name="admin" value="1" id="p_admin" {{if .Data.IsAdmin}}checked{{end}}>
|
|
<label class="form-check-label" for="p_admin"><strong>Administrator</strong></label>
|
|
</div>
|
|
<div class="form-check">
|
|
<input class="form-check-input" type="checkbox" name="settings" value="1" id="p_settings" {{if .Data.Permissions.Settings}}checked{{end}}>
|
|
<label class="form-check-label" for="p_settings">Settings</label>
|
|
</div>
|
|
<div class="form-check">
|
|
<input class="form-check-input" type="checkbox" name="stream" value="1" id="p_stream" {{if .Data.Permissions.Stream}}checked{{end}}>
|
|
<label class="form-check-label" for="p_stream">Stream</label>
|
|
</div>
|
|
<div class="form-check">
|
|
<input class="form-check-input" type="checkbox" name="download" value="1" id="p_download" {{if .Data.Permissions.Download}}checked{{end}}>
|
|
<label class="form-check-label" for="p_download">Download</label>
|
|
</div>
|
|
<div class="form-check">
|
|
<input class="form-check-input" type="checkbox" name="upload" value="1" id="p_upload" {{if .Data.Permissions.Upload}}checked{{end}}>
|
|
<label class="form-check-label" for="p_upload">Upload</label>
|
|
</div>
|
|
<div class="form-check">
|
|
<input class="form-check-input" type="checkbox" name="playlist" value="1" id="p_playlist" {{if .Data.Permissions.Playlist}}checked{{end}}>
|
|
<label class="form-check-label" for="p_playlist">Playlist</label>
|
|
</div>
|
|
<div class="form-check">
|
|
<input class="form-check-input" type="checkbox" name="cover_art" value="1" id="p_cover_art" {{if .Data.Permissions.CoverArt}}checked{{end}}>
|
|
<label class="form-check-label" for="p_cover_art">Cover Art</label>
|
|
</div>
|
|
<div class="form-check">
|
|
<input class="form-check-input" type="checkbox" name="comment" value="1" id="p_comment" {{if .Data.Permissions.Comment}}checked{{end}}>
|
|
<label class="form-check-label" for="p_comment">Comment</label>
|
|
</div>
|
|
<div class="form-check">
|
|
<input class="form-check-input" type="checkbox" name="podcast" value="1" id="p_podcast" {{if .Data.Permissions.Podcast}}checked{{end}}>
|
|
<label class="form-check-label" for="p_podcast">Podcast</label>
|
|
</div>
|
|
<div class="form-check">
|
|
<input class="form-check-input" type="checkbox" name="share" value="1" id="p_share" {{if .Data.Permissions.Share}}checked{{end}}>
|
|
<label class="form-check-label" for="p_share">Share</label>
|
|
</div>
|
|
<div class="form-check">
|
|
<input class="form-check-input" type="checkbox" name="jukebox" value="1" id="p_jukebox" {{if .Data.Permissions.Jukebox}}checked{{end}}>
|
|
<label class="form-check-label" for="p_jukebox">Jukebox</label>
|
|
</div>
|
|
<div class="form-check mb-3">
|
|
<input class="form-check-input" type="checkbox" name="video_conversion" value="1" id="p_video" {{if .Data.Permissions.VideoConversion}}checked{{end}}>
|
|
<label class="form-check-label" for="p_video">Video Conversion</label>
|
|
</div>
|
|
<hr>
|
|
<h3 class="h6">Music Folder Access</h3>
|
|
<p class="small text-body-secondary">Leave all unchecked for unrestricted access to every folder.</p>
|
|
{{range .Data.Folders}}
|
|
<div class="form-check">
|
|
<input class="form-check-input" type="checkbox" name="music_folders" value="{{.ID}}" id="f_{{.ID}}" {{if index $.Data.AllowedFolders .ID}}checked{{end}}>
|
|
<label class="form-check-label" for="f_{{.ID}}">{{.Name}}</label>
|
|
</div>
|
|
{{else}}
|
|
<p class="small text-body-secondary">No music folders configured.</p>
|
|
{{end}}
|
|
<div class="mt-3">
|
|
<button type="submit" class="btn btn-primary btn-sm">Save</button>
|
|
<a href="/admin/users" class="btn btn-sm btn-outline-secondary">Cancel</a>
|
|
</div>
|
|
</form>
|
|
</div>
|
|
</div>
|
|
{{template "footer" .}}{{end}}
|