This was done via `find airsonic-main/src/main/resources/ -name
'ResourceBundle_*.properties' -print0 | xargs -0 sed -i
's/\(helppopup\..*\.text\)\s*=\s*<p>\(.*\)<\/p>/\1=\2/'`, courtesy of fxthomas.
Since we're already using jquery-ui for other stuff, it makes sense to use it
for tooltips too, instead of using an old-school-written-in-2009 1300 lines
steaming pile of javascript named wz_tooltip.js
FancyZoom isn't a free-as-in-freedom software,
and is mostly a big pile of old-school javascript.
This commit replace it with a small jquery-powered
script under MIT license.
When transcoding, always use chunked transfers and report that ranges
are not supported. When not transcoding, support returning ranges but
only if requested.
This adds the 'airsonic.rememberMeKey' system property (can be set from
command-line with `-Dairsonic.rememberMeKey=<value>`) as well as a
'RememberMeKey' setting in airsonic.properties, so that the key used for
generating 'remember me' tokens can be persisted across server restarts.
It also adds a default, insecure key in case we are running in
development mode with the 'airsonic.development' property set.
I bumped it first to 2.X with jQuery migrate, played around but didn't manage
to trigger any warning. So I bumped it again to the latest available version,
jQuery 3.4.0, which isn't triggering useful warnings either.
This page wasn't linked anywhere, and was
allowing an administrator to issue arbitrary sql
comments, and was vulnerable to reflected XSS.
We should get rid of it. If you really want to issue
SQL commands, just ssh to your instance and do it from here.
In case of exceptions, Airsonic logs the full URL that triggered it
since 417583cc, including possibly sensitive query parameters such as
the authentication password/tokens passed to the Subsonic API.
This replaces the value set for this parameter in the URL by the
"<hidden>" string.
Because Double Brace Initialization (DBI) creates an anonymous class with a
reference to the instance of the owning object, its use can lead to memory
leaks if the anonymous inner class is returned and held by other objects. Even
when there's no leak, DBI is so obscure that it's bound to confuse most
maintainers.
jvoisin
jvoisin
Schuyler Eldridge
jo
tesshucom
Peter Marheine
Andrew DeMaria
François-Xavier Thomas