MightyPork/airsonic-custom
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity
838 Commits 2 Branches 0 Tags
61c842923a6d60d4aedd126445a8437b53b752c8
Commit Graph
220 Commits
Author SHA1 Message Date
jvoisin 61c842923a Generate new passwords in a secure way 
Previously, lost passwords were generated via
org.apache.commons.lang.RandomStringUtils,
which is using java.util.Random internally.

This PRNG is has a 48-bit seed, that can easily be bruteforced
if an attacker is able to get the PRNG's output, for example
but resetting their own account multiple times,
leading to trivial privileges escalation attacks.

This commit makes use of java.security.SecureRandom
instead.
 2019-03-28 21:47:57 +01:00
Andrew DeMaria 54e1237320 Exclude new spring 5.0.5 cve 2019-03-27 19:00:14 -06:00
Andrew DeMaria 8a1f36c792 Revert change to DWR fixes #923 
Signed-off-by: Andrew DeMaria <lostonamountain@gmail.com>
 2019-03-26 16:08:54 -06:00
Andrew DeMaria e76d44d957 Merge remote-tracking branch 'origin/pr/908' 2019-03-26 13:59:48 -06:00
Andrew DeMaria 9413f1f489 Merge remote-tracking branch 'origin/pr/912' 2019-03-26 13:00:39 -06:00
Andrew DeMaria 00ee8a9662 Merge remote-tracking branch 'origin/pr/915' 2019-03-26 12:59:48 -06:00
jvoisin 45ef973627 Fix a javascript null-deref 
This commit should fix the following javascript crash that
may occur if the localstorage isn't available/supported by the browser:

```
more.view:140 Uncaught TypeError: Cannot read property 'playCountValue' of null
    at loadShuffleForm (more.view:140)
    at HTMLDocument.<anonymous> (more.view:181)
    at n (jquery-1.7.1.min.js:2)
    at Object.fireWith (jquery-1.7.1.min.js:2)
    at Function.ready (jquery-1.7.1.min.js:2)
    at HTMLDocument.B (jquery-1.7.1.min.js:2)
```

Signed-off-by: jvoisin <julien.voisin@dustri.org>
 2019-03-22 06:10:20 +01:00
jvoisin 0a47c6e461 Bump java-jwt 
Signed-off-by: jvoisin <julien.voisin@dustri.org>
 2019-03-21 22:26:06 +01:00
jvoisin 4e2b435abf Bump cglib version 
Signed-off-by: jvoisin <julien.voisin@dustri.org>
 2019-03-21 22:20:37 +01:00
jvoisin 4de26ac319 Remove pngfix 
pngfix.js is used for compatibility's reason
with IE 5 and 6. I think that now that we're in 2019,
we can get rid of it.

Signed-off-by: jvoisin <julien.voisin@dustri.org>
 2019-03-20 21:59:52 +01:00
Andrew DeMaria 143a220719 Merge remote-tracking branch 'airsonic/pr/849' 
Conflicts:
	airsonic-main/cve-suppressed.xml
	airsonic-main/src/main/java/org/airsonic/player/controller/JAXBWriter.java
	airsonic-main/src/main/java/org/airsonic/player/service/PodcastService.java
	pom.xml
 2019-03-16 19:27:53 -04:00
Andrew DeMaria 0d78c30d06 Change a couple more log entries to debug 2019-03-16 12:56:57 -04:00
François-Xavier Thomas 2c1b5205e8 Write new db maintenance logs as 'debug' instead of 'info' 2019-03-16 17:32:00 +01:00
François-Xavier Thomas 7510b04efc Make checkpoint() method void (return value is not used) 2019-03-16 17:29:00 +01:00
François-Xavier Thomas 8c46d39569 Do not log message about hsqldb-defrag migration on each launch 
The FILES DEFRAG / FILES LOG SIZE properties are kept when upgrading to
2.x; it's enough that they were set once on 1.8. For new installations
the migration will still run with the correct SQL statements.
 2019-03-10 20:53:56 +01:00
François-Xavier Thomas b753e48632 Log more information when running the 'cleanup db' action 2019-03-09 13:33:59 +01:00
François-Xavier Thomas 76e8abd219 Move HSQLDB checkpoint/shutdown to a bean specific to the legacy profile 2019-03-09 13:33:59 +01:00
François-Xavier Thomas b88bdb37c9 Properly shutdown embedded HSQLDB database on exit 2019-03-08 23:48:32 +01:00
François-Xavier Thomas 54e444b03c Make CHECKPOINT / DEFRAG syntax work for both HSQLDB 1 & 2 2019-03-08 22:40:05 +01:00
Iwao AVE!andFrançois-Xavier Thomas c79c02d449 Updated CHECKPOINT / DEFRAG syntax for HSQLDB 2. 
Signed-off-by: Iwao AVE! <harawata@gmail.com>
 2019-03-08 22:40:05 +01:00
François-Xavier Thomas c0f3606091 Force database checkpoints on 'Clean-up' and 'Scan' actions 
This will only affect the (embedded/legacy) HSQLDB driver. Even though
cff97ea9 should prevent the db log from getting uncontrollably large,
the 'Clean-up database' and 'Scan' actions will additionally force a
checkpoint to ensure this happens on big operations.
 2019-03-08 22:40:05 +01:00
Andrew DeMaria 1a88f46c18 CVE-2018-20222 Prevent xxe during parse 
Signed-off-by: Andrew DeMaria <lostonamountain@gmail.com>
 2019-02-18 22:46:05 -05:00
Andrew DeMaria faedfd8a62 Bump version to 10.3.0-SNAPSHOT 
Signed-off-by: Andrew DeMaria <lostonamountain@gmail.com>
 2019-02-18 21:58:15 -05:00
Andrew DeMaria a16b89e0ac Bump to version 10.2.0-RELEASE 
Signed-off-by: Andrew DeMaria <lostonamountain@gmail.com>
 2019-02-16 11:38:17 -07:00
Andrew DeMaria e4bb808862 Merge remote-tracking branch 'origin/pr/869' 2019-02-16 10:46:18 -07:00
tesshuandAndrew DeMaria 3e6d224550 #1 CVE-2018-1000840 
stax-api-1.0.1.jar
stax-api-1.0-2.jar
 2019-02-16 10:38:47 -07:00
tesshuandAndrew DeMaria 6023d4c0bc fix #748 2019-02-16 10:38:47 -07:00
jo 7327353704 Pull translations from transifex 2019-01-25 04:40:03 +01:00
Andrew DeMaria adc224147a Merge remote-tracking branch 'airsonic/pr/855' 2019-01-09 21:02:23 -05:00
Andrew DeMaria 5e14996dc3 Merge remote-tracking branch 'airsonic/pr/859' 2019-01-09 20:59:14 -05:00
Frank de LangeandAndrew DeMaria 8127b4f7fa Fix #860 (external database performance) by using connection pooling … (#864) 
* Fix #860 (external database performance) by using connection pooling (using commons-dbcp2)
 2019-01-09 19:53:52 -06:00
François-Xavier Thomas d6ba6de7e1 Run a first defrag before enabling auto defrag on HSQLDB 2019-01-09 22:27:40 +01:00
François-Xavier Thomas 21eff917b6 PlayQueue: Fix broken keyboard shortcuts 
Using the "space" key to resume playback, as well as +/- to
increase/decrease volume, were not working properly.
 2019-01-09 21:28:40 +01:00
Andrew DeMaria ac0e29bf9c Remove unused import 2019-01-08 21:57:23 -05:00
Andrew DeMaria 61c0c0d758 Fix import style error 2019-01-08 21:56:26 -05:00
Andrew DeMaria 06a8e2dc02 Merge remote-tracking branch 'airsonic/pr/833' 2019-01-08 21:46:11 -05:00
Andrew DeMaria ee4cb71052 Ignore CVE-2018-8088 related to slf4j ext 2019-01-08 21:41:13 -05:00
François-Xavier Thomas cff97ea9be Fix #778: Defragment embedded HSQLDB database more frequently 2019-01-03 20:47:15 +01:00
Rémi Cocula ac453883fc jukebox code quality and unit tests 2018-12-22 13:59:44 +01:00
randomnicode 94f4a85bb7 Suppress CVE-2018-8088 2018-12-15 09:11:52 -08:00
randomnicode f2339e0942 Change zip to java.util 2018-12-15 08:27:54 -08:00
randomnicode 9d33ec255b Declare used and remove unused dependencies 2018-12-15 08:18:54 -08:00
randomnicode 86e58cea3a Update dependencies in airsonic-main 2018-12-14 23:27:51 -08:00
randomnicodeandAndrew DeMaria 77ca475fbe Add additional suppression 2018-12-10 21:03:52 -07:00
randomnicodeandAndrew DeMaria f3cc48f8cb Suppress vulnerabilities file 2018-12-10 21:03:52 -07:00
randomnicodeandAndrew DeMaria 51f17675d5 Update plugins 2018-12-10 21:03:52 -07:00
Andrew DeMaria fb18862db4 Fix extraneous closing tag 2018-12-09 23:59:31 -05:00
Andrew DeMaria cddacb61c2 Merge remote-tracking branch 'airsonic/pr/834' 2018-12-09 23:48:49 -05:00
Andrew DeMaria 4d56df06ba Merge remote-tracking branch 'airsonic/pr/844' 2018-12-09 23:40:31 -05:00
Benz0X af93f1eed1 Correct corrupted downloaded zip 
Prevent the zipping of twice the same file (resulting in an error and a corrupted zip on Linux) when the cover is embedded in tags
 2018-12-08 15:10:12 +01:00