MightyPork/airsonic-custom
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity
871 Commits 2 Branches 0 Tags
72609a8d0c33898f84a18d77e10dd29d47440b6c
Commit Graph
871 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Andrew DeMaria 72609a8d0c Merge remote-tracking branch 'airsonic/pr/950' 2019-04-01 22:34:30 -04:00
Andrew DeMaria c460a16628 Merge remote-tracking branch 'airsonic/pr/928' 2019-04-01 22:32:05 -04:00
jvoisin 87442320fc Try to run jkd9 on travis-ci 2019-04-01 23:17:02 +02:00
jvoisin ab1690b1fe Don't display the title if it's empty 2019-04-01 02:36:28 +02:00
Andrew DeMaria 83882b18d9 Merge remote-tracking branch 'airsonic/pr/919' 2019-03-31 20:01:31 -04:00
Andrew DeMaria 81835aa589 Merge remote-tracking branch 'airsonic/pr/934' 2019-03-31 19:56:56 -04:00
Andrew DeMaria f8f5c4a6bf Merge remote-tracking branch 'airsonic/pr/936' 2019-03-31 19:53:49 -04:00
Andrew DeMaria b73ab9c45e Merge remote-tracking branch 'airsonic/pr/949' 2019-03-31 19:53:17 -04:00
Andrew DeMaria 78ee5bd1da Merge remote-tracking branch 'airsonic/pr/948' 2019-03-31 19:46:17 -04:00
Andrew DeMaria 221a0ed933 Merge remote-tracking branch 'airsonic/pr/945' 2019-03-31 19:45:56 -04:00
jvoisin ac1c887698 Remove Google+ relics 
Google+ is dead: https://developers.google.com/+/
 2019-04-01 01:41:41 +02:00
jvoisin cb0866d5fd Download dependencies via https on download.java.net 2019-04-01 01:34:01 +02:00
Andrew DeMaria edd097ad5b Add a couple of static analysis badges 2019-03-31 19:33:32 -04:00
jvoisin 5edebf7885 Remove inline javascript on the cancel buttons 
The inline javascript used with the cancel buttons
was only used to change the location.
Instead of doing this, it's easier to wrap
the button in a tag.

This is related to #909.
 2019-04-01 01:32:35 +02:00
Andrew DeMaria cd45717256 Merge remote-tracking branch 'airsonic/pr/938' 2019-03-31 19:31:18 -04:00
Andrew DeMaria 570abe69d5 Merge remote-tracking branch 'airsonic/pr/939' 2019-03-31 19:29:39 -04:00
Andrew DeMaria d5500ce3d2 Merge remote-tracking branch 'airsonic/pr/941' 2019-03-31 19:24:26 -04:00
Andrew DeMaria 41a5ae06d5 Merge remote-tracking branch 'airsonic/pr/922' 2019-03-31 19:20:33 -04:00
Andrew DeMaria 6613bd86d5 Merge remote-tracking branch 'airsonic/pr/907' 2019-03-31 19:19:44 -04:00
Andrew DeMaria c9a209fd8f Merge remote-tracking branch 'airsonic/pr/943' 2019-03-31 19:16:41 -04:00
Andrew DeMaria 2b0fe25eff Merge remote-tracking branch 'airsonic/pr/946' 2019-03-31 19:16:28 -04:00
jvoisin ba6b39b7b2 Add two <meta> tags 
- Add a description, since this can be useful
  in browser's histories
- Add a viewport, making it less worse to use
  airsonic on a super-small screen
 2019-03-31 23:55:24 +02:00
jvoisin 4d5680931c Add the dates of the releases to the changelog 2019-03-31 20:45:15 +02:00
jvoisin 883022d81a Remove script.aculo.us dependency 
It's not used anywhere, using an old version,
and the project doesn't seem to be maintained anyway.
 2019-03-30 11:09:42 +01:00
jvoisin 910802b64f Fix a small resource leak 2019-03-29 00:18:25 +01:00
jvoisin 2f9046d6b4 Fix a xss and clean up some js 
- Fix a stupid self-XSS. I doubt that there are ways to
  use it against other users, but well, better safe than sorry
- Replace the javascript-on-focus hacks with the `autofocus` attribute
 2019-03-28 23:38:37 +01:00
François-Xavier Thomas bcc5f8d7a6 Fix StringIndexOutOfBounds errors thrown by DWR/YUI 2019-03-28 22:08:26 +01:00
jvoisin 61c842923a Generate new passwords in a secure way 
Previously, lost passwords were generated via
org.apache.commons.lang.RandomStringUtils,
which is using java.util.Random internally.

This PRNG is has a 48-bit seed, that can easily be bruteforced
if an attacker is able to get the PRNG's output, for example
but resetting their own account multiple times,
leading to trivial privileges escalation attacks.

This commit makes use of java.security.SecureRandom
instead.
 2019-03-28 21:47:57 +01:00
Andrew DeMaria e330eeb864 Remove coverity integration - not working 2019-03-27 20:50:03 -06:00
Andrew DeMaria 4e73266a7f Add travis ci badge 2019-03-27 19:58:55 -06:00
Andrew DeMaria 897de26886 Remove comment 2019-03-27 19:56:13 -06:00
Andrew DeMaria bc0bfdf481 Update scan token 
Signed-off-by: Andrew DeMaria <lostonamountain@gmail.com>
 2019-03-27 19:14:32 -06:00
Andrew DeMaria fb0079d3c0 Merge remote-tracking branch 'origin/pr/932' 2019-03-27 19:02:25 -06:00
Andrew DeMaria 54e1237320 Exclude new spring 5.0.5 cve 2019-03-27 19:00:14 -06:00
Andrew DeMariaandGitHub 5dc96ba011 Add coverity badge 2019-03-27 18:50:37 -06:00
jvoisin 6f3c3312ee Add coverity scan to travis 2019-03-27 23:43:59 +01:00
Andrew DeMaria 8a1f36c792 Revert change to DWR fixes #923 
Signed-off-by: Andrew DeMaria <lostonamountain@gmail.com>
 2019-03-26 16:08:54 -06:00
jvoisin 39b9eab715 Simplify a bit the css 2019-03-26 23:08:50 +01:00
jvoisin 0b72acefed Oups 2019-03-26 23:04:32 +01:00
jvoisin fa5ffdc07a Remove the external fonts usage 
This is a radical (and simple) solution
to #853, #399, #439, #174 and partially #712.
 2019-03-26 21:30:45 +01:00
jvoisinandAndrew DeMaria ab92f83c1f Add a bunch of hardening to the systemd unit 
I tested this locally, it's working on my machine™
Nothing fancy, no new privileges, private stuff (/tmp, …),
no exotic devices/access/…, …

Signed-off-by: jvoisin <julien.voisin@dustri.org>
Signed-off-by: Andrew DeMaria <lostonamountain@gmail.com>
 2019-03-26 14:27:52 -06:00
Andrew DeMaria e76d44d957 Merge remote-tracking branch 'origin/pr/908' 2019-03-26 13:59:48 -06:00
Andrew DeMaria 9413f1f489 Merge remote-tracking branch 'origin/pr/912' 2019-03-26 13:00:39 -06:00
Andrew DeMaria 8f1d790784 Merge remote-tracking branch 'origin/pr/913' 2019-03-26 13:00:08 -06:00
Andrew DeMaria 00ee8a9662 Merge remote-tracking branch 'origin/pr/915' 2019-03-26 12:59:48 -06:00
Andrew DeMaria a3041a59c7 Merge remote-tracking branch 'origin/pr/916' 2019-03-26 12:59:22 -06:00
jvoisinandAndrew DeMaria 615e317b01 Bump liquibase version 
Signed-off-by: jvoisin <julien.voisin@dustri.org>
 2019-03-26 12:52:16 -06:00
jvoisinandAndrew DeMaria 919051db9e Simplify the travis file 
- Remove `sudo` since it's deprecated,
  along with the useless `apt update` call
- Remove the manual maven installation since
  it's already present on the travis image
  by default

This should reduce a bit the time taken for a whole CI run.
 2019-03-26 12:49:01 -06:00
jvoisin 30fa4d0467 Second pass of trivial modernizations 
- Replace unnecessary getters/setters with inline assignments
- Simplify string constructions
- Improve containers construction
 2019-03-26 00:00:21 +01:00
jvoisin ca489f8220 This is a first batch of simple modernization of the codebase 
I threw airsonic at IntelliJ's IDEA analysis,
and asked it to flag what could be modernized
for Java > 5.

- foreach instead of for…
- I added some null-deref checks
- Integer.ValueOf, since Integer(…) is deprecated
- Contextual try
- Objects.equals instead of handcrafted comparisons
- StringBuilder instead of StringBuffer
- Removal of outdated/wrong javadoc comments
 2019-03-25 23:33:03 +01:00