airsonic-custom

Commit Graph

Author	SHA1	Message	Date
Peter Marheine	8b4037b549	Check reCAPTCHA v2 responses when enabled Signed-off-by: Peter Marheine <peter@taricorp.net>	6 years ago
Peter Marheine	1b833003fb	Bring back an optional reCAPTCHA v2 Only showing it in the recovery view, not yet validating the result. Signed-off-by: Peter Marheine <peter@taricorp.net>	6 years ago
Peter Marheine	a928b9ee3f	Add settings for CAPTCHA in account recovery. Allowing users to enable it and specify the site and secret key to use with reCAPTCHA. The old hard-coded keys were insecure; the secret key must not be distributed publicly. The current defaults are the test keys provided at https://developers.google.com/recaptcha/docs/faq#id-like-to-run-automated-tests-with-recaptcha-v2-what-should-i-do Signed-off-by: Peter Marheine <peter@taricorp.net>	6 years ago
Peter Marheine	749342f25e	Remove captcha support It uses reCAPTCHA v1, which hasn't worked since March 2018. Signed-off-by: Peter Marheine <peter@taricorp.net>	6 years ago
Andrew DeMaria	5281d9ab6e	Fix for false positive node vuln Signed-off-by: Andrew DeMaria <lostonamountain@gmail.com>	6 years ago
François-Xavier Thomas	caa1dac3a2	Use dark media player theme on groove theme (#777 )	6 years ago
Peter Marheine	ae7f35a9cd	Don't use HTTPS for scrobbling Turns out HTTPS isn't supported for the old API that we're using, so go back to using plain HTTP. Signed-off-by: Peter Marheine <peter@taricorp.net>	6 years ago
Peter Marheine	69e2ba0825	Use HTTPS and java.net.URI for scrobbling HTTPS will help prevent eavesdropping on the auth token, and using URI will ensure unusual characters (like spaces, accidental or otherwise) are escaped correctly. Fixes #588 Signed-off-by: Peter Marheine <peter@taricorp.net>	6 years ago
Peter Marheine	cfdedea452	Suppress CVE-2018-13684 for dependency-check False positive matching ant-zip against a CVE for ZIP, an Ethereum token. Signed-off-by: Peter Marheine <peter@taricorp.net>	6 years ago
Andrew DeMaria	e3ea7beb96	Fix #764 Signed-off-by: Andrew DeMaria <lostonamountain@gmail.com>	6 years ago
Andrew DeMaria	8d3c0ec9a0	Updates - Update Spring boot Version - Update dependency check version - Exclude irrelevant nodejs cve Signed-off-by: Andrew DeMaria <lostonamountain@gmail.com>	6 years ago
Andrew DeMaria	3e1ea6f913	Fix #749 Ensure transcode settings are protected Signed-off-by: Andrew DeMaria <lostonamountain@gmail.com>	7 years ago
Andrew DeMaria	431c98b496	Exclude cve CVE-2018-1115 Signed-off-by: Andrew DeMaria <lostonamountain@gmail.com>	7 years ago
snw35	6a44c5c815	Handle player id as an Integer instead of String	7 years ago
François-Xavier Thomas	b3f432a545	Issue #164 : Add tests for reading MusicBrainz release tags	7 years ago
François-Xavier Thomas	c76a92746d	Issue #164 : Show link to MusicBrainz release on album pages	7 years ago
jo	30ffc9560b	Fix wrong case	7 years ago
Andrew DeMaria	5cca85f516	Ignore irrelevant CVE Signed-off-by: Andrew DeMaria <lostonamountain@gmail.com>	7 years ago
Bonome	070df25f45	catch exceptions ClientAbortException display a short message and return, to avoid the massive useless traceback in log Signed-off-by: Bonome <bonome@tak.blue>	7 years ago
jo	b259f32bc4	Fix themes using dark background with me_js	7 years ago
jo	d1e190af0c	Remove margin of media_control bar	7 years ago
jo	159d5f67fa	Fix #596	7 years ago
jo	6204409c5e	New add_album to play queue	7 years ago
Romain DEP.	c2416a57a8	deps: update jackson to a vuln-free version, bump java-jwt in the process	7 years ago
Rémi Cocula	be91fb08c4	fix issues #638 and #574	7 years ago
Romain DEP.	d8eac74cb6	Reverted `a93a18a` and properly re-encoded with 'native2ascii -encoding UTF-8'	7 years ago
Andrew DeMaria	caae31452e	Bump to 10.2.0 snapshot Signed-off-by: Andrew DeMaria <lostonamountain@gmail.com>	7 years ago
Andrew DeMaria	dbd2a738eb	Made it easier to see current playing song for dark themes Signed-off-by: Andrew DeMaria <lostonamountain@gmail.com>	7 years ago
Andrew DeMaria	a93a18a055	Fixed elipse in english translation Signed-off-by: Andrew DeMaria <lostonamountain@gmail.com>	7 years ago
Andrew DeMaria	b0aff38caf	Fix #658 again: content type for unscaled images set based on jaudiotagger output Signed-off-by: Andrew DeMaria <lostonamountain@gmail.com>	7 years ago
Andrew DeMaria	11ec30cd9f	Revert "Fix #658 content type for full size cover arts" This reverts commit `18b16eb859`.	7 years ago
Andrew DeMaria	18b16eb859	Fix #658 content type for full size cover arts Signed-off-by: Andrew DeMaria <lostonamountain@gmail.com>	7 years ago
Andrew DeMaria	535d5d06cb	Release 10.1.1 Signed-off-by: Andrew DeMaria <lostonamountain@gmail.com>	7 years ago
Starkad	429fa1fb92	Fixed botched up css (Substandard) (#652 ) Signed-off-by:Manuel Müller <manuel.mueller@geekinbusiness.de>	7 years ago
Manuel Müller	524d8da190	suppressed vulnerabiltiy warning in build, for Postgres JDBC-Driver, since it's a vulnerability in Postgre itself Signed-off-by:Manuel Müller <manuel.mueller@geekinbusiness.de>	7 years ago
Allen Petersen	dcf41ce9e0	Issue 617 Restores optimization in AlbumUpnpProcessor and instead re-implements default behavior in RecentAlbumUpnpProcessor subclass.	7 years ago
Allan Nordhøy	766fec1bf8	escaped &s	7 years ago
Allen Petersen	b4ef434c08	Issue 617 Removes an incorrect override in AlbumUpnpProcessor which was preventing RecentAlbumUpnpProcessor from behaving correctly. Also adds a correct getAllItemsSize() implementation for RecentAlbumUpnpProcessor.	7 years ago
Allan Nordhøy	5a04a8b42b	Reverting apostrophes and double quotes	7 years ago
Andrew DeMaria	5e47bc500e	Fix maven profile mixup with sign/tomcat-embed Signed-off-by: Andrew DeMaria <lostonamountain@gmail.com>	7 years ago
Allan Nordhøy	3c95553dc5	Language rework	7 years ago
Robert Sprunk	756d178978	Upgrade jaudiotagger to 2.2.5 supporting Java 9 Signed-off-by: Robert Sprunk <github@sprunk.me>	7 years ago
Shen-Ta Hsieh	ab33bf2cee	Add show-all button on artist listing page	7 years ago
Andrew DeMaria	78006946ea	Bump 10.2.0-SNAPSHOT Signed-off-by: Andrew DeMaria <lostonamountain@gmail.com>	7 years ago
Andrew DeMaria	e04cda4293	Release 10.1.0 Signed-off-by: Andrew DeMaria <lostonamountain@gmail.com>	7 years ago
Andrew DeMaria	143cc5a40c	Added gpg sign profile Signed-off-by: Andrew DeMaria <lostonamountain@gmail.com>	7 years ago
Andrew DeMaria	c7789533a0	Don't require csrf for search endpoint Reasoning: - It doesn't change state and is not a sensitive endpoint - It really should be changed to GET but that is a bit more intrusive change that can be done at another time - The search csrf token is stored on the top.jsp page for a long time. If the user keeps this tab open for a while it is possible the csrf token will change on their session with other requests going on such that the search csrf token becomes wrong/stale. Signed-off-by: Andrew DeMaria <lostonamountain@gmail.com>	7 years ago
Andrew DeMaria	438461933d	Dep Check Plugin and update vuln dependencies Detail ------ Add a dependency check plugin to find reported issues with dependencies we use. From adding this, there were quite a few false positives which are documented in airsonic-main/cve-suppressed.xml. The applicable vulnerabilities are as follows: ``` commons-fileupload-1.2.jar (commons-fileupload:commons-fileupload:1.2, cpe:/a:apache:commons_fileupload:1.2) : CVE-2016-3092, CVE-2016-1000031, CVE-2014-0050, CVE-2013-0248 castor-core-1.3.1.jar (cpe:/a:castor:castor:1.3.1, cpe:/a:castor_project:castor:1.3.1, org.codehaus.castor:castor-core:1.3.1) : CVE-2014-3004 tomcat-embed-core-8.5.16.jar (cpe:/a:apache_software_foundation:tomcat:8.5.16, cpe:/a:apache:tomcat:8.5.16, cpe:/a:apache_tomcat:apache_tomcat:8.5.16, org.apache.tomcat.embed:tomcat-embed-core:8.5.16) : CVE-2017-12617 ``` CVE-2016-1000031 is rated as CRITICAL, but we do not deserialize content from any multipart uploads so doesn't apply. Signed-off-by: Andrew DeMaria <lostonamountain@gmail.com>	7 years ago
Jonas L	a2a6591d36	Add "opus" and "mka" extension to default This add 2 more extensions to the default scanned audio files. see #603 for more details	7 years ago
Andrew DeMaria	afa3a589df	Removed ref to old project Signed-off-by: Andrew DeMaria <lostonamountain@gmail.com>	7 years ago

1 2 3

141 Commits (8b4037b5492a65108739eda2f5eb6aaa33345e75)