MightyPork/airsonic-custom
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity
1,185 Commits 2 Branches 0 Tags
a85642c797cc53ef526f02088551964dc1e3aa87
Commit Graph
1185 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
jvoisin 268dc6e13d Factorise the key generation into a static method 2019-04-02 10:13:29 +02:00
Andrew DeMaria f04ec61d0f Merge remote-tracking branch 'airsonic/pr/958' 2019-04-01 22:43:42 -04:00
Andrew DeMaria 58f4dfdb2e Merge remote-tracking branch 'airsonic/pr/957' 2019-04-01 22:42:39 -04:00
Andrew DeMaria a59e8e4a9f Merge remote-tracking branch 'airsonic/pr/956' 2019-04-01 22:42:16 -04:00
Andrew DeMaria afb9c6bfb7 Merge remote-tracking branch 'airsonic/pr/954' 2019-04-01 22:41:36 -04:00
Andrew DeMaria 1daa6cff6e Merge remote-tracking branch 'airsonic/pr/952' 2019-04-01 22:39:38 -04:00
Andrew DeMaria 72609a8d0c Merge remote-tracking branch 'airsonic/pr/950' 2019-04-01 22:34:30 -04:00
Andrew DeMaria c460a16628 Merge remote-tracking branch 'airsonic/pr/928' 2019-04-01 22:32:05 -04:00
jvoisin aff7bd3d57 Remove webfx stuff, since they're apparently not used 
The only place where the string `webfx` is mentioned
was in playQueue.jsp, to include a small css file, twice,
that only applies to webfx components, that aren't used
anywhere in the codebase.
 2019-04-02 00:42:24 +02:00
jvoisin db2592a84b Delete AC_OETags.js since it's not used anywhere 2019-04-02 00:37:17 +02:00
jvoisin c9212805be Remove jquery-contextmenu since it's not used anywhere 2019-04-02 00:28:16 +02:00
jvoisin 87442320fc Try to run jkd9 on travis-ci 2019-04-01 23:17:02 +02:00
jvoisin d35834c0e7 Fix a bunch of dom-based xss 
This should close #633
 2019-04-01 23:08:57 +02:00
jvoisin 0d6cbb60ed Use https for external links 2019-04-01 11:45:20 +02:00
jvoisin 3e07ea5288 Use a random key to "encrypt" the remember-me cookie's value 
Since Spring's default remember-me technique is
terrible security-wise (`user:timstamp:md5(use:timestamp:password:key)`),
we should at least use a random key, instead of a fixed one,
otherwise, and attacker able to capture the cookies
might be able to trivially bruteforce offline
the password of the associated user.
 2019-04-01 11:33:35 +02:00
jvoisin ab1690b1fe Don't display the title if it's empty 2019-04-01 02:36:28 +02:00
Andrew DeMaria 83882b18d9 Merge remote-tracking branch 'airsonic/pr/919' 2019-03-31 20:01:31 -04:00
Andrew DeMaria 81835aa589 Merge remote-tracking branch 'airsonic/pr/934' 2019-03-31 19:56:56 -04:00
Andrew DeMaria f8f5c4a6bf Merge remote-tracking branch 'airsonic/pr/936' 2019-03-31 19:53:49 -04:00
Andrew DeMaria b73ab9c45e Merge remote-tracking branch 'airsonic/pr/949' 2019-03-31 19:53:17 -04:00
Andrew DeMaria 78ee5bd1da Merge remote-tracking branch 'airsonic/pr/948' 2019-03-31 19:46:17 -04:00
Andrew DeMaria 221a0ed933 Merge remote-tracking branch 'airsonic/pr/945' 2019-03-31 19:45:56 -04:00
jvoisin ac1c887698 Remove Google+ relics 
Google+ is dead: https://developers.google.com/+/
 2019-04-01 01:41:41 +02:00
jvoisin cb0866d5fd Download dependencies via https on download.java.net 2019-04-01 01:34:01 +02:00
Andrew DeMaria edd097ad5b Add a couple of static analysis badges 2019-03-31 19:33:32 -04:00
jvoisin 5edebf7885 Remove inline javascript on the cancel buttons 
The inline javascript used with the cancel buttons
was only used to change the location.
Instead of doing this, it's easier to wrap
the button in a tag.

This is related to #909.
 2019-04-01 01:32:35 +02:00
Andrew DeMaria cd45717256 Merge remote-tracking branch 'airsonic/pr/938' 2019-03-31 19:31:18 -04:00
Andrew DeMaria 570abe69d5 Merge remote-tracking branch 'airsonic/pr/939' 2019-03-31 19:29:39 -04:00
Andrew DeMaria d5500ce3d2 Merge remote-tracking branch 'airsonic/pr/941' 2019-03-31 19:24:26 -04:00
Andrew DeMaria 41a5ae06d5 Merge remote-tracking branch 'airsonic/pr/922' 2019-03-31 19:20:33 -04:00
Andrew DeMaria 6613bd86d5 Merge remote-tracking branch 'airsonic/pr/907' 2019-03-31 19:19:44 -04:00
Andrew DeMaria c9a209fd8f Merge remote-tracking branch 'airsonic/pr/943' 2019-03-31 19:16:41 -04:00
Andrew DeMaria 2b0fe25eff Merge remote-tracking branch 'airsonic/pr/946' 2019-03-31 19:16:28 -04:00
jvoisin ba6b39b7b2 Add two <meta> tags 
- Add a description, since this can be useful
  in browser's histories
- Add a viewport, making it less worse to use
  airsonic on a super-small screen
 2019-03-31 23:55:24 +02:00
jvoisin 4d5680931c Add the dates of the releases to the changelog 2019-03-31 20:45:15 +02:00
jvoisin 883022d81a Remove script.aculo.us dependency 
It's not used anywhere, using an old version,
and the project doesn't seem to be maintained anyway.
 2019-03-30 11:09:42 +01:00
jvoisin 910802b64f Fix a small resource leak 2019-03-29 00:18:25 +01:00
jvoisin a6c92acb3e Update mediaelement from 4.1.1 to 4.2.9 
I've tested this on mp3, ogg and flac, everything
is working.

Apart from fixing a decent amount of bugs
(https://github.com/mediaelement/mediaelement/releases),
this has the nice side effect of removing a copy
of jquery 1.9.1.
 2019-03-29 00:00:47 +01:00
jvoisin 2f9046d6b4 Fix a xss and clean up some js 
- Fix a stupid self-XSS. I doubt that there are ways to
  use it against other users, but well, better safe than sorry
- Replace the javascript-on-focus hacks with the `autofocus` attribute
 2019-03-28 23:38:37 +01:00
François-Xavier Thomas bcc5f8d7a6 Fix StringIndexOutOfBounds errors thrown by DWR/YUI 2019-03-28 22:08:26 +01:00
jvoisin 61c842923a Generate new passwords in a secure way 
Previously, lost passwords were generated via
org.apache.commons.lang.RandomStringUtils,
which is using java.util.Random internally.

This PRNG is has a 48-bit seed, that can easily be bruteforced
if an attacker is able to get the PRNG's output, for example
but resetting their own account multiple times,
leading to trivial privileges escalation attacks.

This commit makes use of java.security.SecureRandom
instead.
 2019-03-28 21:47:57 +01:00
Andrew DeMaria e330eeb864 Remove coverity integration - not working 2019-03-27 20:50:03 -06:00
Andrew DeMaria 4e73266a7f Add travis ci badge 2019-03-27 19:58:55 -06:00
Andrew DeMaria 897de26886 Remove comment 2019-03-27 19:56:13 -06:00
Andrew DeMaria bc0bfdf481 Update scan token 
Signed-off-by: Andrew DeMaria <lostonamountain@gmail.com>
 2019-03-27 19:14:32 -06:00
Andrew DeMaria fb0079d3c0 Merge remote-tracking branch 'origin/pr/932' 2019-03-27 19:02:25 -06:00
Andrew DeMaria 54e1237320 Exclude new spring 5.0.5 cve 2019-03-27 19:00:14 -06:00
Andrew DeMariaandGitHub 5dc96ba011 Add coverity badge 2019-03-27 18:50:37 -06:00
jvoisin 6f3c3312ee Add coverity scan to travis 2019-03-27 23:43:59 +01:00
Andrew DeMaria 8a1f36c792 Revert change to DWR fixes #923 
Signed-off-by: Andrew DeMaria <lostonamountain@gmail.com>
 2019-03-26 16:08:54 -06:00