MightyPork/airsonic-custom
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity
1,151 Commits 2 Branches 0 Tags
b650ac70d629258e4e6dd1b46e27c88d8b421b74
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
jvoisin b650ac70d6 Temporarily skip a test 
Based on tesshucom's #1192
 2019-08-07 01:52:17 +02:00
jvoisin 4a85cdbc7a Sort the checkstyle modules 2019-08-01 10:46:26 +02:00
jvoisin 0d6ed81b83 Add a check for InnerAssignment in checkstyle.xml 2019-08-01 10:36:51 +02:00
jvoisin ba9d3ff539 Remove an empty statement 2019-08-01 10:30:26 +02:00
jvoisin 61c8fbc5e2 Add more style checks 2019-08-01 10:21:54 +02:00
jvoisin 10b41160c0 Enabled StringLiteralEquality in CheckStyle 2019-07-31 00:26:58 +02:00
jvoisin 167d1d9c20 Enable EqualsHashCode in CheckStyle 2019-07-31 00:23:18 +02:00
jvoisin d256386cbb Use titles in some <img> tags 2019-07-22 22:49:11 +02:00
jvoisinandAndrew DeMaria eccb7e08f5 Fix a NULL-deref in CoverArtController.java 
ImageIO.read() can return null in certain cases
 2019-07-14 11:54:30 -06:00
jvoisinandAndrew DeMaria e9ea61036f First pass of CSP-compliance for mousetrap 
Since the preference for the keyboard shortcuts
is set server-side, I had to shove them into a non-javascript
context, and then access them via javascript,
in a separate file.

Since I'm not a javascript expert, I'm more than open
to alternatives if this isn't the right way™ to do it.
 2019-07-14 11:46:28 -06:00
jvoisin 967c32b92f Fix cucumber. 2019-07-03 22:20:56 +02:00
jvoisin c4b78828d7 Fix cucumber? 2019-07-03 22:20:21 +02:00
jvoisin 5961674944 Add openjdk12 to travis-ci 2019-07-03 00:15:29 +02:00
jvoisin 36985e151b Bump dependency checker 2019-07-03 00:06:53 +02:00
jvoisin 2d06995416 Remove the last mention of Flash in the translation files 2019-06-17 21:50:47 +02:00
jvoisin a27ad99f8d Remove an other Flash-related localization 2019-06-17 21:30:13 +02:00
jvoisin 67eae2893f Remove a localisation about getting flash player 2019-06-17 21:29:37 +02:00
jvoisin 9bd2c1e83f Fix various minor javascript-related warnings 2019-06-15 17:27:03 +02:00
jvoisin 1640411573 Fix some invalid/incomplete javadoc comments 2019-06-15 17:15:51 +02:00
jvoisin 8f4e351718 Add an alt attribute to images, to increase accessibility 2019-06-15 17:06:25 +02:00
jvoisin fc43364908 Fix a useless double-assignation 2019-06-12 00:21:06 +02:00
jvoisin b8d64c1dbd Bump the version of maven-checkstyle-plugin 2019-06-12 00:15:38 +02:00
jvoisin 4fbc080098 Please the linter 2019-06-12 00:11:39 +02:00
jvoisin 70bc0f6c04 Remove the ghetto REST flash-based video player 2019-06-12 00:09:02 +02:00
jvoisin 643be3930f Remove superfluous casts 2019-06-08 16:24:00 +02:00
jvoisin 3202a1086d Minor simplification 
`.sorted(Comparator.reverseOrder()).findFirst()`
can be replaced with `max(Comparator.naturalOrder()`
 2019-06-08 15:50:15 +02:00
jvoisin def5f854fb Inline some variables 
There is no point in `Type a = …; return a;`
 2019-06-08 15:47:15 +02:00
jvoisin 57df709cd8 Replace things like size == 0 with isEmpty 2019-06-08 15:40:51 +02:00
jvoisin e0ac46cf44 Fix 3 minor errors in jsp files 
- Add a missing `$` in dlnaSettings
- Add a missing taglib import in homePage.jsp
- Add a missing `=` in playQueue.jsp's css
 2019-06-08 15:29:46 +02:00
jvoisin 977b656bc6 Remove superfluous escape in two regexp 2019-06-08 15:21:59 +02:00
jvoisin 40f7c73390 Fix the video player that was broken in cf1f86f 2019-06-08 00:54:55 +02:00
jvoisin 3492fc0c05 Fix a crash when transcoding a track without album 2019-06-06 02:19:08 +02:00
jvoisin b1eb0536b8 Fix a crash when transcoding a track without artist 2019-06-06 02:17:10 +02:00
jvoisin e283ac46a8 Fix downloads with embedded covers 
Previously, this would always fail with
embedded covers.
 2019-06-06 02:14:10 +02:00
jvoisin b697dc5bfc An other batch of LGTM-found issues 2019-06-05 23:40:10 +02:00
jvoisin 40a5150b6e Don't use ProtectHome by default in the systemd unit 
Some people might put media in /home/…/
 2019-06-02 16:05:47 +02:00
jvoisin fe73034f10 Strip the <p>…</p> markup in translation 
This was done via `find airsonic-main/src/main/resources/ -name
'ResourceBundle_*.properties' -print0 | xargs -0 sed -i
's/\(helppopup\..*\.text\)\s*=\s*<p>\(.*\)<\/p>/\1=\2/'`, courtesy of fxthomas.
 2019-05-30 00:49:54 +02:00
jvoisin 01dd070efa Fix indentation 2019-05-30 00:49:35 +02:00
jvoisin 195a0879c3 Replace wz_tooltip.js with jquery-ui 
Since we're already using jquery-ui for other stuff, it makes sense to use it
for tooltips too, instead of using an old-school-written-in-2009 1300 lines
  steaming pile of javascript named wz_tooltip.js
 2019-05-29 23:39:25 +02:00
jvoisin f4fa75f808 Fix compat with the latest jquery 
Stolen^w borrowed from https://github.com/keegnotrub/jquery.fancyzoom/issues/3#issue-388966769
 2019-05-28 01:13:02 +02:00
jvoisin c5eb7aa37c Fix a typo 2019-05-28 01:08:27 +02:00
jvoisin 9a43b4f360 Group the .attr calls 2019-05-28 00:57:26 +02:00
jvoisin 7824c3099f Mention de license 2019-05-28 00:56:46 +02:00
jvoisin 15a1e5e7d6 Replace FancyZoom with jquery.fancyzoom 
FancyZoom isn't a free-as-in-freedom software,
and is mostly a big pile of old-school javascript.
This commit replace it with a small jquery-powered
script under MIT license.
 2019-05-28 00:56:46 +02:00
jvoisin 1090348b0e Use the version number in jquery-ui's css path 2019-05-20 22:57:21 +02:00
jvoisin 58daacd9ab Jetty is only used by developers, and never in production 
So we're free to completely ignore CVE against it.
 2019-05-16 00:37:37 +02:00
jvoisin 3ee6fefe11 Bump jQuery/jquery-ui to the latest versions 
I bumped it first to 2.X with jQuery migrate, played around but didn't manage
to trigger any warning.  So I bumped it again to the latest available version,
jQuery 3.4.0, which isn't triggering useful warnings either.
 2019-04-28 16:26:36 +02:00
jvoisin 925ecdaa03 Add a gitlab-ci file 2019-04-27 21:18:30 +02:00
jvoisin 3d54ef1afb Mark the player cookie httpOnly 
It doesn't improve much security-wise,
but it's a good practise anyway.
 2019-04-27 20:37:41 +02:00
jvoisin 8f608485cb Fix a typo 2019-04-27 20:37:35 +02:00
jvoisin 8123716d52 Remove unused loggers 2019-04-27 20:37:35 +02:00
jvoisin 4a06823057 Balance some synchronized 
Balance synchronized used on getters and not setters
as well as the other way around.
 2019-04-27 20:36:08 +02:00
jvoisin d2f40b710b Fix a possible stacktrace on RandomPlayQueue 2019-04-27 20:35:41 +02:00
jvoisin 41408bc2c3 Replace the double-mustache anti-pattern 
Because Double Brace Initialization (DBI) creates an anonymous class with a
reference to the instance of the owning object, its use can lead to memory
leaks if the anonymous inner class is returned and held by other objects. Even
when there's no leak, DBI is so obscure that it's bound to confuse most
maintainers.
 2019-04-25 22:32:45 +02:00
jvoisin c6825cf0d7 Minor refactorization of two methods in AbstractDao 2019-04-24 22:40:38 +02:00
jvoisin a21188a064 Add a permission check for the podcast folder 
This should make podcast-related stacktraces a bit
more obvious to debug for users.
 2019-04-17 23:08:26 +02:00
jvoisin 716fd3635c Remove a useless test page 2019-04-17 22:26:45 +02:00
jvoisin e2683024af Factorize a bit the checkbox-related CSS 
Since the `border: 0;` property is applied
to every checkbox, there is no need for a class.
This is also a good opportunity to use ternaries
for the `checked` attribute, instead of clumsy `if`.
 2019-04-17 22:20:11 +02:00
jvoisin cf1f86f226 Move some video-cast-related inline js to an external file 2019-04-17 21:58:49 +02:00
jvoisin af4165310f Fix yet an other XSS 2019-04-12 22:39:45 +02:00
jvoisin e69287cfe6 Minor frameset-related factorization 2019-04-11 23:15:09 +02:00
jvoisin 17f1d45e08 Remove mentions of subsonic premium 2019-04-10 22:49:08 +02:00
jvoisin 90cb02105e Add a noopener and noreferrer to external urls 
- noreferrer is used to prevent the browser from sending the referrer
  to the visited site
- noopener fixes a fun class of bug: https://mathiasbynens.github.io/rel-noopener/
 2019-04-08 23:13:47 +02:00
jvoisin cdd47b36d2 Clicking on the logo now redirects to home instead of about 
The previous behaviour was confusing, because on
most websites, clicking on the logo will redirect
to the main page, and not on the about one.
 2019-04-08 18:17:19 +02:00
jvoisin a200dd0c37 Don't autocomplete the password field 
I guess that this is a bit silly in 2019,
but since people tend to use weird browsers in weird
places, disabling autocompletion here might prevent
the password from ending up in some local cache.
 2019-04-08 17:25:30 +02:00
jvoisin 9dea3e9051 Add a CONTRIBUTING.md file 2019-04-07 10:55:51 +02:00
jvoisin ec4b969e2c Replace latin encoding with utf-8 2019-04-07 09:27:22 +02:00
jvoisin 5acabcae19 Remove resource bundles for messages as well 2019-04-06 21:46:55 +02:00
jvoisin 9fb56c031b Fix the systemd unit file for OpenJDK 2019-04-05 19:51:15 +02:00
jvoisin 7d865ea7a9 Add a lost meta back 2019-04-03 10:22:38 +02:00
jvoisin 8f74db2ec1 Remove the unused embedded copy of weupnp 2019-04-03 02:44:57 +02:00
jvoisin 5c54bff5ac Remove the unused embedded copy of jarbundler 2019-04-03 02:44:03 +02:00
jvoisin ec8fdb0df1 Remove the unused embedded copy of sbbi-upnplib 2019-04-03 02:42:50 +02:00
jvoisin 030eb7e119 Remove the embedded copy of jaxrpc 2019-04-03 02:40:32 +02:00
jvoisin 258c68dd4d Remove the embedded copy of appbundler 2019-04-03 02:39:20 +02:00
jvoisin 4a1a5467c7 Remove the embedded copy of ant-zip 2019-04-03 02:32:29 +02:00
jvoisin 422127e3f6 Replace the flash player with medialement.js for the shared media 2019-04-03 02:23:50 +02:00
jvoisin 72e372157a Remove WAP-related stuff 
WAP (https://en.wikipedia.org/wiki/Wireless_Application_Protocol)
is a thing from the past that nobody is using anymore.

This should close #960
 2019-04-02 19:48:17 +02:00
jvoisin 268dc6e13d Factorise the key generation into a static method 2019-04-02 10:13:29 +02:00
jvoisin aff7bd3d57 Remove webfx stuff, since they're apparently not used 
The only place where the string `webfx` is mentioned
was in playQueue.jsp, to include a small css file, twice,
that only applies to webfx components, that aren't used
anywhere in the codebase.
 2019-04-02 00:42:24 +02:00
jvoisin db2592a84b Delete AC_OETags.js since it's not used anywhere 2019-04-02 00:37:17 +02:00
jvoisin c9212805be Remove jquery-contextmenu since it's not used anywhere 2019-04-02 00:28:16 +02:00
jvoisin 87442320fc Try to run jkd9 on travis-ci 2019-04-01 23:17:02 +02:00
jvoisin d35834c0e7 Fix a bunch of dom-based xss 
This should close #633
 2019-04-01 23:08:57 +02:00
jvoisin 0d6cbb60ed Use https for external links 2019-04-01 11:45:20 +02:00
jvoisin 3e07ea5288 Use a random key to "encrypt" the remember-me cookie's value 
Since Spring's default remember-me technique is
terrible security-wise (`user:timstamp:md5(use:timestamp:password:key)`),
we should at least use a random key, instead of a fixed one,
otherwise, and attacker able to capture the cookies
might be able to trivially bruteforce offline
the password of the associated user.
 2019-04-01 11:33:35 +02:00
jvoisin ab1690b1fe Don't display the title if it's empty 2019-04-01 02:36:28 +02:00
jvoisin ac1c887698 Remove Google+ relics 
Google+ is dead: https://developers.google.com/+/
 2019-04-01 01:41:41 +02:00
jvoisin cb0866d5fd Download dependencies via https on download.java.net 2019-04-01 01:34:01 +02:00
jvoisin 5edebf7885 Remove inline javascript on the cancel buttons 
The inline javascript used with the cancel buttons
was only used to change the location.
Instead of doing this, it's easier to wrap
the button in a tag.

This is related to #909.
 2019-04-01 01:32:35 +02:00
jvoisin ba6b39b7b2 Add two <meta> tags 
- Add a description, since this can be useful
  in browser's histories
- Add a viewport, making it less worse to use
  airsonic on a super-small screen
 2019-03-31 23:55:24 +02:00
jvoisin 4d5680931c Add the dates of the releases to the changelog 2019-03-31 20:45:15 +02:00
jvoisin 883022d81a Remove script.aculo.us dependency 
It's not used anywhere, using an old version,
and the project doesn't seem to be maintained anyway.
 2019-03-30 11:09:42 +01:00
jvoisin 910802b64f Fix a small resource leak 2019-03-29 00:18:25 +01:00
jvoisin a6c92acb3e Update mediaelement from 4.1.1 to 4.2.9 
I've tested this on mp3, ogg and flac, everything
is working.

Apart from fixing a decent amount of bugs
(https://github.com/mediaelement/mediaelement/releases),
this has the nice side effect of removing a copy
of jquery 1.9.1.
 2019-03-29 00:00:47 +01:00
jvoisin 2f9046d6b4 Fix a xss and clean up some js 
- Fix a stupid self-XSS. I doubt that there are ways to
  use it against other users, but well, better safe than sorry
- Replace the javascript-on-focus hacks with the `autofocus` attribute
 2019-03-28 23:38:37 +01:00
jvoisin 61c842923a Generate new passwords in a secure way 
Previously, lost passwords were generated via
org.apache.commons.lang.RandomStringUtils,
which is using java.util.Random internally.

This PRNG is has a 48-bit seed, that can easily be bruteforced
if an attacker is able to get the PRNG's output, for example
but resetting their own account multiple times,
leading to trivial privileges escalation attacks.

This commit makes use of java.security.SecureRandom
instead.
 2019-03-28 21:47:57 +01:00
jvoisin 6f3c3312ee Add coverity scan to travis 2019-03-27 23:43:59 +01:00
jvoisin 39b9eab715 Simplify a bit the css 2019-03-26 23:08:50 +01:00
jvoisin 0b72acefed Oups 2019-03-26 23:04:32 +01:00