Radeox is a rendering engine for an unspecified markup.
Its [website](http://radeox.org/) is dead, the website
of its [authors](http://www.codehaus.org/) is dead too,
its [last commit](https://github.com/codehaus/radeox) was 13 years ago.
It's only used for the welcome and login messages,
as well as comments from users. If we want to have some markup parsing,
we should use something maintained with autoescaping guarantees,
instead of a piece of zombie code prone to $DEITY knows what injections.
Signed-off-by: Andrew DeMaria <lostonamountain@gmail.com>
This commit is hopefully the final fix on Airsonic's side for #685. It
also fixes#1160, which was caused by temporary workarounds introduced
in #1080 while we were looking for a solution.
The root cause of the issue is the fact that, when we go to the next
track in an Airsonic play queue, we change the media source in the
`ended` event.
In MEJS, this translates as the following two things:
* In Airsonic's 'ended' event, we change the media source (set the `src`
attribute) and call the `load()` method, followed by the `play()`
method.
* The 'ended' event was also used internally by the MEJS player, and
one of these internal uses called the `pause()` method (presumably in
order to make sure that playback was stopped on some media renderers).
Unfortunately, the order in which these events are called depends (in
all modern browsers) on the order in which they are registered.
In our case, the first one is registered inside the `<body>` tag, but
the second one is registered with `$(document).ready(...)`. This means
that the first event handler is called before the second.
This means that, in some cases (when we're unlucky, hence the seemingly
random nature of the bug), `pause()` is called after `load()`
but before the media has finished loading.
Apparently, this causes the `AbortError: The fetching process for the
media resource was aborted by the user agent at the user's request.`
message to appear (which indicates exactly what's described in the last
paragraph), and the playback of the next song is aborted.
Since the preference for the keyboard shortcuts
is set server-side, I had to shove them into a non-javascript
context, and then access them via javascript,
in a separate file.
Since I'm not a javascript expert, I'm more than open
to alternatives if this isn't the right way™ to do it.
This allows the user to control playback for the internet radios, which
were previously started outside of the main player without any
possibility for direct control.
This commit is kind of a hack to force MediaElement.js to show a
progress bar when we are loading a song.
Normally, in vanilla HTML5 MediaElement, we'd explicitely call 'play()'
when loading a song. Here, we cannot ensure playback will work well if
we don't wait for the 'canplay' event to be fired, but the progress bar
won't show up without 'play()'...
This commit emits a fake 'waiting' event to let the MEJS know that it
should update the UI.
This commit works around a race caused by some of our JS code trying to
run play() for the next song while the MEJS player is still cleaning up
the last song.
MEJS issue: https://github.com/mediaelement/mediaelement/issues/2650
Since we're already using jquery-ui for other stuff, it makes sense to use it
for tooltips too, instead of using an old-school-written-in-2009 1300 lines
steaming pile of javascript named wz_tooltip.js
FancyZoom isn't a free-as-in-freedom software,
and is mostly a big pile of old-school javascript.
This commit replace it with a small jquery-powered
script under MIT license.
I bumped it first to 2.X with jQuery migrate, played around but didn't manage
to trigger any warning. So I bumped it again to the latest available version,
jQuery 3.4.0, which isn't triggering useful warnings either.
This page wasn't linked anywhere, and was
allowing an administrator to issue arbitrary sql
comments, and was vulnerable to reflected XSS.
We should get rid of it. If you really want to issue
SQL commands, just ssh to your instance and do it from here.
Evan Harris
François-Xavier Thomas
jvoisin
Andrew DeMaria
benferreri
jvoisin
Peter Marheine