| Commit message (Collapse) | Author | Age | Files | Lines |
| |
|
|
|
|
| |
Fixes another persistent XSS vulnerability.
|
|
|
|
|
| |
Based on merge request #22 from Jean-Lou Hau, but does the escaping for
everything and in a different place.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Handling of unknown tags was wrong (we should just pass them through and
hope for the best, not do some weird-ass id3v2 thing). Add matroska to
the list of known tags. Switch the video types to a generic cleanup
function and move the several-times-duplicated general information
gathering into the general information gathering function where it
belongs. Treat the general information as another tag type instead of
special-casing it as a complete override through array_merge. Drop the
useless iconv stuff (getID3 already translates tags to our requested
charset). Rename some functions to more closely match their purpose.
Fix some private functions that were marked public. Fix encoding
detection, which has been completely broken for a while.
|
|
|
|
|
| |
The mysql extension is deprecated in PHP 5.5 and will be removed in the
future.
|
|
|
|
|
| |
Now you shouldn't need to manually run the command to see what went
wrong.
|
|
|
|
|
| |
Starting with a fresh 3.3.3.5 import these updates failed. Kick them to
the curb.
|
|
|
|
| |
Based on merge request #11
|
|
|
|
| |
It's what it should have been from the start.
|
| |
|
|
|
|
|
| |
Merge request #20. Basic, not very pretty, but works and, unlike the
Flash player, is maintainable.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
| |
Code duplication is bad even when it's CSS, mmkay?
If a theme has templates/rtl.css, it will be loaded in addition to
default.css. This is more sane than the old behaviour, which loaded
default-rtl.css instead of default.css.
I'm not feeling ambitious enough to actually check whether the current
-rtl.css files work and change them to overrides instead of modified
copypasta, so I just dropped them for now.
|
| |
|
|
|
|
|
|
|
|
| |
Remove some of the roundabout complexity that had built up. Push people
toward using a single, flexible tool for most of their transcoding
needs. Increase backend and configuration flexibility to support
user-requested format changes (e.g. for an HTML5 player); this
functionality is not yet exposed.
|
|
|
|
|
|
| |
Now that playback doesn't pretend it's supported, we don't need the
fragile hacks to support guessing the content size or 'seeking' within
a transcoded stream.
|
|
|
|
|
| |
Simplify the rating search and drop the ugly subquery; make it a
straight query against the current user's ratings.
|
|
|
|
| |
git://github.com/sstephenson/prototype.git
|
| |
|
|
|
|
|
| |
Previously, users who didn't have access to modify the password were
shown the actual current setting instead of asterisks.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Should fix the VLC plugin, as well as allow direct use of an Ampache
site on Android devices.
First, split the Stream class into an instantiable class that does the
playlist wrangling and a static class that handles the streaming stuff.
How does this work? Well, stream.php does its fancy stuff like
gathering the media IDs and clearing the playlist, but instead
of generating the playlist file there we use the Stream_Playlist
class to store the list of URLs in the database, then redirect to
play/index.php to create the actual download (there are some magic
playlist types like localplay that don't need to redirect.)
The playlist will be cached as long as that stream session is active, so
it can be downloaded multiple times and by clients that don't share the
browser's cookie cache.
Clean up the playlist generation by reducing copypasta.
|
| |
|
| |
|
|
|
|
| |
is_readable is flaky under Windows, opendir should be more accurate.
|
| |
|
|
|
|
|
| |
Notably: "PHP5 standards improvements". Maybe it will throw less
PHP warnings now.
|
| |
|
| |
|
|
|
|
|
|
| |
Don't run scrub_in on the subject and body; it's not touching the
database or being output back to the browser, and we send plain text
email. Anything malicious that can be done is a phpmailer bug.
|
|
|
|
|
| |
This should be a more complete fix, and possibly a somewhat more
efficient approach.
|
|
|
|
|
|
| |
Actually transfer all ASF tags into the asf tag array. I suspect that
some things like 'genre' may actually be multivalued, but I don't have
any samples to back that up.
|
|
|
|
| |
I'm tired of seeing alpha1.
|
|
|
|
|
|
| |
Using a relative path required it to be run from the top-level
directory; we already do voodoo to figure out the correct prefix, so we
should use that.
|
|
|
|
|
|
|
|
|
| |
Newer versions of the PCRE library changed behaviour so we can't
replace invalid characters by listing them, since it now requires
that the characters in a pattern are valid Unicode characters. Use an
inverted character class instead.
Might work.
|
|
|
|
|
|
| |
According to the changelog, getID3 1.7.9 standardised on part_of_a_set
as the key for this info (pulled from TPOS or TPA, depending on the
minor version of ID3v2); we were looking for 'pos', which is wrong.
|
| |
|
| |
|
|
|
|
|
|
|
|
|
|
| |
Previously we would say things like "1 seconds" and "1 hours". Using
the magic of ngettext and sprintf we can get rid of the static
concatenation order and become theoretically more translatable as well
as more correct in English.
Also changed the logic a bit, since the old looping method was
unfriendly to my brain.
|
| |
|
|
|
|
|
|
| |
Initial tag is case sensitive; we were emitting [Playlist] but some
players don't accept that. There is unfortunately no real standard to
check, but this does match what Winamp (ack, pthbbt) does.
|
|
|
|
|
|
| |
Picard is putting multiple MBIDs in the tags now that MusicBrainz' new
schema is live. The easiest way to deal with this is to store all of
them as an aggregate value and match against that.
|
|
|
|
|
|
|
|
| |
This would result in extra slashes, e.g.
'/\/([0-9]+?)\s\\\-\s(.+?)\..+$/' instead of
'/\/([0-9]+?)\s\-\s(.+?)\..+$/'
There are some unrelated cosmetic changes as well.
|
|
|
|
|
| |
It could be in either $_REQUEST or a playlist object, so we need to
check the correct one.
|
|
|
|
| |
ID can be multiple digits, so we should capture all of them.
|
| |
|
|
|
|
|
| |
JSON has some strict rules about what can be escaped, and we should have
been scrubbing to entities all along.
|
|
|
|
| |
Add an option to have newly registered accounts disabled by default.
|
|
|
|
| |
Sessions can be longer than 32 characters. Bump to 64.
|
|
|
|
|
|
| |
It seems that Chrome believes that commas end header values (it's
probably correct in this belief). Quoting the value should avoid this,
and potentially other issues.
|
|
|
|
| |
Missing ampersand.
|