fix: production-readiness hardening — security, perf, a11y, observability
Lint & Test / test (push) Successful in 20s
Lint & Test / test (push) Successful in 20s
Security - Default scripts_management, callbacks_management, links_management, and media_folders_management to False so a leaked token cannot escalate to RCE through admin CRUD endpoints. - TokenSpec + scope hierarchy (read | control | admin); legacy bare-string api_tokens entries promote to admin for back-compat. Management endpoints now require admin scope. - WebSocket subprotocol auth (Sec-WebSocket-Protocol: media-server.token.<T>) preferred over ?token= query so the token no longer lands in URL/history/ Referer; query fallback retained for HA integration back-compat. - Origin allow-list check on the WS endpoint (CSWSH defence). - In-process token-bucket rate limiter: 5/min for failed auths, 10/min for /api/scripts/execute and /api/callbacks/execute. - shell=False subprocess path (shlex.split) + per-parameter regex `pattern` in ScriptParameterConfig to harden shell=true scripts against parameter injection (Windows cmd.exe env-var expansion). - CSP gains form-action, worker-src, manifest-src directives. - Refuse cors_origins=["*"] at startup; strip token=... from uvicorn access logs; validate Gitea release tag against strict SemVer regex. - noopener noreferrer + no-referrer referrerpolicy on every outbound link. - icacls hardening of config.yaml on Windows (current user + SYSTEM + Administrators only); 0600 still enforced on POSIX. - WS volume handler clamps input and never drops the socket on bad messages. Performance - Album-art read in windows_media gated by track key — was decoding the WinRT thumbnail twice per second regardless of track changes. - /api/media/artwork returns content-derived ETag + Cache-Control so the browser sends If-None-Match and gets 304s on track repeats. - Foreground-service ctypes argtypes hoisted to one-time module init (was re-declaring ~14 prototypes per probe). - display_service _static_cache keyed by (edid_hash, ...) tuple with eviction of disappeared monitors — fixes stale capabilities on hot-plug swaps where the new topology has the same monitor count. - Visualizer rAF loop paused on document.hidden, resumed on visible. Reliability / bug fixes - Lifespan rewritten as try/yield/finally so a partial-startup failure cannot orphan background tasks or executors. - _run_callback in routes/media.py keeps a strong task ref (GC-safe) and uses the dedicated callback executor instead of the default pool. - macos_media.set_volume() no longer always returns True. - TrayManager._restart_requested initialised in __init__; set before signalling exit so the main thread observes it correctly. - Missing static_dir now logs a WARNING instead of silent UI disable. UX / accessibility / PWA - manifest.json theme_color and background_color match the Studio Reference base (#0E0D0B); added id and scope for PWA installability. - ARIA on mini-player icon buttons; inner SVGs marked aria-hidden. - OS mediaSession API wired so headset / lockscreen / Bluetooth buttons drive play/pause/next/prev/seek and show track metadata + artwork. Observability - X-Request-ID middleware (accept upstream id if it matches a safe regex, otherwise UUID4); request_id_var added to ContextVars and included in every log line alongside the token label. - Audit log (append-only JSONL) for every script + callback execution, including the on_play/on_pause/etc. event callbacks. Background-thread writer; queue capped; flushed in lifespan teardown. Deployment - proxy_headers + forwarded_allow_ips plumbed through Settings → uvicorn.Config for reverse-proxy installs. - HTTPS support via ssl_certfile + ssl_keyfile (+ optional password); startup refuses to launch with only one of the pair set. - Thumbnail cache moved from project-root .cache to %LOCALAPPDATA%/media-server/cache (Windows) and $XDG_CACHE_HOME/media-server/thumbnails (POSIX). Tests - 35 new tests across auth scopes, rate limiter, browser path traversal (../ NUL UNC absolute), script-param validation incl. regex, Gitea tag whitelist, config atomic write + POSIX perms. 47 passed / 4 skipped.
This commit is contained in:
@@ -26,16 +26,16 @@
|
||||
</div>
|
||||
</div>
|
||||
<div class="mini-controls">
|
||||
<button class="mini-control-btn mini-nav-btn" data-onclick="previousTrack()" data-i18n-title="player.previous" title="Previous">
|
||||
<svg viewBox="0 0 24 24"><path d="M6 6h2v12H6zm3.5 6l8.5 6V6z"/></svg>
|
||||
<button class="mini-control-btn mini-nav-btn" data-onclick="previousTrack()" data-i18n-title="player.previous" data-i18n-aria-label="player.previous" title="Previous" aria-label="Previous">
|
||||
<svg viewBox="0 0 24 24" aria-hidden="true" focusable="false"><path d="M6 6h2v12H6zm3.5 6l8.5 6V6z"/></svg>
|
||||
</button>
|
||||
<button class="mini-control-btn" data-onclick="togglePlayPause()" id="mini-btn-play-pause" title="Play/Pause">
|
||||
<svg viewBox="0 0 24 24" id="mini-play-pause-icon">
|
||||
<button class="mini-control-btn" data-onclick="togglePlayPause()" id="mini-btn-play-pause" title="Play/Pause" aria-label="Play/Pause">
|
||||
<svg viewBox="0 0 24 24" id="mini-play-pause-icon" aria-hidden="true" focusable="false">
|
||||
<path d="M8 5v14l11-7z"/>
|
||||
</svg>
|
||||
</button>
|
||||
<button class="mini-control-btn mini-nav-btn" data-onclick="nextTrack()" data-i18n-title="player.next" title="Next">
|
||||
<svg viewBox="0 0 24 24"><path d="M6 18l8.5-6L6 6v12zM16 6v12h2V6h-2z"/></svg>
|
||||
<button class="mini-control-btn mini-nav-btn" data-onclick="nextTrack()" data-i18n-title="player.next" data-i18n-aria-label="player.next" title="Next" aria-label="Next">
|
||||
<svg viewBox="0 0 24 24" aria-hidden="true" focusable="false"><path d="M6 18l8.5-6L6 6v12zM16 6v12h2V6h-2z"/></svg>
|
||||
</button>
|
||||
</div>
|
||||
<div class="mini-progress-container">
|
||||
@@ -48,8 +48,8 @@
|
||||
</div>
|
||||
</div>
|
||||
<div class="mini-volume-container">
|
||||
<button class="mini-control-btn" data-onclick="toggleMute()" id="mini-btn-mute" title="Mute">
|
||||
<svg viewBox="0 0 24 24" id="mini-mute-icon">
|
||||
<button class="mini-control-btn" data-onclick="toggleMute()" id="mini-btn-mute" title="Mute" aria-label="Mute" aria-pressed="false">
|
||||
<svg viewBox="0 0 24 24" id="mini-mute-icon" aria-hidden="true" focusable="false">
|
||||
<path d="M3 9v6h4l5 5V4L7 9H3zm13.5 3c0-1.77-1.02-3.29-2.5-4.03v8.05c1.48-.73 2.5-2.25 2.5-4.02z"/>
|
||||
</svg>
|
||||
</button>
|
||||
@@ -88,7 +88,7 @@
|
||||
</div>
|
||||
<div class="header-toolbar">
|
||||
<div id="headerLinks" class="header-links"></div>
|
||||
<a class="header-btn" href="/docs" target="_blank" title="API Documentation" aria-label="API Documentation">
|
||||
<a class="header-btn" href="/docs" target="_blank" rel="noopener noreferrer" referrerpolicy="no-referrer" title="API Documentation" aria-label="API Documentation">
|
||||
<svg viewBox="0 0 24 24"><path fill="currentColor" d="M14 2H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h12c1.1 0 2-.9 2-2V8l-6-6zm-1 2l5 5h-5V4zM6 20V4h5v7h7v9H6zm2-4h8v2H8v-2zm0-3h8v2H8v-2z"/></svg>
|
||||
</a>
|
||||
<button class="header-btn" data-onclick="showAboutDialog()" data-i18n-title="about.button_title" title="About" aria-label="About">
|
||||
|
||||
@@ -536,6 +536,8 @@ export async function loadHeaderLinks() {
|
||||
a.href = link.url;
|
||||
a.target = '_blank';
|
||||
a.rel = 'noopener noreferrer';
|
||||
// Prevent leaking the WebUI URL (with ?token=) via Referer.
|
||||
a.referrerPolicy = 'no-referrer';
|
||||
a.className = 'header-link';
|
||||
a.title = link.label || link.url;
|
||||
|
||||
|
||||
@@ -10,6 +10,7 @@ import {
|
||||
lastStatus, setLastStatus, currentPlayState, setCurrentPlayState,
|
||||
POSITION_INTERPOLATION_MS, seek, notifyRemoteVolume,
|
||||
getAuthHeaders, hasCredentials,
|
||||
togglePlayPause, nextTrack, previousTrack,
|
||||
} from './core.js';
|
||||
import { updateBackgroundColors } from './background.js';
|
||||
import { loadDisplayMonitors } from './links.js';
|
||||
@@ -381,11 +382,85 @@ function buildVisualizerGradient() {
|
||||
|
||||
function startVisualizerRender() {
|
||||
if (visualizerAnimFrame) return;
|
||||
// Don't even queue a frame while the tab is hidden — rAF still fires on
|
||||
// hidden tabs (throttled but not paused) and would burn CPU + battery
|
||||
// smoothing into bars no one can see. We resume on `visibilitychange`.
|
||||
if (typeof document !== 'undefined' && document.hidden) return;
|
||||
// Cache editorial spectrum bar refs once per start.
|
||||
cacheEditorialSpectrumBars();
|
||||
renderVisualizerFrame();
|
||||
}
|
||||
|
||||
// ─── OS Media Session integration ─────────────────────────────
|
||||
// Hooks the page into the system's media session so headset / lockscreen /
|
||||
// Bluetooth play-pause-skip buttons drive the active track. Action handlers
|
||||
// are set once and never re-registered; only the metadata + playback state
|
||||
// flip when a track changes.
|
||||
let _mediaSessionInitialised = false;
|
||||
let _lastMediaSessionKey = '';
|
||||
function syncMediaSession(status) {
|
||||
if (typeof navigator === 'undefined' || !('mediaSession' in navigator)) return;
|
||||
const session = navigator.mediaSession;
|
||||
|
||||
if (!_mediaSessionInitialised) {
|
||||
const setHandler = (name, fn) => {
|
||||
try { session.setActionHandler(name, fn); } catch { /* unsupported action */ }
|
||||
};
|
||||
setHandler('play', () => togglePlayPause());
|
||||
setHandler('pause', () => togglePlayPause());
|
||||
setHandler('nexttrack', () => nextTrack());
|
||||
setHandler('previoustrack', () => previousTrack());
|
||||
setHandler('seekto', (ev) => { if (ev && typeof ev.seekTime === 'number') seek(ev.seekTime); });
|
||||
_mediaSessionInitialised = true;
|
||||
}
|
||||
|
||||
// Track-identity key — re-build metadata only when title/artist/album change.
|
||||
const artworkSrc = status && status.album_art_url ? '/api/media/artwork' : '';
|
||||
const key = `${status.title || ''}|${status.artist || ''}|${status.album || ''}|${artworkSrc}`;
|
||||
if (key !== _lastMediaSessionKey) {
|
||||
_lastMediaSessionKey = key;
|
||||
try {
|
||||
session.metadata = new MediaMetadata({
|
||||
title: status.title || '',
|
||||
artist: status.artist || '',
|
||||
album: status.album || '',
|
||||
artwork: artworkSrc ? [{ src: artworkSrc, sizes: '512x512', type: 'image/*' }] : [],
|
||||
});
|
||||
} catch { /* MediaMetadata unsupported on very old browsers */ }
|
||||
}
|
||||
|
||||
session.playbackState =
|
||||
status.state === 'playing' ? 'playing'
|
||||
: status.state === 'paused' ? 'paused'
|
||||
: 'none';
|
||||
|
||||
if (typeof session.setPositionState === 'function'
|
||||
&& status.duration && status.duration > 0
|
||||
&& typeof status.position === 'number') {
|
||||
try {
|
||||
session.setPositionState({
|
||||
duration: status.duration,
|
||||
position: Math.min(status.position, status.duration),
|
||||
playbackRate: 1.0,
|
||||
});
|
||||
} catch { /* invalid range — ignore */ }
|
||||
}
|
||||
}
|
||||
|
||||
// Pause / resume the visualizer with tab visibility. Idempotent: called once
|
||||
// at module init below, no-op if no listener support.
|
||||
if (typeof document !== 'undefined' && document.addEventListener) {
|
||||
document.addEventListener('visibilitychange', () => {
|
||||
if (document.hidden) {
|
||||
stopVisualizerRender();
|
||||
} else if (frequencyData) {
|
||||
// Only restart if a payload is live (otherwise startVisualizerRender
|
||||
// would queue a no-op rAF chain forever waiting for one).
|
||||
startVisualizerRender();
|
||||
}
|
||||
});
|
||||
}
|
||||
|
||||
export function stopVisualizerRender() {
|
||||
if (visualizerAnimFrame) {
|
||||
cancelAnimationFrame(visualizerAnimFrame);
|
||||
@@ -903,6 +978,11 @@ export function updateUI(status) {
|
||||
|
||||
updateMuteIcon(status.muted);
|
||||
|
||||
// Wire the OS Media Session so headset buttons, lockscreen controls, and
|
||||
// Bluetooth remotes drive the active media (not the WebUI tab). Cheap and
|
||||
// idempotent — re-running setActionHandler with the same fn is a no-op.
|
||||
syncMediaSession(status);
|
||||
|
||||
const src = resolveMediaSource(status.source);
|
||||
dom.source.textContent = src ? src.name : t('player.unknown_source');
|
||||
dom.sourceIcon.innerHTML = src?.icon || '';
|
||||
|
||||
@@ -80,6 +80,9 @@ export async function displayQuickAccess() {
|
||||
card.href = link.url;
|
||||
card.target = '_blank';
|
||||
card.rel = 'noopener noreferrer';
|
||||
// Prevent the WebUI's URL (which may carry ?token=...) from
|
||||
// leaking to third-party sites via Referer.
|
||||
card.referrerPolicy = 'no-referrer';
|
||||
|
||||
if (link.icon) {
|
||||
const iconEl = document.createElement('div');
|
||||
|
||||
@@ -88,9 +88,22 @@ export function connectWebSocket(token) {
|
||||
|
||||
const protocol = window.location.protocol === 'https:' ? 'wss:' : 'ws:';
|
||||
const wsBase = `${protocol}//${window.location.host}/api/media/ws`;
|
||||
const wsUrl = token ? `${wsBase}?token=${encodeURIComponent(token)}` : wsBase;
|
||||
|
||||
const newWs = new WebSocket(wsUrl);
|
||||
// Prefer Sec-WebSocket-Protocol-based auth so the token never appears in
|
||||
// the URL (which would otherwise land in browser history, server access
|
||||
// logs, and Referer headers). Keep the ?token=... fallback for clients
|
||||
// that pre-date this change and don't speak the subprotocol.
|
||||
let newWs;
|
||||
if (token) {
|
||||
try {
|
||||
newWs = new WebSocket(wsBase, [`media-server.token.${token}`]);
|
||||
} catch (e) {
|
||||
console.warn('Subprotocol WS handshake failed, falling back to ?token=', e);
|
||||
newWs = new WebSocket(`${wsBase}?token=${encodeURIComponent(token)}`);
|
||||
}
|
||||
} else {
|
||||
newWs = new WebSocket(wsBase);
|
||||
}
|
||||
activeSocket = newWs;
|
||||
setWs(newWs);
|
||||
|
||||
|
||||
@@ -1,12 +1,14 @@
|
||||
{
|
||||
"id": "/",
|
||||
"name": "Media Server",
|
||||
"short_name": "Media",
|
||||
"description": "Remote media player control and file browser",
|
||||
"start_url": "/",
|
||||
"scope": "/",
|
||||
"display": "standalone",
|
||||
"orientation": "any",
|
||||
"background_color": "#121212",
|
||||
"theme_color": "#121212",
|
||||
"background_color": "#0E0D0B",
|
||||
"theme_color": "#0E0D0B",
|
||||
"icons": [
|
||||
{
|
||||
"src": "/static/icons/icon.svg",
|
||||
|
||||
Reference in New Issue
Block a user