mirror of
https://github.com/navidrome/navidrome.git
synced 2026-10-08 10:27:08 +02:00
11640f2e4d* fix(security): restrict transcoding config reads to admins
Authenticated non-admin users could read transcoding configs through
the native API (GET /api/transcoding and /api/transcoding/{id}) when
EnableTranscodingConfig was enabled. The responses included the full
command templates, disclosing admin-configured ffmpeg invocations and
local command paths. Write operations were already admin-only.
The /transcoding route was registered in the general authenticated
group, and only the repository's write methods checked IsAdmin. This
applies the boundary at two layers:
- Move the route under adminOnlyMiddleware, alongside the other
admin-only resources (/library, /config, /inspect).
- Add an IsAdmin guard to the repository's rest.Repository read
methods (Read, ReadAll, Count) as defense-in-depth.
The guard is scoped to the REST methods only. The streaming pipeline
resolves profiles via Get/FindByFormat (model.TranscodingRepository),
which stay open so transcoding keeps working for non-admin users.
Adds regression tests covering non-admin read denial and confirming
non-admin streaming lookups (Get/FindByFormat) still succeed.
* fix(security): redact transcoding Command for non-admins instead of blocking reads
Reworks the previous approach after review (Codex P2): moving /transcoding
under adminOnlyMiddleware and denying non-admin reads broke legitimate
non-admin UI flows. The web UI reads the transcoding resource as a regular
user in several places that need only the profile name and target format:
the player edit dropdown (ReferenceInput), the player list (ReferenceField),
and the share/download format pickers (useGetList -> {targetFormat, name}).
The only sensitive field is Command (the admin-owned ffmpeg template). So:
- Revert the route move; /transcoding stays in the authenticated group.
- Read/ReadAll now return the profiles to any authenticated user but blank
the Command field for non-admins (mirrors user_repository's field-level
redaction). Count is no longer denied (the UI needs list pagination).
- Writes remain admin-only (Save/Update/Delete/Put).
- Streaming is unaffected: it resolves profiles via Get/FindByFormat, which
are not redacted, so on-the-fly transcoding keeps working for non-admins.
Tests updated: non-admin reads succeed with Command blank, admin reads keep
Command, non-admin Get/FindByFormat keep Command, writes still denied.
|
||
|---|---|---|
| .. | ||
| e2e | ||
| album_repository.go | ||
| album_repository_test.go | ||
| artist_repository.go | ||
| artist_repository_test.go | ||
| collation_test.go | ||
| criteria_sql.go | ||
| criteria_sql_benchmark_test.go | ||
| criteria_sql_test.go | ||
| export_test.go | ||
| folder_repository.go | ||
| folder_repository_test.go | ||
| genre_repository.go | ||
| genre_repository_test.go | ||
| helpers.go | ||
| helpers_test.go | ||
| library_repository.go | ||
| library_repository_test.go | ||
| mediafile_repository.go | ||
| mediafile_repository_test.go | ||
| persistence.go | ||
| persistence_suite_test.go | ||
| persistence_test.go | ||
| player_repository.go | ||
| player_repository_test.go | ||
| playlist_repository.go | ||
| playlist_repository_test.go | ||
| playlist_track_repository.go | ||
| playqueue_repository.go | ||
| playqueue_repository_test.go | ||
| plugin_cleanup.go | ||
| plugin_cleanup_test.go | ||
| plugin_repository.go | ||
| plugin_repository_test.go | ||
| property_repository.go | ||
| property_repository_test.go | ||
| radio_repository.go | ||
| radio_repository_test.go | ||
| scrobble_buffer_repository.go | ||
| scrobble_buffer_repository_test.go | ||
| scrobble_repository.go | ||
| scrobble_repository_test.go | ||
| share_repository.go | ||
| share_repository_test.go | ||
| smart_playlist_repository.go | ||
| smart_playlist_repository_test.go | ||
| sql_annotations.go | ||
| sql_annotations_test.go | ||
| sql_base_repository.go | ||
| sql_base_repository_test.go | ||
| sql_bookmarks.go | ||
| sql_bookmarks_test.go | ||
| sql_participations.go | ||
| sql_restful.go | ||
| sql_restful_test.go | ||
| sql_search.go | ||
| sql_search_fts.go | ||
| sql_search_fts_test.go | ||
| sql_search_like.go | ||
| sql_search_like_test.go | ||
| sql_search_test.go | ||
| sql_tags.go | ||
| tag_library_filtering_test.go | ||
| tag_repository.go | ||
| tag_repository_test.go | ||
| transcoding_repository.go | ||
| transcoding_repository_test.go | ||
| user_props_repository.go | ||
| user_repository.go | ||
| user_repository_test.go | ||