navidrome/server
Deluan bbc6d0722c feat: add library access validation to selectedMusicFolderIds
Enhanced the selectedMusicFolderIds function to validate musicFolderId parameters
against the user's accessible libraries. Invalid library IDs (those the user
doesn't have access to) are now silently filtered out, improving security by
preventing users from accessing libraries they don't have permission for.

Changes include:
- Added validation logic to check musicFolderId parameters against user's accessible libraries
- Added slices package import for efficient validation
- Enhanced function documentation to clarify validation behavior
- Added comprehensive test cases covering validation scenarios
- Maintains backward compatibility with existing behavior
2025-07-16 18:10:15 -04:00
..
backgrounds feat(ui): use webp for login backgrounds 2025-03-06 23:32:52 -05:00
events feat(ui): add Now Playing panel for admins (#4209) 2025-06-10 17:22:13 -04:00
nativeapi feat(library): implement scanner interface for triggering library scans on create/update 2025-07-16 18:10:14 -04:00
public fix(share): force share image to be square (to fix aspect ratio) (#4122) 2025-05-26 17:39:05 -04:00
subsonic feat: add library access validation to selectedMusicFolderIds 2025-07-16 18:10:15 -04:00
auth.go feat(plugins): allow Plugins to call the Subsonic API (#4260) 2025-06-25 14:18:32 -04:00
auth_test.go fix(server): first user created should be admin, when using reverse proxy (#3920) 2025-04-05 08:24:14 -03:00
initial_setup.go chore(server): add logs to begin/end transaction 2025-02-24 19:13:42 -05:00
initial_setup_test.go Upgrade Ginkgo to V2 2022-07-26 16:53:17 -04:00
middlewares.go feat(bfr): Big Refactor: new scanner, lots of new fields and tags, improvements and DB schema changes (#2709) 2025-02-19 20:35:17 -05:00
middlewares_test.go feat(ui): show user's lastAccess (#3342) 2024-09-30 20:46:10 -04:00
serve_index.go feat(ui): implement new event stream connection logic 2025-06-29 10:18:05 -04:00
serve_index_test.go feat(ui): implement new event stream connection logic 2025-06-29 10:18:05 -04:00
server.go fix(server): don't override /song routes 2025-06-01 14:41:50 -04:00
server_suite_test.go Rename log.LevelCritical to log.LevelFatal 2022-12-21 14:53:36 -05:00
server_test.go Make server unix socket file permission configurable via flag UnixSocketPerm (#2763) 2024-01-20 14:50:30 -05:00