navidrome/server/subsonic
Deluan bbc6d0722c feat: add library access validation to selectedMusicFolderIds
Enhanced the selectedMusicFolderIds function to validate musicFolderId parameters
against the user's accessible libraries. Invalid library IDs (those the user
doesn't have access to) are now silently filtered out, improving security by
preventing users from accessing libraries they don't have permission for.

Changes include:
- Added validation logic to check musicFolderId parameters against user's accessible libraries
- Added slices package import for efficient validation
- Enhanced function documentation to clarify validation behavior
- Added comprehensive test cases covering validation scenarios
- Maintains backward compatibility with existing behavior
2025-07-16 18:10:15 -04:00
..
filter fix(subsonic): Sort songs by presence of lyrics for getLyrics (#4237) 2025-06-16 12:04:41 -04:00
responses fix: Allow nullable ReplayGain and support 0.0 (#4239) 2025-06-17 12:02:25 -04:00
album_lists.go feat(subsonic): set sortName for OS AlbumList (#3776) 2025-03-05 22:52:15 -05:00
album_lists_test.go feat(prometheus): add metrics to Subsonic API and Plugins (#4266) 2025-06-27 22:13:57 -04:00
api.go fix(prometheus): report subsonic error code (#4282) 2025-06-30 11:54:02 -04:00
api_suite_test.go feat:(server): support reading lyrics from filesystem (#2897) 2025-04-30 08:10:19 -04:00
api_test.go fix(prometheus): report subsonic error code (#4282) 2025-06-30 11:54:02 -04:00
bookmarks.go feat(server): add update and clear play queue endpoints to native API (#4215) 2025-06-11 12:02:31 -04:00
browsing.go refactor: change ArtistRepository.GetIndex to accept multiple library IDs 2025-07-16 18:10:15 -04:00
browsing_test.go refactor: simplify getUserAccessibleLibraries function and update related tests 2025-07-16 18:10:15 -04:00
helpers.go feat: add library access validation to selectedMusicFolderIds 2025-07-16 18:10:15 -04:00
helpers_test.go feat: add library access validation to selectedMusicFolderIds 2025-07-16 18:10:15 -04:00
jukebox.go refactor: small improvements and clean up (#3423) 2024-10-22 22:54:31 -04:00
library_scanning.go feat(ui): add scan progress and error reporting to UI (#4094) 2025-05-21 09:30:23 -04:00
media_annotation.go feat(plugins): experimental support for plugins (#3998) 2025-06-22 20:45:38 -04:00
media_annotation_test.go feat(prometheus): add metrics to Subsonic API and Plugins (#4266) 2025-06-27 22:13:57 -04:00
media_retrieval.go fix(subsonic): Sort songs by presence of lyrics for getLyrics (#4237) 2025-06-16 12:04:41 -04:00
media_retrieval_test.go feat(prometheus): add metrics to Subsonic API and Plugins (#4266) 2025-06-27 22:13:57 -04:00
middlewares.go fix(prometheus): report subsonic error code (#4282) 2025-06-30 11:54:02 -04:00
middlewares_test.go feat(plugins): allow Plugins to call the Subsonic API (#4260) 2025-06-25 14:18:32 -04:00
opensubsonic.go Add OS Lyrics extension (#2656) 2023-12-27 20:20:29 -05:00
opensubsonic_test.go feat(prometheus): add metrics to Subsonic API and Plugins (#4266) 2025-06-27 22:13:57 -04:00
playlists.go fix(subsonic): clearing playlist comment and public in Subsonic API (#4258) 2025-06-24 08:50:06 -04:00
playlists_test.go feat(prometheus): add metrics to Subsonic API and Plugins (#4266) 2025-06-27 22:13:57 -04:00
radio.go Replace all utils.Param* with req.Params 2023-12-21 17:41:09 -05:00
searching.go fix(subsonic): fix albumCount in artists (#3827) 2025-03-14 21:21:03 -04:00
sharing.go fix(subsonic): make Share's lastVisited optional 2025-01-09 16:10:53 -05:00
stream.go Add log.IsGreaterOrEqualTo, that take into consideration path-scoped log levels 2023-12-25 16:35:16 -05:00
system.go Some cleanup, adding missing context handling 2022-12-06 19:57:47 -05:00
users.go fix(subsonic): fix JukeboxRole logic in GetUser and eliminate code duplication (#4170) 2025-06-02 21:34:43 -04:00
users_test.go fix(subsonic): fix JukeboxRole logic in GetUser and eliminate code duplication (#4170) 2025-06-02 21:34:43 -04:00