Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix non-admin users not being able to create playlists #524

Merged
merged 2 commits into from
Sep 15, 2024

Conversation

roobre
Copy link
Contributor

@roobre roobre commented Jul 3, 2024

Found this while working on a tentative implementation for #522. It seems that #499 introduced some logic that prepopulates playlist.UserID to 1 if nothing else can be decoded from the path.

Before this PR, ServeCreateOrUpdatePlaylist was trying to figure out if a playlist existed by trying to open the file derived from its name. If the name does not exist, playlistIDDecode returns an empty string, which playlistStore.Read gladly accepts and proceeds to open "", which implies ., which does not fail. Then, the code added in #499 will slap the admin user ID on the playlist object, shortly before playlistStore.Read realizes this is actually a directory and returns an error.

That error, however, was never checked. As a result, an empty non-existing playlist with UserID: 1 was returned, and prevented creating playlists as every non-existing playlist will "belong" to admin, and thus no one other than admin could "modify" it.

This PR adds a couple safety checks so this does not happen:

  • Does not bother opening a playlist if the decoded path is empty
  • Checks error returned by Open
  • Causes Open to fail earlier if a path to a directory is passed

@sentriz
Copy link
Owner

sentriz commented Sep 15, 2024

thanks!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants