sentriz / gonic

music streaming server / free-software subsonic server API implementation
ircs://irc.libera.chat/#gonic
GNU General Public License v3.0
1.62k stars 115 forks source link

Fix non-admin users not being able to create playlists #524

Closed roobre closed 2 months ago

roobre commented 4 months ago

Found this while working on a tentative implementation for #522. It seems that https://github.com/sentriz/gonic/pull/499 introduced some logic that prepopulates playlist.UserID to 1 if nothing else can be decoded from the path.

Before this PR, ServeCreateOrUpdatePlaylist was trying to figure out if a playlist existed by trying to open the file derived from its name. If the name does not exist, playlistIDDecode returns an empty string, which playlistStore.Read gladly accepts and proceeds to open "", which implies ., which does not fail. Then, the code added in #499 will slap the admin user ID on the playlist object, shortly before playlistStore.Read realizes this is actually a directory and returns an error.

That error, however, was never checked. As a result, an empty non-existing playlist with UserID: 1 was returned, and prevented creating playlists as every non-existing playlist will "belong" to admin, and thus no one other than admin could "modify" it.

This PR adds a couple safety checks so this does not happen:

sentriz commented 2 months ago

thanks!