amahi / amahi-anywhere-fs Goto Github PK

Currently one can access any local server running on the hda machine using Vhost/? in User-Agent header, for example Vhost/localhost:3000/blah-blah or even more vulnerable could be Vhost/anywebsite.com.

looks like there is some issue with escaping folder names or something like that.

when the server comes across a folder that has a + sign, the contents are returned as 404. it's browseable, however.

we have a hole in our testing, looks like we tested file names but not folder names?

I first compiled it on my Archlinux, it didn't work. So I turn to Ubuntu (Docker on my Arch), it still couldn't work, the errors are following:

root@Ubuntu:~/work/amahi-anywhere-fs# make
head: cannot open '/etc/system-release' for reading: No such file or directory
go get -tags " linux" fs
# fs
src/fs/fs.go:60:18: undefined: PFE_HOST
src/fs/fs.go:61:18: undefined: PFE_PORT
src/fs/fs.go:71:37: undefined: PFE_HOST
src/fs/fs.go:72:42: undefined: PFE_PORT
src/fs/fs.go:85:39: undefined: MYSQL_CREDENTIALS
src/fs/fs.go:109:41: undefined: METADATA_FILE
src/fs/fs.go:109:56: undefined: TMDB_API_KEY
src/fs/fs.go:109:70: undefined: TVRAGE_API_KEY
src/fs/fs.go:109:86: undefined: TVDB_API_KEY
src/fs/fs.go:112:13: undefined: PID_FILE
src/fs/fs.go:112:13: too many errors
Makefile:17: recipe for target 'build-production' failed
make: *** [build-production] Error 2

Mime types for files containing source codes are missing. For example: .css, .java, .swift, .c++, .c, .py etc.
A comprehensive list of mime types can be found here for reference.

i cannot seem to be able to build this client on

$ make build-production
go get -tags "fedora linux" fs
# github.com/go-sql-driver/mysql
src/github.com/go-sql-driver/mysql/connection.go:485: undefined: driver.TxOptions
src/github.com/go-sql-driver/mysql/connection.go:491: undefined: sql.IsolationLevel
src/github.com/go-sql-driver/mysql/connection.go:491: undefined: sql.LevelDefault
src/github.com/go-sql-driver/mysql/connection.go:505: undefined: driver.NamedValue
src/github.com/go-sql-driver/mysql/connection.go:524: undefined: driver.NamedValue
src/github.com/go-sql-driver/mysql/connection.go:558: undefined: driver.NamedValue
src/github.com/go-sql-driver/mysql/connection.go:577: undefined: driver.NamedValue
src/github.com/go-sql-driver/mysql/connection.go:642: undefined: driver.NamedValue
src/github.com/go-sql-driver/mysql/utils.go:730: undefined: driver.NamedValue
src/github.com/go-sql-driver/mysql/utils.go:742: undefined: driver.IsolationLevel
src/github.com/go-sql-driver/mysql/connection.go:491: too many errors
Makefile:16: recipe for target 'build-production' failed
make: *** [build-production] Error 2
$ go version
go version go1.7.6 linux/amd64

Separate service objects are created for running local and remote servers, this creates duplicate copies of different resources created inside those service. Hence users authenticated on local server are not available on remote access and vice versa. Similarly two copies of HDAShares and other resources are maintained which is unnecessary.
This can be resolved by creating only a single copy of service and using it for both local as well as remote server.

Create and cache low-resolution thumbnail for image files for faster loading

near as i can tell, it should be text/csv but it's currently a generic octect-stream.

at the moment the log at /var/log/amahi-anywhere.log is fairly basic. i think we tried to use a fairly standard "apache-like" logging. some features would make it more useful.

• what is the origin of the request (e.g. local IP, remote IP, or at a minimum local/remote)
• no session information should appear on it. some calls still have that and it should be stripped
• as we work on NAUs, we will probably need to record the user (there are ways to do that in typical logs, but we're not appearing to have a place for that at the moment)
• we also should log things like denied accesses

I think we should calculate each files's md5 when we upload it, if the files exists and md5 is the same, we don‘t do anything, but if the file name exists but md5 is diffirent, we should rename the currently uploaded file.

I am seeing these errors in a file called /var/log/.fatal.amahi-anywhere.log, however, there is no indication as to the location of the file that causes this, which would help finding out the issue

[2021-03-19 18:00:30] [FATAL] [cache.go:fillCacheWalkFunc:42] Panic while creating thumbnail: runtime error: invalid memory address or nil pointer dereference

The Problem:

As the cast feature is now functional on both Android and iOS apps. So while casting media content, It's better if we show the currently playing video's cover image (or preview) or audio's album art image. This gets displayed at several places in android/ios (like notification icon, extended controls screen background, mini controller's side icon, on the cast device selection dialog, lock screen background, etc.). Now the problem is that the cast API requires a URL of the image which we do not have.

Solution

An API to fetch the metadata (including Artist, Album, Track title, Genre, Album Artwork, Track number in case of audio file) of the media file and also a unique URL pointing to the cached album art or preview image for the media.