Your message dated Mon, 15 Feb 2010 12:49:29 +0000
with message-id <[email protected]>
and subject line Bug#568118: fixed in libapache-mod-musicindex 1.3.1-1
has caused the Debian Bug report #568118,
regarding libapache2-mod-musicindex: Music files overwritten if no write access
to cache directory
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
568118: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=568118
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: libapache2-mod-musicindex
Version: 1.2.2-3
Severity: normal
I was bitten by this bug yesterday, and I replicated it successfully
today:
Setup :
- The Apache process (eg. www-data) has write access to your audio
files. Obviously this is not a good idea, but it can happen for
instance if the files are on a NTFS partition mounted with ntfs-3g (full
access to all files and directories are granted by default to all system
users unless you restrict access with uid, gid and *mask options).
- The Apache process does *not* have write access to the musicindex
cache directory (for instance because of a typo in the MusicIndexCache line).
Now start apache2 and access the MusicIndex page. Browse to an album
page. You just need to reload the page (hit Reload in Firefox). The song
list entries disappear from the page, because your audio files have just
been overwritten by the cached index files.
In this setup, the index text file are written into the music directory.
Since they have the same name as the audio files, they simply overwrite
the songs.
If you search for songs in MusicIndex, all your audio files will be
overwritten since they are indexed when searching.
The cache write error is listed in /var/log/apache2/error.log:
[Tue Feb 02 15:43:53 2010] [error] [client 192.168.0.5] [musicindex]
(file_make_cache_entry) Permission denied., referer: [...]
I did not notice any other error message.
Obviously my setup was wrong, however I think that index data should not
be written into music folders when the cache folder is not writable as
it can result in a massive data loss.
-- System Information:
Debian Release: 5.0.4
APT prefers stable
APT policy: (500, 'stable')
Architecture: i386 (i686)
Kernel: Linux 2.6.26.2010-01-31
Locale: LANG=fr_FR.UTF-8, LC_CTYPE=fr_FR.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/bash
Versions of packages libapache2-mod-musicindex depends on:
ii apache2.2-common 2.2.9-10+lenny6 Apache HTTP Server common files
ii libapr1 1.2.12-5+lenny1 The Apache Portable Runtime Librar
ii libarchive1 2.4.17-2 Single library to read/write tar,
ii libc6 2.7-18lenny2 GNU C Library: Shared libraries
ii libflac8 1.2.1-1.2 Free Lossless Audio Codec - runtim
ii libid3tag0 0.15.1b-10 ID3 tag reading library from the M
ii libmad0 0.15.1b-4 MPEG audio decoder library
ii libvorbis0a 1.2.0.dfsg-3.1+lenny1 The Vorbis General Audio Compressi
ii libvorbisfile3 1.2.0.dfsg-3.1+lenny1 The Vorbis General Audio Compressi
ii mod-musicindex-com 1.2.2-3 Common files for mod-musicindex
libapache2-mod-musicindex recommends no packages.
libapache2-mod-musicindex suggests no packages.
-- no debconf information
--- End Message ---
--- Begin Message ---
Source: libapache-mod-musicindex
Source-Version: 1.3.1-1
We believe that the bug you reported is fixed in the latest version of
libapache-mod-musicindex, which is due to be installed in the Debian FTP
archive:
libapache-mod-musicindex_1.3.1-1.diff.gz
to main/liba/libapache-mod-musicindex/libapache-mod-musicindex_1.3.1-1.diff.gz
libapache-mod-musicindex_1.3.1-1.dsc
to main/liba/libapache-mod-musicindex/libapache-mod-musicindex_1.3.1-1.dsc
libapache-mod-musicindex_1.3.1.orig.tar.gz
to
main/liba/libapache-mod-musicindex/libapache-mod-musicindex_1.3.1.orig.tar.gz
libapache2-mod-musicindex_1.3.1-1_amd64.deb
to
main/liba/libapache-mod-musicindex/libapache2-mod-musicindex_1.3.1-1_amd64.deb
mod-musicindex-common_1.3.1-1_all.deb
to main/liba/libapache-mod-musicindex/mod-musicindex-common_1.3.1-1_all.deb
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Thibaut VARENE <[email protected]> (supplier of updated
libapache-mod-musicindex package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Format: 1.8
Date: Mon, 15 Feb 2010 12:46:07 +0100
Source: libapache-mod-musicindex
Binary: libapache2-mod-musicindex mod-musicindex-common
Architecture: source amd64 all
Version: 1.3.1-1
Distribution: unstable
Urgency: medium
Maintainer: Thibaut VARENE <[email protected]>
Changed-By: Thibaut VARENE <[email protected]>
Description:
libapache2-mod-musicindex - Browse, stream, download and search through
MP3/Ogg/FLAC files
mod-musicindex-common - Common files for mod-musicindex
Closes: 568118
Changes:
libapache-mod-musicindex (1.3.1-1) unstable; urgency=medium
.
* Fix missing checks in flat file cache (Closes: #568118)
* Fix mysql cache's directory recording logic
Checksums-Sha1:
d4cb21edfe58e0f9340da649d9dcf86774bd5d32 1236
libapache-mod-musicindex_1.3.1-1.dsc
8cd3b9871408779db58bf638606ee1bf3313ba2e 480111
libapache-mod-musicindex_1.3.1.orig.tar.gz
971e16121b3390ebaaa239e93d235590a145570f 8673
libapache-mod-musicindex_1.3.1-1.diff.gz
622f45431e862fd71a975705854c6faf0469cbcb 37840
libapache2-mod-musicindex_1.3.1-1_amd64.deb
aee50738620406ea1cc08b87888adb4984d783c3 38620
mod-musicindex-common_1.3.1-1_all.deb
Checksums-Sha256:
a85601da3b94cfc3739708200336b017db3a7b770bc78ccfc2f057c16e423628 1236
libapache-mod-musicindex_1.3.1-1.dsc
37c149da02dcfe425889bfde8338b3aba385e2adc6941749f921698b24b0d95b 480111
libapache-mod-musicindex_1.3.1.orig.tar.gz
f04e4e4394fc0e86e991f0d397db3c558d02b0037b751ccb69ba5a70d70b64c6 8673
libapache-mod-musicindex_1.3.1-1.diff.gz
75063a64d8662f679c3cffc7f18c5a62757c2d8e45c2b57e8d47c18229c2cb08 37840
libapache2-mod-musicindex_1.3.1-1_amd64.deb
537baf7bdaaca95db7e81bfb7be06ddf598e4f528f7eaac4f9d4811106e24bdf 38620
mod-musicindex-common_1.3.1-1_all.deb
Files:
3bb123f1d5bd6a82be0ec4101d8f2dee 1236 httpd optional
libapache-mod-musicindex_1.3.1-1.dsc
3b3adc78a89f5371af85964d3626018b 480111 httpd optional
libapache-mod-musicindex_1.3.1.orig.tar.gz
488ea99eede0bc1d8fec529cd8e9c0b9 8673 httpd optional
libapache-mod-musicindex_1.3.1-1.diff.gz
1d51ae22197d8d186427d4b6059f9aff 37840 httpd optional
libapache2-mod-musicindex_1.3.1-1_amd64.deb
25f8ead907faf24572b29e1aa3de1546 38620 httpd optional
mod-musicindex-common_1.3.1-1_all.deb
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
iEYEARECAAYFAkt5PmAACgkQHjLD2rfS8GPbuwCfdjMUxxgj25nCwzC7LLIyJ0Q4
YTUAn3lu+faOQZbREyd2e/QgSKRbBZ95
=vYEE
-----END PGP SIGNATURE-----
--- End Message ---
