tags 568118 confirmed pending thanks Hi,
Thanks for the lengthy bugreport, it's very helpful. It's indeed a completely stupid bug in the code, it's identified. I'm pondering the most efficient way to fix it, and will release a new version of mod_musicindex ASAP. Thanks On Tue, Feb 2, 2010 at 4:19 PM, Alexandre Ratti <[email protected]> wrote: > Package: libapache2-mod-musicindex > Version: 1.2.2-3 > Severity: normal > > > I was bitten by this bug yesterday, and I replicated it successfully > today: > > Setup : > - The Apache process (eg. www-data) has write access to your audio > files. Obviously this is not a good idea, but it can happen for > instance if the files are on a NTFS partition mounted with ntfs-3g (full > access to all files and directories are granted by default to all system > users unless you restrict access with uid, gid and *mask options). > - The Apache process does *not* have write access to the musicindex > cache directory (for instance because of a typo in the MusicIndexCache line). > > Now start apache2 and access the MusicIndex page. Browse to an album > page. You just need to reload the page (hit Reload in Firefox). The song > list entries disappear from the page, because your audio files have just > been overwritten by the cached index files. > > In this setup, the index text file are written into the music directory. > Since they have the same name as the audio files, they simply overwrite > the songs. > > If you search for songs in MusicIndex, all your audio files will be > overwritten since they are indexed when searching. > > The cache write error is listed in /var/log/apache2/error.log: > > [Tue Feb 02 15:43:53 2010] [error] [client 192.168.0.5] [musicindex] > (file_make_cache_entry) Permission denied., referer: [...] > > I did not notice any other error message. > > Obviously my setup was wrong, however I think that index data should not > be written into music folders when the cache folder is not writable as > it can result in a massive data loss. > > > -- System Information: > Debian Release: 5.0.4 > APT prefers stable > APT policy: (500, 'stable') > Architecture: i386 (i686) > > Kernel: Linux 2.6.26.2010-01-31 > Locale: LANG=fr_FR.UTF-8, LC_CTYPE=fr_FR.UTF-8 (charmap=UTF-8) > Shell: /bin/sh linked to /bin/bash > > Versions of packages libapache2-mod-musicindex depends on: > ii apache2.2-common 2.2.9-10+lenny6 Apache HTTP Server common files > ii libapr1 1.2.12-5+lenny1 The Apache Portable Runtime > Librar > ii libarchive1 2.4.17-2 Single library to read/write tar, > ii libc6 2.7-18lenny2 GNU C Library: Shared libraries > ii libflac8 1.2.1-1.2 Free Lossless Audio Codec - > runtim > ii libid3tag0 0.15.1b-10 ID3 tag reading library from the > M > ii libmad0 0.15.1b-4 MPEG audio decoder library > ii libvorbis0a 1.2.0.dfsg-3.1+lenny1 The Vorbis General Audio > Compressi > ii libvorbisfile3 1.2.0.dfsg-3.1+lenny1 The Vorbis General Audio > Compressi > ii mod-musicindex-com 1.2.2-3 Common files for mod-musicindex > > libapache2-mod-musicindex recommends no packages. > > libapache2-mod-musicindex suggests no packages. > > -- no debconf information > > > -- Thibaut VARENE http://www.parisc-linux.org/~varenet/ -- To UNSUBSCRIBE, email to [email protected] with a subject of "unsubscribe". Trouble? Contact [email protected]
