[Slim-Checkins] r33873 - in /7.7/trunk/server: Changelog7.html HTML/EN/html/SqueezeJS/Base.js

Author: mherger
Date: Tue Mar  6 07:24:17 2012
New Revision: 33873

URL: http://svn.slimdevices.com/slim?rev=33873&view=rev
Log:
Fixed Bug: 17858
Description: not all absolute URLs are publicly available. Don't use imageproxy for local addresses.

Modified:
    7.7/trunk/server/Changelog7.html
    7.7/trunk/server/HTML/EN/html/SqueezeJS/Base.js

Modified: 7.7/trunk/server/Changelog7.html
URL: http://svn.slimdevices.com/slim/7.7/trunk/server/Changelog7.html?rev=33873&r1=33872&r2=33873&view=diff
==============================================================================
--- 7.7/trunk/server/Changelog7.html (original)
+++ 7.7/trunk/server/Changelog7.html Tue Mar  6 07:24:17 2012
@@ -18,6 +18,7 @@
 		<li><a href="http://bugs.slimdevices.com/show_bug.cgi?id=17841">#17841</a> - directory traversal vulnerability in the web UI code</li>
 		<li><a href="http://bugs.slimdevices.com/show_bug.cgi?id=17852">#17852</a> - Support for new ReadyNAS Duo and NV+ V2 devices</li>
 		<li><a href="http://bugs.slimdevices.com/show_bug.cgi?id=17855">#17855</a> - Only enable single output channel mode if actively synced</li>
+		<li><a href="http://bugs.slimdevices.com/show_bug.cgi?id=17858">#17858</a> - Web UI shows red X instead of artwork for absolute URL in private network</li>
 		<li><a href="http://bugs.slimdevices.com/show_bug.cgi?id=17876">#17876</a> - Unnecessary items in context menu for current-playlist tracks</li>
 		<li><a href="http://bugs.slimdevices.com/show_bug.cgi?id=17877">#17877</a> - Resume after underrun broken for synchronized (ip3k) players</li>
 		<li><a href="http://bugs.slimdevices.com/show_bug.cgi?id=17881">#17881</a> - BMF scan corrupts dB replacing title with file name</li>

Modified: 7.7/trunk/server/HTML/EN/html/SqueezeJS/Base.js
URL: http://svn.slimdevices.com/slim/7.7/trunk/server/HTML/EN/html/SqueezeJS/Base.js?rev=33873&r1=33872&r2=33873&view=diff
==============================================================================
--- 7.7/trunk/server/HTML/EN/html/SqueezeJS/Base.js (original)
+++ 7.7/trunk/server/HTML/EN/html/SqueezeJS/Base.js Tue Mar  6 07:24:17 2012
@@ -759,8 +759,21 @@
 			if (result.playlist_loop[0].artwork_url) {
 				coverart = result.playlist_loop[0].artwork_url;
 
+				var publicURL = (coverart.search(/^http:/) != -1);
+				
+				if (publicURL) {
+					var parts = coverart.match(/^http:\/\/(.+)/);
+					
+					// don't use image proxy when dealing with private IP addresses
+					if (parts && parts[1].match(/^\d+/) && (
+						parts[1].match(/^192\.168/) || parts[1].match(/^172\.16\./) || parts[1].match(/^10\./)
+					)) {
+						publicURL = false;
+					}
+				}
+				
 				// SqueezeJS.externalImageProxy must be a template accepting url and size values
-				if (coverart && width && SqueezeJS.externalImageProxy && coverart.search(/^http:/) != -1) {
+				if (coverart && width && SqueezeJS.externalImageProxy && publicURL) {
 					coverart = SqueezeJS.externalImageProxy.apply({
 						url: encodeURIComponent(coverart),
 						size: width
@@ -768,7 +781,7 @@
 				}
 
 				// some internal logos come without resizing parameters - add them here if size is defined
-				else if (coverart && width && coverart.search(/^http:/) == -1) {
+				else if (coverart && width && !publicURL) {
 					coverart = coverart.replace(/(icon)(\.\w+)$/, "$1_" + width + 'x' + width + "_p$2");
 				}
 			}