Ampache is a web based audio/video streaming application and file manager. Prior to version 6.6.0, the Democratic Playlist Name is vulnerable to a stored cross-site scripting. Version 6.6.0 fixes this issue.
Ampache is a web based audio/video streaming application and file manager. Ampache has multiple reflective XSS vulnerabilities,this means that all forms in the Ampache that use `rule` as a variable are not secure. For example, when querying a song, when querying a podcast, we need to use `$rule` variable. This vulnerability is fixed in 6.3.1
Ampache, a web based audio/video streaming application and file manager, has a stored cross-site scripting (XSS) vulnerability in versions prior to 6.6.0. This vulnerability exists in the "Playlists - Democratic - Configure Democratic Playlist" feature. An attacker with Content Manager permissions can set the Name field to `<svg onload=alert(8)>`. When any …
ampache is a web based audio/video streaming application and file manager. A CSRF attack can be performed in order to delete objects (Playlist, smartlist etc.). Cross-Site Request Forgery (CSRF) is an attack that forces authenticated users to submit a request to a Web application against which they are currently authenticated. This vulnerability can be expl…
Ampache is a web based audio/video streaming application and file manager. Stored Cross Site Scripting (XSS) vulnerability in ampache before v6.3.1 allows a remote attacker to execute code via a crafted payload to serval parameters in the post request of /preferences.php?action=admin_update_preferences. This vulnerability is fixed in 6.3.1.
VuXML only (0) · listed, port not fixed yet
None. pkg audit reports nothing for this version.
Fixed (0)
No VuXML entries for this package.
Commits (48)
Baptiste Daroussin (bapt) · 5.6.0_1
MAN?PREFIX: eleminate its usage and move man to share/man
audio/ampache: Update to 5.6.0
Fix the .htaccess issues with newer Apache-- see patchfile. Submitted
upstream as pull request 3526
https://github.com/ampache/ampache/pull/3526
Changelog: https://github.com/ampache/ampache/blob/develop/docs/CHANGELOG.md
*/*: Remove merged or non-existent USE_PHP directives
- Remove USE_PHP=hash which is available in default php installation of
all versions of php
* security/pear-Horde_Crypt_Blowfish: Remove OPTION MHASH
- Remove USE_PHP=json which is available in default php installation of
all versions of php
* devel/pear-PHPTAL: Remove OPTION JSON
* www/ilias: Remove OPTION SCORM2004
- Remove USE_PHP=mssql which is no longer available in php from php80
and later and has been replaced with sqlsrv module which is Windows
only
* www/codeigniter: Remove OPTION MSSQL
* www/moodle311: Remove OPTION MSSQL
* www/moodle39: Remove OPTION MSSQL
* www/moodle40: Remove OPTION MSSQL
* www/moodle41: Remove OPTION MSSQL
- Remove USE_PHP=openssl which is available in default php installation
of all versions of php
* databases/phpmyadmin: Remove OPTION OPENSSL
* databases/phpmyadmin5: Remove OPTION OPENSSL
* security/pear-Horde_Crypt_Blowfish: Remove OPTION OPENSSL
* www/nextcloud: Remove OPTION SSL
* www/owncloud: Remove OPTION SSL
- Remove USE_PHP=pcre which is available in default php installation of
all versions of php
* sysutils/racktables: Remove OPTION PCRE
- Remove USE_PHP=postgresql which should be USE_PHP=pgsql and update
following ports
* www/typo3-11
* www/typo3-12
- Remove USE_PHP=pdf which is no longer available as php module
* databases/phpmyadmin: Remove OPTION PDF
- Remove USE_PHP=spl which is available in default php installation of
all versions of php
- Remove USE_PHP=sqlsrv which was never imported into FreeBSD as that is
Windows only php module
* www/typo3-11: Remove OPTION SQLSRV
* www/typo3-12: Remove OPTION SQLSRV
- Bump where DEFAULT OPTIONS are affected
Sponsored by: Bounce Experts
Approved by: portmgr(blanket)
audio/ampache: Update to 5.5.7
Keep the original mime and bitrate on song objects instead of the
transcoded value
Spotify art collector (AGAIN)
get_now_playing has_access check
Malformed HTML for regular users in preferences sidebar
Missing translation on preferences sidebar
Default catalog_filter group could be missing on a new install
Gather genre tags when not an array
Display webp images
Check for a valid image extensions when uploading art
Templates for squashed branch with a default path
Many other fixes, see https://github.com/ampache/ampache/releases
audio/ampache: Update to 5.5.1
Many improvements, including API additions and search fixes.
Database update needed but should be fairly seamless-- just go to
sign in and it'll do these for you.
PR: ports/263089
Remove WWW entries moved into port Makefiles
Commit b7f05445c00f has added WWW entries to port Makefiles based on
WWW: lines in pkg-descr files.
This commit removes the WWW: lines of moved-over URLs from these
pkg-descr files.
Approved by: portmgr (tcberner)
Add WWW entries to port Makefiles
It has been common practice to have one or more URLs at the end of the
ports' pkg-descr files, one per line and prefixed with "WWW:". These
URLs should point at a project website or other relevant resources.
Access to these URLs required processing of the pkg-descr files, and
they have often become stale over time. If more than one such URL was
present in a pkg-descr file, only the first one was tarnsfered into
the port INDEX, but for many ports only the last line did contain the
port specific URL to further information.
There have been several proposals to make a project URL available as
a macro in the ports' Makefiles, over time.
This commit implements such a proposal and moves one of the WWW: entries
of each pkg-descr file into the respective port's Makefile. A heuristic
attempts to identify the most relevant URL in case there is more than
one WWW: entry in some pkg-descr file. URLs that are not moved into the
Makefile are prefixed with "See also:" instead of "WWW:" in the pkg-descr
files in order to preserve them.
There are 1256 ports that had no WWW: entries in pkg-descr files. These
ports will not be touched in this commit.
The portlint port has been adjusted to expect a WWW entry in each port
Makefile, and to flag any remaining "WWW:" lines in pkg-descr files as
deprecated.
Approved by: portmgr (tcberner)
Fix CONFLICTS entries in archivers, astro, audio
Fix conflicts entries based on a script that searches for duplicate
files installed by several ports.
Some patters seem to make ports conflict with themselves, but this is
actually not the case due to the check-*-conflicts logic implemented
in bsd.port.mk, which excludes self-conflicts.
PHP based ports have been ignored in this commit as requested by the
committers currently working on the php-8.1 import.
Approved by: portmgr (implicit)
audio/ampache: Update to 5.0.0
Huge numbers of features added and several changes-- please refer to
UPDATING for required actions.
Release notes: https://github.com/ampache/ampache/releases/tag/5.0.0
audio/ampache: pkg-plist fix
Solve the problem of root owned directories correctly
No need for PORTREVISION bump as the change does not
make a significant difference to the result.
audio/ampache: Resurrect and update to 4.3.0
Delighted that this has a new upstream maintainer!
Huge numbers of changes since it was taken over last
year, so definitely worth another look.
http://ampache.org/
Remove expired ports: 2015-11-26 audio/pecl-id3: Broken for more than 6 months 2015-11-26 dns/geta: Broken for more than 6 months 2015-11-26 finance/openerp-web: Broken for more than 6 months 2015-11-26 devel/py-async: Further using of this module is not encouraged by upstream 2015-11-26 chinese/kon2: Depends on expiring chinese/cce 2015-11-26 games/linux-skulltag: Depends on expiring audio/linux-
Remove indefinite articles and trailing periods from COMMENT, plus minor COMMENT typos and surrounding whitespace fixes. Categories A-C.
CR: D196
Approved by: portmgr (bapt)
According to the Porter's Handbook (5.12.2.3.) default options must be added to OPTIONS_DEFINE. This policy has been implemented only recently that's why we have many ports violating this policy.
This patch adds the default options specified in the Porter's Handbook to
OPTIONS_DEFINE where they are being used. Ports maintained by
gnome@FreeBSD.org, kde@FreeBSD.org and x11@FreeBSD.org have been excluded.
Approved by: portmgr (bapt)
Bump portrevision due to upgrade of devel/gettext.
The affected ports are the ones with gettext as a run-dependency
according to ports/INDEX-7 (5007 of them) and the ones with USE_GETTEXT
in Makefile (29 of them).
PR: ports/124340
Submitted by: edwin@
Approved by: portmgr (pav)
Ampache is a Web-based Audio file manager. It is implemented with MySQL, and PHP. It allows you to view, edit, and play your audio files via the web. It has support for playlists, artist and album views, album art, random play, playback via Http/On the Fly Transcoding and Downsampling, Vote based playback, Mpd and Icecast, Integrated Flash Player, as well as per user themes and song play tracking.
WWW: http://ampache.org/
PR: ports/119093
Submitted by: Philippe Audeoud <jadawin at tuxaco.net>