groove/audiobookshelf
1
0
Fork 0
mirror of https://github.com/advplyr/audiobookshelf.git synced 2026-07-17 14:51:55 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Restrict Library Paths

Browse source 
This patch introduces the new environment variable `MEDIA_BASE_PATH`
allowing to restrict the media paths that can be added to libraries and
therefore limiting which sections of the filesystem audiobookshelf will
scan and potentially serve to the web.

This means, you can, for example, specify that all media are in
`/audiobooks`, preventing users to access file system paths not starting
with this.

This also prevents things like users specifying `/` as a library path
which seems to be a good way for a denial of service attack right now.

The patch also adds the new environment variable to the example Docker
commands and docker-compose files, matching the media file specified in
those examples.
This commit is contained in:
Lars Kiesow 2022-11-25 22:36:41 +01:00
parent 6dec750d3e
commit 4a125276b3
No known key found for this signature in database
GPG key ID: 5DAFE8D9C823CE73
3 changed files with 18 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

3
server/Server.js
View file

@ -38,7 +38,7 @@ const TaskManager = require('./managers/TaskManager')
const EBookManager = require('./managers/EBookManager')
class Server {
constructor(SOURCE, PORT, HOST, UID, GID, CONFIG_PATH, METADATA_PATH, ROUTER_BASE_PATH) {
constructor(SOURCE, PORT, HOST, UID, GID, CONFIG_PATH, METADATA_PATH, ROUTER_BASE_PATH, MEDIA_BASE_PATH) {
this.Port = PORT
this.Host = HOST
global.Source = SOURCE
@ -48,6 +48,7 @@ class Server {
global.ConfigPath = fileUtils.filePathToPOSIX(Path.normalize(CONFIG_PATH))
global.MetadataPath = fileUtils.filePathToPOSIX(Path.normalize(METADATA_PATH))
global.RouterBasePath = ROUTER_BASE_PATH
global.MediaBasePath = MEDIA_BASE_PATH
if (!fs.pathExistsSync(global.ConfigPath)) {
fs.mkdirSync(global.ConfigPath)