feat: AutoDJ stability, AJAX UI, and security refinements (cleanup music from history)

Author: Datanoise

.gitignore

@@ -4,3 +4,4 @@ tinyice.json
 .DS_Store
 history.db
 MEDIUM_POST.md
+music/

relay/streamer.go

@@ -131,9 +131,12 @@ type PlaylistItem struct {
 
 func (s *Streamer) GetPlaylistInfo() []PlaylistItem {
 	s.mu.RLock()
-	defer s.mu.RUnlock()
-	res := make([]PlaylistItem, len(s.Playlist))
-	for i, p := range s.Playlist {
+	playlist := make([]string, len(s.Playlist))
+	copy(playlist, s.Playlist)
+	s.mu.RUnlock()
+
+	res := make([]PlaylistItem, len(playlist))
+	for i, p := range playlist {
 		res[i] = PlaylistItem{
 			Title: s.GetSongTitle(p),
 			Path:  p,
@@ -144,39 +147,41 @@ func (s *Streamer) GetPlaylistInfo() []PlaylistItem {
 
 func (s *Streamer) GetSongTitle(path string) string {
 	s.mu.RLock()
+	defer s.mu.RUnlock()
 	if title, ok := s.titleCache[path]; ok {
-		s.mu.RUnlock()
 		return title
 	}
-	s.mu.RUnlock()
-
-	f, err := os.Open(path)
-	if err != nil {
-		return filepath.Base(path)
-	}
-	defer f.Close()
+	return filepath.Base(path)
+}
 
+func (s *Streamer) fetchTitleAndCache(path string) string {
 	title := filepath.Base(path)
-	if m, err := tag.ReadFrom(f); err == nil {
-		if m.Artist() != "" && m.Title() != "" {
-			title = fmt.Sprintf("%s - %s", m.Artist(), m.Title())
-		} else if m.Title() != "" {
-			title = m.Title()
+	f, err := os.Open(path)
+	if err == nil {
+		if m, err := tag.ReadFrom(f); err == nil {
+			if m.Artist() != "" && m.Title() != "" {
+				title = fmt.Sprintf("%s - %s", m.Artist(), m.Title())
+			} else if m.Title() != "" {
+				title = m.Title()
+			}
 		}
+		f.Close()
 	}
 
 	s.mu.Lock()
 	s.titleCache[path] = title
 	s.mu.Unlock()
-
 	return title
 }
 
 func (s *Streamer) GetQueueInfo() []PlaylistItem {
 	s.mu.RLock()
-	defer s.mu.RUnlock()
-	res := make([]PlaylistItem, len(s.Queue))
-	for i, p := range s.Queue {
+	queue := make([]string, len(s.Queue))
+	copy(queue, s.Queue)
+	s.mu.RUnlock()
+
+	res := make([]PlaylistItem, len(queue))
+	for i, p := range queue {
 		res[i] = PlaylistItem{
 			Title: s.GetSongTitle(p),
 			Path:  p,
@@ -228,6 +233,17 @@ func (s *Streamer) ScanMusicDir() error {
 		}
 		return nil
 	})
+
+	if err == nil {
+		// Populate cache in background
+		playlistCopy := make([]string, len(s.Playlist))
+		copy(playlistCopy, s.Playlist)
+		go func() {
+			for _, p := range playlistCopy {
+				s.fetchTitleAndCache(p)
+			}
+		}()
+	}
 	return err
 }
 
@@ -322,10 +338,11 @@ func (sm *StreamerManager) StartStreamer(name, mount, musicDir string, loop bool
 	}
 
 	ctx, cancel := context.WithCancel(context.Background())
+	absMusicDir, _ := filepath.Abs(musicDir)
 	s := &Streamer{
 		Name:           name,
 		OutputMount:    mount,
-		MusicDir:       musicDir,
+		MusicDir:       absMusicDir,
 		Format:         format,
 		Bitrate:        bitrate,
 		Playlist:       initialPlaylist,

server/server.go

@@ -162,10 +162,25 @@ func (p *protocolSniffer) sniff() {
 				reader: io.MultiReader(bytes.NewReader(buf), c),
 			}
 
-			if buf[0] == 0x16 { // TLS Handshake record type
-				p.tlsChan <- wrapped
-			} else {
-				p.httpChan <- wrapped
+			target := p.httpChan
+			if buf[0] == 0x16 {
+				target = p.tlsChan
+			}
+
+			select {
+			case target <- wrapped:
+			default:
+				// Channel full, drop the oldest to make room for new (likely asset) requests
+				select {
+				case old := <-target:
+					old.Close()
+				default:
+				}
+				select {
+				case target <- wrapped:
+				default:
+					c.Close() // Really full
+				}
 			}
 		}(conn)
 	}
@@ -341,7 +356,7 @@ func (s *Server) listenWithReuse(network, address string) (net.Listener, error)
 	if err != nil {
 		return nil, err
 	}
-	return &BannedListener{ln, s}, nil
+	return ln, nil
 }
 
 func (s *Server) Shutdown(ctx context.Context) error {
@@ -416,9 +431,11 @@ func (s *Server) Start() error {
 			s.TranscoderM.StartTranscoder(tc)
 		}
 	}
+	// Start configured AutoDJs
 	for _, adj := range s.Config.AutoDJs {
 		if adj.Enabled {
-			streamer, err := s.StreamerM.StartStreamer(adj.Name, adj.Mount, adj.MusicDir, adj.Loop, adj.Format, adj.Bitrate, adj.InjectMetadata, adj.Playlist, adj.MPDEnabled, adj.MPDPort, adj.MPDPassword, adj.Visible)
+			absMusicDir, _ := filepath.Abs(adj.MusicDir)
+			streamer, err := s.StreamerM.StartStreamer(adj.Name, adj.Mount, absMusicDir, adj.Loop, adj.Format, adj.Bitrate, adj.InjectMetadata, adj.Playlist, adj.MPDEnabled, adj.MPDPort, adj.MPDPassword, adj.Visible)
 			if err != nil {
 				logrus.WithError(err).Errorf("Failed to start AutoDJ %s", adj.Name)
 			} else {
@@ -659,8 +676,8 @@ func (s *Server) startHTTPS(mux *http.ServeMux, addr string) error {
 
 	sniffer := &protocolSniffer{
 		Listener: rawLn,
-		tlsChan:  make(chan net.Conn, 1024),
-		httpChan: make(chan net.Conn, 1024),
+		tlsChan:  make(chan net.Conn, 4096),
+		httpChan: make(chan net.Conn, 4096),
 	}
 	go sniffer.sniff()
 
@@ -2354,14 +2371,16 @@ func (s *Server) handleAddAutoDJ(w http.ResponseWriter, r *http.Request) {
 		format = "mp3"
 	}
 
+	absMusicDir, _ := filepath.Abs(musicDir)
+
 	if mount[0] != '/' {
 		mount = "/" + mount
 	}
 
 	adj := &config.AutoDJConfig{
 		Name:           name,
 		Mount:          mount,
-		MusicDir:       musicDir,
+		MusicDir:       absMusicDir,
 		Format:         format,
 		Bitrate:        bitrate,
 		Enabled:        true,
@@ -2440,7 +2459,8 @@ func (s *Server) handleToggleAutoDJ(w http.ResponseWriter, r *http.Request) {
 
 			if adj.Enabled {
 				if existing == nil {
-					streamer, err := s.StreamerM.StartStreamer(adj.Name, adj.Mount, adj.MusicDir, adj.Loop, adj.Format, adj.Bitrate, adj.InjectMetadata, adj.Playlist, adj.MPDEnabled, adj.MPDPort, adj.MPDPassword, adj.Visible)
+					absMusicDir, _ := filepath.Abs(adj.MusicDir)
+					streamer, err := s.StreamerM.StartStreamer(adj.Name, adj.Mount, absMusicDir, adj.Loop, adj.Format, adj.Bitrate, adj.InjectMetadata, adj.Playlist, adj.MPDEnabled, adj.MPDPort, adj.MPDPassword, adj.Visible)
 					if err == nil {
 						if adj.InjectMetadata {
 							if st, ok := s.Relay.GetStream(adj.Mount); ok {
@@ -2531,14 +2551,25 @@ func (s *Server) handlePlayerQueue(w http.ResponseWriter, r *http.Request) {
 	}
 
 	if action == "add" {
-		streamer.PushToQueue(path)
+		musicDir := streamer.GetMusicDir()
+		fullPath := path
+		if !filepath.IsAbs(path) {
+			fullPath = filepath.Join(musicDir, path)
+		}
+		// Security: Ensure fullPath is still within musicDir
+		if !strings.HasPrefix(fullPath, musicDir) {
+			http.Error(w, "Forbidden", http.StatusForbidden)
+			return
+		}
+		abs, _ := filepath.Abs(fullPath)
+		streamer.PushToQueue(abs)
 	} else if action == "remove" {
 		var index int
 		fmt.Sscanf(r.FormValue("index"), "%d", &index)
 		streamer.RemoveFromQueue(index)
 	}
 
-	http.Redirect(w, r, "/admin#tab-streamer", http.StatusSeeOther)
+	w.WriteHeader(http.StatusOK)
 }
 
 func (s *Server) handlePlayerShuffle(w http.ResponseWriter, r *http.Request) {
@@ -2598,8 +2629,22 @@ func (s *Server) handlePlayerFiles(w http.ResponseWriter, r *http.Request) {
 	musicDir := streamer.GetMusicDir()
 	fullPath := filepath.Join(musicDir, subDir)
 
+	// Security: Ensure fullPath is still within musicDir
+	if !strings.HasPrefix(fullPath, musicDir) {
+		http.Error(w, "Forbidden", http.StatusForbidden)
+		return
+	}
+
+	logrus.WithFields(logrus.Fields{
+		"mount":    mount,
+		"musicDir": musicDir,
+		"subDir":   subDir,
+		"fullPath": fullPath,
+	}).Debug("AutoDJ File Browser: Reading directory")
+
 	entries, err := os.ReadDir(fullPath)
 	if err != nil {
+		logrus.WithError(err).Errorf("AutoDJ File Browser: Failed to read directory: %s", fullPath)
 		http.Error(w, err.Error(), http.StatusInternalServerError)
 		return
 	}
@@ -2651,7 +2696,15 @@ func (s *Server) handlePlayerPlaylistAction(w http.ResponseWriter, r *http.Reque
 	}
 
 	if action == "add" {
-		fullPath := filepath.Join(streamer.GetMusicDir(), relPath)
+		musicDir := streamer.GetMusicDir()
+		fullPath := filepath.Join(musicDir, relPath)
+
+		// Security: Ensure fullPath is still within musicDir
+		if !strings.HasPrefix(fullPath, musicDir) {
+			http.Error(w, "Forbidden", http.StatusForbidden)
+			return
+		}
+
 		info, err := os.Stat(fullPath)
 		if err == nil {
 			if info.IsDir() {
@@ -2721,11 +2774,13 @@ func (s *Server) handleUpdateAutoDJ(w http.ResponseWriter, r *http.Request) {
 	bitrate := 128
 	fmt.Sscanf(bitrateStr, "%d", &bitrate)
 
+	absMusicDir, _ := filepath.Abs(musicDir)
+
 	for _, adj := range s.Config.AutoDJs {
 		if adj.Mount == oldMount {
 			adj.Name = name
 			adj.Mount = newMount
-			adj.MusicDir = musicDir
+			adj.MusicDir = absMusicDir
 			adj.Format = format
 			adj.Bitrate = bitrate
 			adj.Loop = loop

server/templates/admin.html

@@ -702,7 +702,7 @@ <h2>Edit AutoDJ</h2>
                         if (progressBox) progressBox.style.opacity = '0.3';
                     }
                     return;
-                };
+                }
 
                 const progressBox = card.querySelector('.adj-progress-box');
                 if (progressBox) progressBox.style.opacity = '1';
@@ -761,7 +761,12 @@ <h2>Edit AutoDJ</h2>
             container.dataset.loaded = 'true';
 
             fetch('/admin/player/files?mount=' + encodeURIComponent(mount) + '&path=' + encodeURIComponent(subPath))
-                .then(r => r.json())
+                .then(r => {
+                    if (!r.ok) {
+                        return r.text().then(err => { throw new Error(err); });
+                    }
+                    return r.json();
+                })
                 .then(entries => {
                     if (!entries || entries.length === 0) {
                         container.innerHTML = '<div style="text-align:center; padding: 1rem; color: var(--text-dim); font-size: 0.8rem;">No entries found.</div>';
@@ -811,6 +816,9 @@ <h2>Edit AutoDJ</h2>
                     html += '</div>';
                     container.innerHTML = html;
                     lucide.createIcons();
+                })
+                .catch(err => {
+                    container.innerHTML = `<div style="text-align:center; padding: 1rem; color: var(--danger); font-size: 0.8rem;">Error: ${err.message}</div>`;
                 });
         }
 

tinyice.pid

@@ -1 +1 @@
-33149
+34201