Local audio files? about mumbleradioplayer HOT 6 CLOSED

@SYZYGY-DEV333 Yes, it's quite easy to implement.
In this case, the path will be into the config file, and you will need to play it with the command !playfile file_name for example. Is that good for you ?

from mumbleradioplayer.

Feature added !

from mumbleradioplayer.

The current implementation has a path traversal bug. Since the parameter goes through unchecked, one can chain "../" to discover potentially existing media files and play them. Potential leakage of non-media files is prevented by FFMPEG returning an error.

Below is a patch, that fixes the bug by rejecting any parameter with a slash in it. This is not ideal, especially since one would also not allow any subdirectories to be accessed, but since those tend to get long anyway, it's a good thing to not make the user remember folder structures just to play a file.

diff --git a/mumbleRadioPlayer.py b/mumbleRadioPlayer.py
index 56717e2..6c59cda 100644
--- a/mumbleRadioPlayer.py
+++ b/mumbleRadioPlayer.py
@@ -78,6 +78,9 @@ class MumbleRadioPlayer:
                 self.play_stream(parameter)
 
             if command == self.config.get('command', 'play_file') and parameter:
+                if "/" in parameter:
+                    self.mumble.users[text.actor].send_message(self.config.get('strings', 'bad_file'))
+                    return
                 path = self.config.get('bot', 'music_folder') + parameter
                 if os.path.isfile(path):
                     self.launch_play_file(path)

from mumbleradioplayer.

Good point !

from mumbleradioplayer.

fixed in 4fb9bc2 , thank @LordYuuma
(not tested, I will have time next week)

from mumbleradioplayer.

Command !list added in 84e3b83 to improve the local audio file feature.

from mumbleradioplayer.