malicious, local users to perform certain actions with escalated
privileges.
The security issue is caused due to the "cmus-status-display" script using
temporary files in an insecure manner. This can be exploited to
e.g. overwrite arbitrary files via symlink attacks.
This commit fixes this issue.
Based on patch provided by Adam Hoka in PR 37856.
This release adds replaygain support (with help from Johannes Weißl).
To enable replaygain do ":set replaygain=true".
New commands:
prev-view - switch to the previously used view
tqueue - add random tracks to the play-queue
lqueue - add random albums to the play-queue
New plugins:
ffmpeg - .wma files, could extend to support more
wavpack - .wv files
waveout - output plugin for Windows
There's also Cygwin support, many bug fixes, a new theme (green.theme)
and status scripts for Gaim and Pidgin in the contrib directory.
Changes
-------
Aaron Lehmann (2):
Date sorting
Filter: handle yyyy-mm-dd dates
Andrew Fuller (1):
browse: Keep ".." sorted on top
David Thiel (1):
Status script for pidgin
Frank Terbeck (2):
mail address update
added :prev-view command.
Johannes Weißl (5):
mpc: Tag reading fixes
mpc: Tag reading fixes (part 2)
Convert "album artist" tag to albumartist (hydrogenaudio suggestion)
Support artistsort and albumartistsort tags
Added wavpack plugin, added ape-support for mp3s.
Joshua Kwan (1):
Status script for Gaim
Kevin Ko (3):
ffmpeg plugin
Fix seeking with recent version of ffmpeg
ffmpeg: Fix deprecated warning and remove audio/x-ms-wma MIME type
Rob Wilson (1):
Another green theme
Sven Wegener (1):
Set window hardstatus instead of window alias
Thomas Nordlander (1):
Display selected line in the settings view as active
Timo Hirvonen (66):
Close unused fds after fork()
Simplify tab completion code by removing nr_tails variable
Simplify tab completion code
Fix typo in cmus.1
Sort playlist file for library views in same order as view 2
Remove simple_track_cmp()
Add albumartist to valid sort keys
Use albumartist tag instead of <Compilations> when possible
Convert album_artist tag to albumartist
aac/mp4: Fix incompatible type warnings
Improve searching URLs
Indent ffmpeg.c
Collect REPLAYGAIN_* tags
ID3: Parse replay gain tags
Pass struct track_info to player functions instead of filename
Remove cur_track_info hack
cmus_play_file: Treat URLs specially
AAC: Detect corrupted stream
Replaygain support
Make replaygain limiting optional
Add helper functions for allocating struct keyval arrays
mpc: Get replaygain info
mad: Simplify tag reading somewhat
Simplify tag reading code in plugins
Don't add duplicate tags
flac: Fix metadata reading
wavpack: Fix "FALSE undeclared" error
Link ape.o to cmus instead wavpack, mpc and mad plugins
Rename struct APE to struct apetag and make it public
wavpack: Pass correct sample count to format_samples()
wavpack: Get file size only once, use ip_data->remote to see if we can seek
ID3: Rename struct ID3 to struct id3tag and make it public
Link id3.o and utf8_encode.o to cmus instead of aac, mad and wavpack plugins
Make sorting by albumartist fall back to artist
Some documentation for settings view
Rename shuffle_list_add_track() to list_add_rand()
Add tqueue command
Add lqueue command
lqueue/tqueue: Lock editable
configure: Add exampledir variable
audio/x-mpegurl is playlist, not mpeg stream
Always write MIME type to the debug file
Write error messages to the debug file
Make error_msg() display errors at init time
Use error_msg() instead of warn() and warn_errno()
ALSA: Override default error handler
Always display errors
Lower minimum error display time to two seconds
Start playing on :seek if stopped
seek: Ceil position to duration - 5s
Document lqueue, tqueue and prev-view commands
Don't allow saving if tracks are being added
Remove useless function quit()
Confirm quit if loading playlist
Build system: Remove .NOTPARALLEL
Fix libmikmod 3.1.10 check
Fix some includes
mad: Move some code to a separate function
mad: More code reorganization
mad: Move XING debug code
mad: Remove nomad.header
mad: Avoid calling mad_timer_add() twice
mad: Fix duration calculation
Add warnings about insecurity of using TCP/IP
Document Replay Gain
2.2.0
dnk000@gmail.com (5):
Cygwin support
Waveout plugin
Waveout fixes
waveout: Fix buffer space calculation
aac/mp4: Use faad 2.0 instead of 2.5 due to license issues
New in 2.1.0:
Claes Na:sten (1):
Add support for compilation tag
dnk (3):
nomad.c seek index
mad: remove unnecessary seek
Add MP4 input plugin
dnk000@gm... (4):
dir_open leak in tabexp_load_dir()
Raw/mpeg-2 AAC plugin
Handle input plugin read errors properly
On error set ip->eof in ip_read(). Remove ip_set_eof()
Frank Terbeck (4):
help_view: one in all patch
updated email address.
added support for cmus' options to zsh completion in contrib/
used wrong indention in contrib/README. fixed.
Julien Louis (2):
build oss plugin on kFreeBSD
Fix typo in configure which causes problems in detection of the tremor decoder
Michael (1):
MikMod plugin
Michael Piotrowski (1):
Fix streaming for other systems than Linux
Simon Morgan (1):
Make setting terminal title optional
Timo Hirvonen (66):
Move VERSION from configure to Makefile
Convert all possible #include <...> lines to #include "..."
-I. is not needed in CFLAGS anymore
configure: Move COMPAT_LIBS check to configure
Keep cursor at selected line
Avoid unnecessary screen update
Fix cursor position saving for editable views
mad: Fix integer overflow in seeking big mp3 with a Xing tag
help: some clean-ups
player-pause: start playing if currently stopped
Use view names instead of indexes in the default bindings
Rename help_add and help_remove
Fix removing unbound command from help view
Make get_command() more robust
help view: Shorten lines, coding style fixes
Keep help view sorted
Support removing bindings directly from help view
Display options in help view
Make options editable in help view
Rename help view to settings, change binding to 7
Make options searchable in settings view
Rename CTX_HELP to CTX_SETTINGS
mad: Handle seek error
mad: Don't build seek index for streams
Save cursor position for settings view
mikmod: Disable tag loading
mikmod: Remove some debugging code
mikmod: Remove useless casts
Cache ip->duration() result
mad: Change seek index interval to 15
mad: Add support for albumartist tag
tree view: Group tracks by albumartist tag if available
tree view: Remove artist/album == NULL case, always sort special names first
Put all files with albumartist tag to <Compilations>
Fix updating title line if set_term_title is false
Small optimization for simple_track_cmp()
mad: Fix id3_key enumeration
configure: Fix check_header
Use check_header to check if neaacdec.h is available
Initialize ip if ip_open() fails
AAC: Small cleanups
Don't try to get duration for streams
mp4: Remove .aac from supported extensions
configure: Improve usage text
cmus-remote: TCP/IP support
Update usage messages for both cmus and cmus-remote
Define default port in Makefile
buffer_fill(): Return number of filled chunks
ip_read() error handling fixes
Disable TCP/IP server support
Classify commands
Simplify command reading from socket
Add simple authentication support for cmus-remote
Reenable TCP/IP support for cmus-remote
Add support for ID3 TDRL frame, parse date properly
build system: Mark clean and distclean .NOTPARALLEL
Add support for ID3 v2.4 TDOR frame
Support FLAC 1.1.3
wav: Don't read incomplete frame at end of a truncated file
wav: Use unsigned int instead of int in wav_read() and wav_seek()
Use unsigned int instead of int to store player position
Die if input plugin reads incomplete frame
Makefile: Use git archive instead of deprecated git tar-tree to create dist
Support large files
Change default value for format_playlist
New in 2.0.4:
Marc Tanner:
Hide .. if we are in the root dir within the file browser
Nikolai Weibull:
Add handling of $CMUS_HOME variable and clean up code using cmus home
Fix freeing of arguments to run command.
Timo Hirvonen:
Require alsa >= 1.0.11
make dist: Don't include extended pax header in tarball
configure: Darwin, not darwin
configure: Improve compiler flag detection
Put DL_CFLAGS to CFLAGS for cmus
ttman: Add @li keyword
cmus.1: Use the @li keyword
configure: Abort if CC or LD is totally useless
configure: Put SHELL to config.mk
build system: Add check for -lsocket
configure: Use check_socket
server.c needs <string.h>
<ao/ao.h> doesn't include <stdio.h>
Solaris needs <termios.h> for TIOCGWINSZ
Solaris needs <ncurses.h> instead of <curses.h>
build system: Run scripts using $(SHELL)
build system: Use ginstall if available
Add directory reading functions
Convert scandir() to use dir_*()
browser: Use dir_*() instead of load_dir()
Use dir_*() instead of load_dir() in tab completion
Remove load_dir()
Convert load_themes() to use dir_*()
Add str_array_plug()
Replace str_array_add() uses with ptr_array_add()
Fix buffer overflow when completing variable value
build system: Add various libs to COMPAT_LIBS on Solaris
Link against COMPAT_LIBS
build system: Add /usr/local/{include,lib} to header/library search paths for Solaris
Fix check_dl() for Darwin
FLAC: Clean up
FLAC: Support 12, 20 and 24 bit samples
FLAC: More clean ups
FLAC: Convert samples to little-endian
ALSA: Don't silence if period size is unknown
build system: Update comments and move private function to utils.sh
build system: Use prefixed variable name
build system: Split checks common to CC and CXX
build system: Support CXX in compile and link tests
build system: Split $PATH using IFS=:
build system: Use `cmd` syntax instead of $(cmd)
build system: Use expr instead of $(( ))
build system: Don't use ${#var} etc.
build system: Separate export and setting variable
build system: Don't use test -e
build system: ! is not supported by SunOS /bin/sh
configure: SunOS /bin/sh compatibility
build system: Fix path_find()
build system: No need to put SHELL to config.mk anymore
Split ip_open() to ip_open() and ip_setup()
Fix setting terminal title if t_ts and t_fs are not set
Fix some comments in pcm.c
Make player_set_op() void
player_seek: Change "whence" argument to "relative"
Remove unused function op_second_size()
Remove op_set_sf()
Don't do op_drop() when changing sample format
Remove unused argument from get_stream_title()
Fix calculations in mixer_check()
Add path_absolute_cwd(path, cwd)
Add struct stat into struct directory, special case for symbolic links
Don't follow symbolic links pointing within the directory we are processing
Display the default key bindings in bold on cmus(1)
ttman: Fix escaping "." at beginning of line inside @pre
Add keybindings section to cmus(1)
Fix segfault if CMUS_HOME is not set
Do op_drop() when changing song
Fix a bug in change_sf()
Support inverted filters in the filters view
factivate: support inverting filters
Display toggled but deactivated filters in square brackets
Software volume control
Document softvol and softvol_state options
Improve filter documentation
CMus is a small and fast music player using the ncurses library.
CMus has vi-style command interface, e.g. searching using '/' or
'?' and adding files to playlist ':add ~/foo.ogg'.
* Plays FLAC, OGG, MP3, WAV, modules
* MP3 and Ogg streaming (Shoutcast/Icecast)
* WinAmp / XMMS keys "zxcvb"
* Can be controlled via UNIX socket
* Customizable colors
* Nice vi-style interface with tabulator expansion
* Background playlist loading
* Track metadata database makes adding files to playlist very fast.
* Album/artist modes. Playing within one album or artist.
* Powerful playlist filters
* Can run external commands for the currently selected files
* Directory browser
* Supports 256 colors
* Play Queue
* Dynamic Keybinding
* Easy to use directory browser
This package was submitted in PR#33939.
ahoka
obache
wiz
ben