[SOLVED] Albums play 'selectively' after upping to 9.0.7

[Tonewheelkev]

All good with 9.0.6 ....no problems viewing/playing from both folder/library views

Did in place update to 9.0.7....now...some albums fail to open....selecting clear/play does nothing....something definitely wrong here!

Here's startup log....I can see lots of 'Invalid characters detected' entries towards the bottom.....presume this is something to do with the problem?

20240815 121615 worker: --
20240815 121615 worker: -- Start moOde 9 series
20240815 121615 worker: --
20240815 121615 worker: Successfully daemonized
20240815 121615 worker: Wait for Linux startup
20240815 121621 worker: Linux startup complete
20240815 121621 worker: Boot config is ok
20240815 121622 worker: Session loaded
20240815 121622 worker: Package locks applied
20240815 121623 worker: File check complete
20240815 121623 worker: Debug logging off
20240815 121623 worker: --
20240815 121623 worker: -- System
20240815 121623 worker: --
20240815 121624 worker: Host name:     moode
20240815 121624 worker: RPi model:     Pi-4B 1.5 4GB
20240815 121624 worker: moOde release: 9.0.7 2024-08-13
20240815 121624 worker: RaspiOS:       12.6 Bookworm 64-bit
20240815 121624 worker: Linux Kernel:  6.6.31 64-bit
20240815 121624 worker: MPD version:   0.23.14
20240815 121624 worker: User id:       pi
20240815 121624 worker: Home folder:   /home/pi
20240815 121624 worker: Time zone:     Europe/London
20240815 121624 worker: Kbd layout:    gb
20240815 121624 worker: HDMI ports(s): on
20240815 121624 worker: HDMI-CEC:      off
20240815 121624 worker: Sys LED0:      on
20240815 121624 worker: Sys LED1:      on
20240815 121624 worker: Reduce power:  n/a
20240815 121624 worker: CPU governor:  ondemand
20240815 121624 worker: Integ audio:   vc4-kms-v3d
20240815 121624 worker: --
20240815 121624 worker: -- Network
20240815 121624 worker: --
20240815 121624 worker: Eth0
20240815 121624 worker: Ethernet: adapter exists
20240815 121624 worker: Ethernet: timeout off
20240815 121624 worker: Ethernet: method  dhcp
20240815 121624 worker: Ethernet: address 192.168.0.11
20240815 121624 worker: Ethernet: netmask 255.255.255.0
20240815 121624 worker: Ethernet: gateway 192.168.0.1
20240815 121624 worker: Ethernet: pri DNS 194.168.4.100
20240815 121624 worker: Ethernet: domain  none found
20240815 121624 worker: Wlan0
20240815 121624 worker: Wireless: adapter does not exist
20240815 121624 worker: --
20240815 121624 worker: -- File sharing
20240815 121624 worker: --
20240815 121626 worker: SMB file sharing:  on
20240815 121626 worker: NFS file sharing:  on
20240815 121626 worker: DLNA file sharing: off
20240815 121626 worker: --
20240815 121626 worker: -- Special configs
20240815 121626 worker: --
20240815 121626 worker: Plexamp:          not installed
20240815 121626 worker: RoonBridge:       not installed
20240815 121626 worker: Allo Piano 2.1:   not detected
20240815 121626 worker: Allo Boss 2:      not detected, OLED script ok
20240815 121626 worker: IQaudIO AMP*:     not detected
20240815 121626 worker: --
20240815 121626 worker: -- ALSA debug
20240815 121626 worker: --
20240815 121626 worker: Cards:  0:E30             1:vc4hdmi0        2:vc4hdmi1        3:empty           
20240815 121626 worker:         4:empty           5:empty           6:empty           7:empty           
20240815 121626 worker: Mixers: 0E30 )          1:none            2:none            3:none            
20240815 121626 worker:         4:none            5:none            6:none            7:none            
20240815 121626 worker: --
20240815 121626 worker: -- Audio configuration
20240815 121626 worker: --
20240815 121626 worker: Audio device:  0:E30
20240815 121626 worker: ALSA card:     has not been reassigned
20240815 121626 worker: MPD config:    update not needed
20240815 121626 worker: ALSA output:   USB
20240815 121626 worker: ALSA mode:     Default (plughw)
20240815 121626 worker: ALSA mixer     E30
20240815 121626 worker: ALSA volume:   91% (-11.00dB)
20240815 121626 worker: ALSA maxvol:   65%
20240815 121626 worker: ALSA loopback: off
20240815 121626 worker: MPD mixer      Software
20240815 121627 worker: Audio formats: S32_LE, SPECIAL, DSD_U32_BE
20240815 121627 worker: CamillaDSP:    off
20240815 121627 worker: CDSP volume:   0dB
20240815 121627 worker: CDSP volrange: 60dB
20240815 121627 worker: --
20240815 121627 worker: -- MPD startup
20240815 121627 worker: --
20240815 121627 worker: MPD service:        started
20240815 121627 worker: MPD port 6600:      accepting connections
20240815 121627 worker: MPD ALSA Default:   on
20240815 121627 worker: MPD ALSA Bluetooth: off
20240815 121627 worker: MPD HTTP Server:    off
20240815 121627 worker: MPD volume:         63
20240815 121627 worker: Saved MPD vol:      -1
20240815 121627 worker: Saved SRC vol:      0
20240815 121627 worker: MPD crossfade:      off
20240815 121627 worker: MPD ignore CUE:     no
20240815 121627 worker: MPD CDSP volsync:   off
20240815 121628 worker: --
20240815 121628 worker: -- Music sources
20240815 121628 worker: --
20240815 121628 worker: USB drive:      Crucial2TB (ntfs)
20240815 121628 worker: USB drive:      KEVC 128GB (ntfs)
20240815 121628 worker: USB drive:      Kingston1TB (ntfs)
20240815 121628 worker: USB drive:      Trans1TB (ntfs)
20240815 121628 worker: NVMe drives:    none
20240815 121628 worker: NAS sources:    none
20240815 121628 worker: --
20240815 121628 worker: -- Feature availability
20240815 121628 worker: --
20240815 121628 worker: Input select:    available, Source: MPD, Output: E30
20240815 121628 worker: Bluetooth:       available, PIN: None, ALSA/CDSP maxvol: 100%/0dB, ALSA outmode: Standard
20240815 121628 worker: AirPlay:         available
20240815 121628 worker: Spotify Connect: available
20240815 121628 worker: Squeezelite:     available
20240815 121628 worker: UPnP client:     available
20240815 121628 worker: Plexamp:         not installed, ALSA maxvol: 65%
20240815 121628 worker: RoonBridge:      not installed
20240815 121628 worker: Multiroom:       available
20240815 121628 worker: GPIO buttons:    available
20240815 121628 worker: HTTPS mode:      available
20240815 121628 worker: Stream recorder: n/a
20240815 121628 worker: --
20240815 121628 worker: -- Peripherals
20240815 121628 worker: --
20240815 121630 worker: Local display:   off
20240815 121630 worker: HDMI 4K 60Hz:    off
20240815 121630 worker: On-screen kbd:   off
20240815 121630 worker: Rotary encoder:  off
20240815 121630 worker: USB volume knob: off
20240815 121630 worker: LCD updater:     off
20240815 121630 worker: --
20240815 121630 worker: -- Miscellaneous
20240815 121630 worker: --
20240815 121630 worker: Software update:   Automatic check on
20240815 121630 worker: Software update:   Checking for available update...
20240815 121631 worker: Software update:   Software is up to date
20240815 121631 worker: Auto-CoverView:    off
20240815 121631 worker: CoverView timeout: Never
20240815 121631 worker: Auto-shuffle:      off
20240815 121631 worker: Auto-play:         off
20240815 121631 worker: Web SSH server:    on
20240815 121631 worker: Maintenance task:  360 mins
20240815 121631 worker: Current view:      reset to Playback
20240815 121631 worker: Active flags:      all false
20240815 121631 worker: Reset flags:       skipped
20240815 121631 worker: Session check:     ok
20240815 121631 worker: --
20240815 121631 worker: -- Startup complete
20240815 121631 worker: --
20240815 121631 worker: Mount monitor:    started
20240815 121631 worker: Radio monitor:    off
20240815 121631 worker: Watchdog monitor: started
20240815 121631 worker: Responsiveness:   Default
20240815 121631 worker: Ready
20240815 121703 worker: Job update_library
20240815 121703 mpdindex: Start
20240815 121704 mpdindex: Cmd (update)
20240815 121704 thumb-gen: Start
20240815 121704 thumb-gen: Scan opt: Default
20240815 121704 thumb-gen: Priority: Cover image file
20240815 121704 thumb-gen: Res,Qual: 600px,60
20240815 121704 thumb-gen: Px ratio: 3
20240815 121704 thumb-gen: Th width: 600
20240815 121704 thumb-gen: Thm qual: 60
20240815 121704 thumb-gen: Scanning: NAS, NVME, SDCARD, Crucial2TB, KEVC 128GB, Kingston1TB, Trans1TB
20240815 121726 thumb-gen: Done: 3373 folders scanned, 0 thumbs created, 3373 already in cache.
20240815 121737 mpdindex: Done: indexed 2763 artists, 3244 albums, 46254 songs
20240815 121737 worker: Job update_library done
20240815 121829 chkValue(): Invalid characters detected
20240815 121829 chkValue(): USB/Crucial2TB/Van Morrison/Van Morrison - It's Too Late To Stop Now
20240815 121833 chkValue(): Invalid characters detected
20240815 121833 chkValue(): USB/Crucial2TB/Van Morrison/Van Morrison - It's Too Late To Stop Now
20240815 121835 chkValue(): Invalid characters detected
20240815 121835 chkValue(): USB/Crucial2TB/Van Morrison/Van Morrison - Astral Weeks- Live At The Hollywood Bowl (2009) [24-48]
20240815 121840 chkValue(): Invalid characters detected
20240815 121840 chkValue(): USB/Crucial2TB/Van Morrison/Van Morrison - It's Too Late To Stop Now
20240815 121859 chkValue(): Invalid characters detected
20240815 121859 chkValue(): USB/Crucial2TB/Van Morrison/Van Morrison - It's Too Late To Stop Now
20240815 121920 clear_playqueue
20240815 121932 chkValue(): Invalid characters detected
20240815 121932 chkValue(): USB/Crucial2TB/Van Morrison/Van Morrison - It's Too Late To Stop Now
20240815 121935 chkValue(): Invalid characters detected
20240815 121935 chkValue(): USB/Crucial2TB/Van Morrison/Van Morrison - It's Too Late To Stop Now
20240815 121937 chkValue(): Invalid characters detected
20240815 121937 chkValue(): USB/Crucial2TB/Van Morrison/Van Morrison - It's Too Late To Stop Now
20240815 121957 chkValue(): Invalid characters detected
20240815 121957 chkValue(): USB/Crucial2TB/Van Morrison/Van Morrison - It's Too Late To Stop Now
20240815 122112 chkValue(): Invalid characters detected
20240815 122112 chkValue(): USB/Crucial2TB/Van Morrison/Van Morrison - Astral Weeks- Live At The Hollywood Bowl (2009) [24-48]
20240815 122113 chkValue(): Invalid characters detected
20240815 122113 chkValue(): USB/Crucial2TB/Van Morrison/Van Morrison - Astral Weeks- Live At The Hollywood Bowl (2009) [24-48]
20240815 122115 chkValue(): Invalid characters detected
20240815 122115 chkValue(): USB/Crucial2TB/Van Morrison/Van Morrison - Astral Weeks- Live At The Hollywood Bowl (2009) [24-48]
20240815 122125 chkValue(): Invalid characters detected
20240815 122125 chkValue(): USB/Crucial2TB/Van Morrison/Van Morrison - It's Too Late To Stop Now
20240815 122127 chkValue(): Invalid characters detected
20240815 122127 chkValue(): USB/Crucial2TB/Van Morrison/Van Morrison - It's Too Late To Stop Now
20240815 123215 chkValue(): Invalid characters detected
20240815 123215 chkValue(): USB/Crucial2TB/Van Morrison/Van Morrison - It's Too Late To Stop Now/Van Morrison - It's Too Late To Stop Now [CD 1] [1974].wv.iso [1].flac
20240815 123221 chkValue(): Invalid characters detected
20240815 123221 chkValue(): USB/Crucial2TB/Van Morrison/Van Morrison - It's Too Late To Stop Now/Van Morrison - It's Too Late To Stop Now [CD 1] [1974].wv.iso [1].flac
20240815 123559 clear_playqueue
20240815 123700 chkValue(): Invalid characters detected
20240815 123700 chkValue(): USB/Crucial2TB/Van Morrison/Van Morrison - It's Too Late To Stop Now/Van Morrison - It's Too Late To Stop Now [CD 1] [1974].wv.iso [1].flac
20240815 123719 chkValue(): Invalid characters detected
20240815 123719 chkValue(): USB/Crucial2TB/Van Morrison/Van Morrison - Live At The Grand Opera House Belfast (1984) [24-96]/01. Introduction- Into The Mystic (Instrumental) - Inarticulate Speech Of The Heart.flac
20240815 123726 chkValue(): Invalid characters detected
20240815 123726 chkValue(): USB/KEVC 128GB/Van Morrison - The Skiffle Sessions (2000) [24-96]/01. It Takes A Worried Man.flac
20240815 124342 chkValue(): Invalid characters detected
20240815 124342 chkValue(): USB/Crucial2TB/The Band - The Band (1969) [192-24]
20240815 124344 chkValue(): Invalid characters detected
20240815 124344 chkValue(): USB/Crucial2TB/The Band - The Band (1969) [192-24]
20240815 124345 chkValue(): Invalid characters detected
20240815 124345 chkValue(): USB/Crucial2TB/The Band - The Band (1969) [192-24]
20240815 124348 chkValue(): Invalid characters detected
20240815 124348 chkValue(): USB/Crucial2TB/The Band - The Band (1969) [192-24]
20240815 124411 chkValue(): Invalid characters detected
20240815 124411 chkValue(): USB/Crucial2TB/The Band - Music From Big Pink (1968) [24-96]
20240815 124441 chkValue(): Invalid characters detected
20240815 124441 chkValue(): USB/Crucial2TB/Black Sabbath - Paranoid [Deluxe Edition] (2016)
20240815 124443 chkValue(): Invalid characters detected
20240815 124443 chkValue(): USB/Crucial2TB/Black Sabbath - Paranoid [Deluxe Edition] (2016)
20240815 124446 chkValue(): Invalid characters detected
20240815 124446 chkValue(): USB/Crucial2TB/Black Sabbath - Paranoid [Deluxe Edition] (2016)
20240815 124603 chkValue(): Invalid characters detected
20240815 124603 chkValue(): USB/Crucial2TB/Van Morrison/Van Morrison - It's Too Late To Stop Now/Van Morrison - It's Too Late To Stop Now [CD 1] [1974].wv.iso [1].flac
20240815 124612 chkValue(): Invalid characters detected
20240815 124612 chkValue(): USB/Crucial2TB/Van Morrison/Van Morrison - It's Too Late To Stop Now/Van Morrison - It's Too Late To Stop Now [CD 1] [1974].wv.iso [1].flac

Any thoughts please??????????????

[Tim Curtis]

Its a bug in the new get/post security filter :-0

I'll provide a patch today.

[Tim Curtis]

Run this patch then reboot.

Code:

wget -q -O - https://moodeaudio.org/test/r907patch_secfilter.sh | sudo bash

[Tonewheelkev]

Run this patch then reboot.

Code:

wget -q -O - https://moodeaudio.org/test/r907patch_secfilter.sh | sudo bash

That worked....
Thanks again!

[aekingfisher]

I hit this security filter issue where an album would not play - a `double dot` in the filename of a track is blocked at;
www/inc/common.php#L105

[Tim Curtis]

Right. Whats the Album and full filename?

[aekingfisher]

Right. Whats the Album and full filename?

https://www.discogs.com/master/23336-Orbital-In-Sides

Track 2 has a dot at the end of its title!

[Tim Curtis]

What was the action you were trying to perform in the WebUI?

[aekingfisher]

Library > Album view > click circle with 3 dots on album > hit Play

Code:

POST /command/queue.php?cmd=play_group
{
 "path[]": [
   ...
   "02+P.E.T.R.O.L..mp3",
   ...
 ]
}

302 http status response - 'HTTP 400 Bad request'

[Nutul]

The test in the php file could, of course, be modified to fire the error only if the ".." represent actually a path traversal - that is, at the beginning of the path, followed by a "/", or checking the resulting expanded path - but this is not the point: I would suggest you name the file as 02-PETROL.mp3, and set the correct track number/artist/album/title in the metadata tag... moOde use those data to fill the library entries.
Also, using only standard ASCII, and no path-related symbols in the filename can also guarantee cross-OS compatibility.