mpv-remote-app icon indicating copy to clipboard operation
mpv-remote-app copied to clipboard

Setting unsafefilebrowsing=0 disables file browsing entirely

Open AgentConDier opened this issue 2 years ago • 0 comments

Issue description

When /api/v1/mpvinfo returns "unsafefilebrowsing":false, the browse button is disabled: grafik

Expected behavior

  • The browse button works, but only allows access to the configured filebrowserpaths

How to reproduce

  1. Set unsafefilebrowsing=0 and configure filebrowserpaths
  2. Attempt to browse

If I hack the server to lie about it's configuration and send "unsafefilebrowsing":true, the browse dialog actually works as expected: I am only able to browse drives configured in filebrowserpaths, and pressing .. displays an error message.

Code Snippet
// remoteServer.js
async function getMPVInfo() {
  let fake_settings = Object.assign({}, settings);
  fake_settings.unsafefilebrowsing = true;
  return {
    "ffmpeg-version": await handle(mpv.getProperty("ffmpeg-version"))
      .then((resp) => resp[0])
      .catch(() => null),
    "mpv-version": await handle(mpv.getProperty("mpv-version"))
      .then((resp) => resp[0])
      .catch(() => null),
    "libass-version": await handle(mpv.getProperty("libass-version"))
      .then((resp) => resp[0])
      .catch(() => null),
    mpvremoteConfig: fake_settings,
    mpvremoteVersion: version,
  };    
}

AgentConDier avatar Dec 17 '23 04:12 AgentConDier