Package: libapache2-mod-musicindex Version: 1.2.2-3 Severity: normal
I was bitten by this bug yesterday, and I replicated it successfully today: Setup : - The Apache process (eg. www-data) has write access to your audio files. Obviously this is not a good idea, but it can happen for instance if the files are on a NTFS partition mounted with ntfs-3g (full access to all files and directories are granted by default to all system users unless you restrict access with uid, gid and *mask options). - The Apache process does *not* have write access to the musicindex cache directory (for instance because of a typo in the MusicIndexCache line). Now start apache2 and access the MusicIndex page. Browse to an album page. You just need to reload the page (hit Reload in Firefox). The song list entries disappear from the page, because your audio files have just been overwritten by the cached index files. In this setup, the index text file are written into the music directory. Since they have the same name as the audio files, they simply overwrite the songs. If you search for songs in MusicIndex, all your audio files will be overwritten since they are indexed when searching. The cache write error is listed in /var/log/apache2/error.log: [Tue Feb 02 15:43:53 2010] [error] [client 192.168.0.5] [musicindex] (file_make_cache_entry) Permission denied., referer: [...] I did not notice any other error message. Obviously my setup was wrong, however I think that index data should not be written into music folders when the cache folder is not writable as it can result in a massive data loss. -- System Information: Debian Release: 5.0.4 APT prefers stable APT policy: (500, 'stable') Architecture: i386 (i686) Kernel: Linux 2.6.26.2010-01-31 Locale: LANG=fr_FR.UTF-8, LC_CTYPE=fr_FR.UTF-8 (charmap=UTF-8) Shell: /bin/sh linked to /bin/bash Versions of packages libapache2-mod-musicindex depends on: ii apache2.2-common 2.2.9-10+lenny6 Apache HTTP Server common files ii libapr1 1.2.12-5+lenny1 The Apache Portable Runtime Librar ii libarchive1 2.4.17-2 Single library to read/write tar, ii libc6 2.7-18lenny2 GNU C Library: Shared libraries ii libflac8 1.2.1-1.2 Free Lossless Audio Codec - runtim ii libid3tag0 0.15.1b-10 ID3 tag reading library from the M ii libmad0 0.15.1b-4 MPEG audio decoder library ii libvorbis0a 1.2.0.dfsg-3.1+lenny1 The Vorbis General Audio Compressi ii libvorbisfile3 1.2.0.dfsg-3.1+lenny1 The Vorbis General Audio Compressi ii mod-musicindex-com 1.2.2-3 Common files for mod-musicindex libapache2-mod-musicindex recommends no packages. libapache2-mod-musicindex suggests no packages. -- no debconf information -- To UNSUBSCRIBE, email to [email protected] with a subject of "unsubscribe". Trouble? Contact [email protected]
