From 866e0e1670f79653203a3da65096841ab37fc903 Mon Sep 17 00:00:00 2001 From: wm4 Date: Sun, 31 Aug 2014 19:49:39 +0200 Subject: player: always load playlists Until now, you had to use --load-unsafe-playlists or --playlist to get playlists loaded. Change this and always load playlists by default. This still attempts to reject unsafe URLs. For example, trying to invoke libavdevice pseudo-demuxer is explicitly prevented. Local paths and any http links (and some more) are always allowed. --- stream/stream_lavf.c | 20 +++++++++++++++++--- 1 file changed, 17 insertions(+), 3 deletions(-) (limited to 'stream/stream_lavf.c') diff --git a/stream/stream_lavf.c b/stream/stream_lavf.c index 37c6adc51c..2270831b88 100644 --- a/stream/stream_lavf.c +++ b/stream/stream_lavf.c @@ -322,10 +322,24 @@ const stream_info_t stream_info_ffmpeg = { .name = "ffmpeg", .open = open_f, .protocols = (const char *const[]){ - "lavf", "ffmpeg", "rtmp", "rtsp", "http", "https", "mms", "mmst", "mmsh", - "mmshttp", "udp", "ftp", "rtp", "httpproxy", "hls", "rtmpe", "rtmps", - "rtmpt", "rtmpte", "rtmpts", "srtp", "tcp", "udp", "tls", "unix", "sftp", + "rtmp", "rtsp", "http", "https", "mms", "mmst", "mmsh", "mmshttp", "rtp", + "httpproxy", "hls", "rtmpe", "rtmps", "rtmpt", "rtmpte", "rtmpts", "srtp", "md5", NULL }, .can_write = true, + .is_safe = true, }; + +// Unlike above, this is not marked as safe, and can contain protocols which +// may do insecure things. (Such as "ffmpeg", which can access the "lavfi" +// pseudo-demuxer, which in turn gives access to filters that can access the +// local filesystem.) +const stream_info_t stream_info_ffmpeg_unsafe = { + .name = "ffmpeg", + .open = open_f, + .protocols = (const char *const[]){ + "lavf", "ffmpeg", "udp", "ftp", "tcp", "tls", "unix", "sftp", + NULL }, + .can_write = true, +}; + -- cgit v1.2.3