Thomas B. "dm8tbr" Ruecker 53e6ee7abb SECURITY FIX - Override supplementary groups ... In case of <changeowner> only UID and GID were changed, supplementary groups were left in place. This is a potential security issue only if <changeowner> is used. New behaviour is to set UID, GID and set supplementary groups based on the UID Even in case of icecast remaining in supplementary group 0 this "only" gives it things like access to files that are owned by group 0 and according to their umask. This is obviously bad, but not as bad as UID 0 with all its other special rights. It's a security issue and we fix immediately and recommend users to update. PS: Cherry picking this should be fine by distros for fixing older releases. svn path=/icecast/trunk/icecast/; revision=19137		2014-05-06 04:53:24 +00:00
..
avl	Replaced usage of sprintf() with snprintf(). Also exported size of key printer's buffer in avl/.	2013-01-16 12:02:14 +00:00
httpp	commited support for HTTP PUT, See #1812	2012-07-16 16:05:21 +00:00
log	corrected logic checking argument. Thanks to David Binderman for reporting	2013-07-04 12:31:17 +00:00
net	bug+fix reported on icecast-dev (Petr Pisar, 06/07/2009). poll implementation	2009-07-06 14:28:16 +00:00
thread	Add handlers for spinlocks if available, map to mutexes when not.	2009-01-09 03:18:03 +00:00
timing	minor cleanups.	2009-07-07 16:37:31 +00:00
admin.c	Send charset in headers for everything, excluding file-serv and streams.	2014-02-23 21:29:35 +00:00
admin.h	const updates, no functional changes	2007-08-16 22:49:13 +00:00
auth_htpasswd.c	removed \r at end of lines	2012-10-12 14:41:12 +00:00
auth_htpasswd.h	fix bug #1141	2007-08-23 16:58:18 +00:00
auth_url.c	Added support for a default mount. See #1914.	2013-04-02 18:46:44 +00:00
auth_url.h	return type was wrong, although it probably won't affect stability	2007-10-24 22:40:42 +00:00
auth.c	Added support for a default mount. See #1914.	2013-04-02 18:46:44 +00:00
auth.h	Allow source client authentication via auth handler. Here the URL handler can	2009-01-14 01:18:22 +00:00
cfgfile.c	Fix email address, my work email was fixed since.	2014-05-04 08:07:25 +00:00
cfgfile.h	Added support for a default mount. See #1914.	2013-04-02 18:46:44 +00:00
client.c	Send charset in headers for everything, excluding file-serv and streams.	2014-02-23 21:29:35 +00:00
client.h	send 100-continue-header if client requests it	2014-01-12 12:29:27 +00:00
compat.h	win32 updates. cleanup of the start and finish of the gui and service	2009-08-05 22:32:47 +00:00
configtest.c	Add Copyright notice to each source file, as requested by debian.	2004-01-29 01:02:12 +00:00
connection.c	send 100-continue-header if client requests it	2014-01-12 12:29:27 +00:00
connection.h	Allow source client authentication via auth handler. Here the URL handler can	2009-01-14 01:18:22 +00:00
event.c	merge work. mainly stats and some log message updates	2007-10-22 02:29:49 +00:00
event.h	Add Copyright notice to each source file, as requested by debian.	2004-01-29 01:02:12 +00:00
format_ebml.c	Add WebM support.	2012-06-13 21:24:23 +00:00
format_ebml.h	Clarify that only these specific files are GPLv2 or v3.	2012-05-24 18:32:06 +00:00
format_flac.c	memory leak when handling ogg flac, and make sure that moving listeners	2006-03-15 02:24:57 +00:00
format_flac.h	Add more Ogg codec handlers, there has not been that much testing on these	2005-05-07 11:01:35 +00:00
format_kate.c	Add Kate and Skeleton codecs to ogg handler. patch by ogg.k.ogg.k	2008-04-19 02:11:37 +00:00
format_kate.h	Add Kate and Skeleton codecs to ogg handler. patch by ogg.k.ogg.k	2008-04-19 02:11:37 +00:00
format_midi.c	Add more Ogg codec handlers, there has not been that much testing on these	2005-05-07 11:01:35 +00:00
format_midi.h	Add more Ogg codec handlers, there has not been that much testing on these	2005-05-07 11:01:35 +00:00
format_mp3.c	send Expires:-headers on all cache=0 requests, close #1870	2013-02-24 02:04:43 +00:00
format_mp3.h	explicitly flag up a metadata update after they have been set. Could of led to	2009-01-15 03:38:49 +00:00
format_ogg.c	fixed(?) a memory leak: lost headers of stream because of wrong ref counter in associated refbuf objects. I HATE refbuf.	2014-01-12 21:09:04 +00:00
format_ogg.h	merge extra checks. minor cleanup work	2005-08-07 14:50:59 +00:00
format_opus.c	Clarify that only these specific files are GPLv2 or v3.	2012-05-24 18:32:06 +00:00
format_opus.h	Clarify that only these specific files are GPLv2 or v3.	2012-05-24 18:32:06 +00:00
format_skeleton.c	Do not allow Skeleton from taking control over the sync marks. Karl's proposal for the Vorbis+Skeleton issue.	2008-11-23 23:31:36 +00:00
format_skeleton.h	Add Kate and Skeleton codecs to ogg handler. patch by ogg.k.ogg.k	2008-04-19 02:11:37 +00:00
format_speex.c	no functional/structural change but cleans up the annoying signed/unsigned pointer warnings	2007-10-04 16:48:38 +00:00
format_speex.h	Add more Ogg codec handlers, there has not been that much testing on these	2005-05-07 11:01:35 +00:00
format_theora.c	fix starting point problem with low bandwidth theroa streams. listener could	2008-09-09 02:18:22 +00:00
format_theora.h	merge multi ogg codec handling. Handle theora and/or vorbis. Place new	2004-12-07 21:06:26 +00:00
format_vorbis.c	explicitly flag up a metadata update after they have been set. Could of led to	2009-01-15 03:38:49 +00:00
format_vorbis.h	merge multi ogg codec handling. Handle theora and/or vorbis. Place new	2004-12-07 21:06:26 +00:00
format.c	Add warning when using generic handler for stream sent to Icecast.	2013-04-05 16:43:16 +00:00
format.h	Add David Richard's webm support patch.	2012-05-18 17:33:17 +00:00
fserve.c	Make some more vars local (static).	2012-10-10 22:48:15 +00:00
fserve.h	Allow rereading of the mime types file on xml reload. Also allow for specifying	2007-08-13 21:33:27 +00:00
global.c	Don't impose a limit on the number of listening sockets allowed in the xml	2007-10-16 01:53:06 +00:00
global.h	more sock_t cleanups, win32 should have less warnings now	2007-10-24 22:42:49 +00:00
logging.c	Throw away the reqbuf stuff as it was not well designed. Removing it and restoring usage of %H *fixes* #1942 not just workaround it with opening security holes. close #1942	2013-04-02 12:19:33 +00:00
logging.h	Handle http 302 response when a relay starts. The socket IO is isolated into a	2007-08-10 21:33:16 +00:00
main.c	SECURITY FIX - Override supplementary groups	2014-05-06 04:53:24 +00:00
Makefile.am	Add WebM support.	2012-06-13 21:24:23 +00:00
md5.c	minor cleanups	2004-11-20 02:16:59 +00:00
md5.h	minor cleanups	2004-11-20 02:16:59 +00:00
refbuf.c	fixed(?) a memory leak: lost headers of stream because of wrong ref counter in associated refbuf objects. I HATE refbuf.	2014-01-12 21:09:04 +00:00
refbuf.h	type cleanups. reduces memory usage on 64bit, no difference on 32bit. closes #780	2007-12-15 17:02:16 +00:00
sighandler.c	updated copyright notices.	2012-10-11 22:54:53 +00:00
sighandler.h	cleanup unused var schedule_config_reread.	2012-11-13 11:25:46 +00:00
slave.c	Added support for a default mount. See #1914.	2013-04-02 18:46:44 +00:00
slave.h	add optional bind setting to relays	2009-03-17 01:45:41 +00:00
source.c	Adding stream_start_iso8601, server_start_iso8601	2014-05-04 07:14:54 +00:00
source.h	race condition patch as submitted by lds and remi, slightly motified by me. closes #1810	2012-07-17 14:03:37 +00:00
stats.c	Adding stream_start_iso8601, server_start_iso8601	2014-05-04 07:14:54 +00:00
stats.h	Adding stream_start_iso8601, server_start_iso8601	2014-05-04 07:14:54 +00:00
TODO	added new lion at end of file so it does not mess up my console.	2012-07-17 14:50:44 +00:00
util.c	corrected Date:-header format to conform the standard (see RFC1123). Thanks to cato for reporting.	2013-11-06 01:01:31 +00:00
util.h	Send proper HTTP headers in responses to clients.	2012-07-17 23:55:09 +00:00
xslt.c	Send charset in headers for everything, excluding file-serv and streams.	2014-02-23 21:29:35 +00:00
xslt.h	Patch from gtgbr@gmx.net to fix (void) function prototypes, with some minor	2005-12-17 12:23:09 +00:00
yp.c	Added support for a default mount. See #1914.	2013-04-02 18:46:44 +00:00
yp.h	Patch from gtgbr@gmx.net to fix (void) function prototypes, with some minor	2005-12-17 12:23:09 +00:00