spalencsar/bearwave
1
0
Fork 0
mirror of https://github.com/spalencsar/bearwave.git synced 2026-07-07 06:34:16 +02:00
Code Issues Packages Projects Releases Wiki Activity

release: 1.0.4 security hardening and stability fixes

Browse Source 
Validate manual stream URLs (http/https only), restrict notification
cover downloads to HTTPS, and add transfer timeouts for metadata and
cover fetches. Document playback, tray, MPRIS, and QML refactor changes
in CHANGELOG and AppStream metadata.
This commit is contained in:
Sebastian Palencsar
2026-06-20 14:31:13 +02:00
parent cbd82e5ab1
commit 74cabebc4b
9 changed files with 91 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
src/notificationmanager.cpp
View File

@@ -123,6 +123,11 @@ void NotificationManager::onTrackInfoChanged()
void NotificationManager::downloadCover(const QString &url)
{
if (!url.startsWith(QLatin1String("https://"))) {
qDebug() << "Skipping cover download for non-HTTPS URL";
return;
}
if (m_currentReply) {
QNetworkReply *reply = m_currentReply;
m_currentReply = nullptr;
@@ -133,6 +138,7 @@ void NotificationManager::downloadCover(const QString &url)
m_pendingCoverUrl = url;
QNetworkRequest request(url);
request.setTransferTimeout(10000);
m_currentReply = m_networkManager->get(request);
connect(m_currentReply, &QNetworkReply::finished, this, &NotificationManager::onDownloadFinished);
}