Skip to content

v0.3.13 — - **Fixed: any authenticated user could load the admin panel HTML page** (, ) even without in their config. The route guard in only verified the JWT was valid (user logged in) but never checked the admin flag. Non-admin users are now redirected to immediately — they never see the admin UI

Choose a tag to compare

View all tags
@aroundmyroom aroundmyroom released this 10 Jul 15:05
· 45 commits to main since this release
v0.3.13
cf8e3fb

Velvet v0.3.13 — Security fix + child vpath access

Security: admin panel now requires admin role

Any authenticated user could previously load the admin panel HTML
(/admin, /admin/index.html) even without admin: true in their
config. The route guard only verified the JWT was valid — it never
checked the admin flag. Non-admin users are now redirected to /
immediately and never see the admin UI.

Admin API endpoints already rejected non-admin requests (403/405);
this closes the HTML-access gap.

Bug fix: users with restricted vpath access can now play music

This release also fixes a long-standing issue where users whose vpaths
list contained only child vpaths (sub-folders of a root vpath) could not
browse or play music at all — every menu was empty and every playback
attempt failed with 403/500 errors.

What was broken

Velvet indexes all music files under the root vpath (e.g. Music). A user
configured with only "vpaths": ["12-inches"] — where 12-inches is a sub-folder
of Music — had queries like WHERE vpath IN ('12-inches') which returned zero
rows, because no files are stored under that name in the database.

What is fixed

  • Playback: files stream correctly through the parent root's media mount,
    restricted to the user's allowed filesystem prefix.
  • Artists menu: shows only artists that have files in the user's sub-folder.
  • Albums menu: empty for users with no albumsOnly vpath (correct behaviour).
  • Genres and Decades menus: filtered to only the user's allowed content.
  • All other menus (search, recently played, home stats, random, starred, etc.)
    are scoped correctly to the user's accessible files.
  • Access control is preserved: users cannot access files outside their
    configured vpath prefix — the fix is purely additive.

How it works

Auth middleware now computes a dbVpaths set for child-only users by adding the
parent root vpaths needed for database lookups. All ~25 DB query endpoints use
this expanded set. Access-control checks (media streaming, metadata, waveforms,
playback logging) continue to use the original strict vpaths list with an
added prefix check.

Assets 2
Loading