From 5f1d4158ae3c8cb17f89a5d87c6d2abf0d2fabb1 Mon Sep 17 00:00:00 2001
From: jcorporation <mail@jcgames.de>
Date: Thu, 25 Apr 2019 22:00:11 +0100
Subject: [PATCH 1/6] Fix: allow same characters in playlistnames as mpd itself
 #111

---
 dist/htdocs/js/mympd.min.js | 17 +++++++++--------
 htdocs/js/mympd.js          | 25 ++++++++++++++++---------
 src/global.c                |  8 +-------
 3 files changed, 26 insertions(+), 24 deletions(-)

diff --git a/dist/htdocs/js/mympd.min.js b/dist/htdocs/js/mympd.min.js
index 14eb0bc80..3bba1a522 100644
--- a/dist/htdocs/js/mympd.min.js
+++ b/dist/htdocs/js/mympd.min.js
@@ -178,17 +178,17 @@ var c;settings.featTags&&(c='<option value="any">Any Tag</option>');c+='<option
 a.data.searchstr,settings.featAdvsearch?(document.getElementById("selectSaveSmartPlaylistTag").parentNode.classList.add("hide"),document.getElementById("inputSaveSmartPlaylistSearchstr").parentNode.classList.replace("col-md-6","col-md-12")):(document.getElementById("selectSaveSmartPlaylistTag").parentNode.classList.remove("hide"),document.getElementById("inputSaveSmartPlaylistSearchstr").parentNode.classList.replace("col-md-12","col-md-6"))):"sticker"==a.data.type?(document.getElementById("saveSmartPlaylistSticker").classList.remove("hide"),
 document.getElementById("selectSaveSmartPlaylistSticker").value=a.data.sticker,document.getElementById("inputSaveSmartPlaylistStickerMaxentries").value=a.data.maxentries):"newest"==a.data.type&&(document.getElementById("saveSmartPlaylistNewest").classList.remove("hide"),a=a.data.timerange/24/60/60,document.getElementById("inputSaveSmartPlaylistNewestTimerange").value=a);modalSaveSmartPlaylist.show();b.focus()}
 function chkInt(a,b){if(""!=a.value.replace(/\d/g,""))return a.classList.add("is-invalid"),b.classList.add("was-validated"),!1;a.classList.remove("is-invalid");return!0}
-function saveSmartPlaylist(){var a=document.getElementById("saveSmartPlaylistName").value,b=document.getElementById("saveSmartPlaylistType").value,c=a.replace(/[\w\-]/g,""),d=document.getElementById("saveSmartPlaylistFrm");if(""!=a&&""==c){if("search"==b)d=document.getElementById("selectSaveSmartPlaylistTag"),d=d.options[d.selectedIndex].value,settings.featAdvsearch&&(d="expression"),c=document.getElementById("inputSaveSmartPlaylistSearchstr").value,sendAPI({cmd:"MPD_API_SMARTPLS_SAVE",data:{type:b,
-playlist:a,tag:d,searchstr:c}});else if("sticker"==b){c=document.getElementById("selectSaveSmartPlaylistSticker");c=c.options[c.selectedIndex].value;var e=document.getElementById("inputSaveSmartPlaylistStickerMaxentries");if(!chkInt(e,d))return;sendAPI({cmd:"MPD_API_SMARTPLS_SAVE",data:{type:b,playlist:a,sticker:c,maxentries:e.value}})}else if("newest"==b){c=document.getElementById("inputSaveSmartPlaylistNewestTimerange");if(!chkInt(c,d))return;d=86400*parseInt(c.value);sendAPI({cmd:"MPD_API_SMARTPLS_SAVE",
-data:{type:b,playlist:a,timerange:d}})}else{document.getElementById("saveSmartPlaylistType").classList.add("is-invalid");return}modalSaveSmartPlaylist.hide();showNotification("Saved smart playlist "+a,"","","success")}else document.getElementById("saveSmartPlaylistName").classList.add("is-invalid"),d.classList.add("was-validated")}
+function saveSmartPlaylist(){var a=document.getElementById("saveSmartPlaylistName").value,b=document.getElementById("saveSmartPlaylistType").value,c=document.getElementById("saveSmartPlaylistFrm");if(1==validate_plname(a)){if("search"==b){c=document.getElementById("selectSaveSmartPlaylistTag");c=c.options[c.selectedIndex].value;settings.featAdvsearch&&(c="expression");var d=document.getElementById("inputSaveSmartPlaylistSearchstr").value;sendAPI({cmd:"MPD_API_SMARTPLS_SAVE",data:{type:b,playlist:a,
+tag:c,searchstr:d}})}else if("sticker"==b){d=document.getElementById("selectSaveSmartPlaylistSticker");d=d.options[d.selectedIndex].value;var e=document.getElementById("inputSaveSmartPlaylistStickerMaxentries");if(!chkInt(e,c))return;sendAPI({cmd:"MPD_API_SMARTPLS_SAVE",data:{type:b,playlist:a,sticker:d,maxentries:e.value}})}else if("newest"==b){d=document.getElementById("inputSaveSmartPlaylistNewestTimerange");if(!chkInt(d,c))return;c=86400*parseInt(d.value);sendAPI({cmd:"MPD_API_SMARTPLS_SAVE",
+data:{type:b,playlist:a,timerange:c}})}else{document.getElementById("saveSmartPlaylistType").classList.add("is-invalid");return}modalSaveSmartPlaylist.hide();showNotification("Saved smart playlist "+a,"","","success")}else document.getElementById("saveSmartPlaylistName").classList.add("is-invalid"),c.classList.add("was-validated")}
 function showAddToPlaylist(a){document.getElementById("addToPlaylistUri").value=a;document.getElementById("addToPlaylistPlaylist").innerHTML="";document.getElementById("addToPlaylistNewPlaylist").value="";document.getElementById("addToPlaylistNewPlaylistDiv").classList.add("hide");document.getElementById("addToPlaylistFrm").classList.remove("was-validated");document.getElementById("addToPlaylistNewPlaylist").classList.remove("is-invalid");toggleBtn("toggleAddToPlaylistBtn",0);var b=document.getElementById("streamUrl");
 b.focus();b.value="";b.classList.remove("is-invalid");document.getElementById("addStreamFrm").classList.remove("was-validated");"stream"!=a?(document.getElementById("addStreamFooter").classList.add("hide"),document.getElementById("addStreamFrm").classList.add("hide"),document.getElementById("addToPlaylistFooter").classList.remove("hide"),document.getElementById("addToPlaylistFrm").classList.remove("hide"),document.getElementById("addToPlaylistLabel").innerText="Add to playlist"):(document.getElementById("addStreamFooter").classList.remove("hide"),
 document.getElementById("addStreamFrm").classList.remove("hide"),document.getElementById("addToPlaylistFooter").classList.add("hide"),document.getElementById("addToPlaylistFrm").classList.add("hide"),document.getElementById("addToPlaylistLabel").innerText="Add Stream");modalAddToPlaylist.show();settings.featPlaylists&&(playlistEl="addToPlaylistPlaylist",sendAPI({cmd:"MPD_API_PLAYLIST_LIST",data:{offset:0,filter:"-"}},getAllPlaylists))}
-function addToPlaylist(){var a=document.getElementById("addToPlaylistUri").value;if("stream"==a&&(a=document.getElementById("streamUrl").value,""==a||-1==a.indexOf("http"))){document.getElementById("streamUrl").classList.add("is-invalid");document.getElementById("addStreamFrm").classList.add("was-validated");return}var b=document.getElementById("addToPlaylistPlaylist");b=b.options[b.selectedIndex].text;if("New Playlist"==b){b=document.getElementById("addToPlaylistNewPlaylist").value;var c=b.replace(/[\w\-]/g,
-"");if(""==b||""!=c){document.getElementById("addToPlaylistNewPlaylist").classList.add("is-invalid");document.getElementById("addToPlaylistFrm").classList.add("was-validated");return}}""!=b?("SEARCH"==a?addAllFromSearchPlist(b):"DATABASE"==a?addAllFromBrowseDatabasePlist(b):sendAPI({cmd:"MPD_API_PLAYLIST_ADD_TRACK",data:{uri:a,plist:b}}),modalAddToPlaylist.hide()):(document.getElementById("addToPlaylistPlaylist").classList.add("is-invalid"),document.getElementById("addToPlaylistFrm").classList.add("was-validated"))}
+function addToPlaylist(){var a=document.getElementById("addToPlaylistUri").value;if("stream"==a&&(a=document.getElementById("streamUrl").value,""==a||-1==a.indexOf("http"))){document.getElementById("streamUrl").classList.add("is-invalid");document.getElementById("addStreamFrm").classList.add("was-validated");return}var b=document.getElementById("addToPlaylistPlaylist");b=b.options[b.selectedIndex].text;if("New Playlist"==b&&(b=document.getElementById("addToPlaylistNewPlaylist").value,1!=validate_plname(b))){document.getElementById("addToPlaylistNewPlaylist").classList.add("is-invalid");
+document.getElementById("addToPlaylistFrm").classList.add("was-validated");return}""!=b?("SEARCH"==a?addAllFromSearchPlist(b):"DATABASE"==a?addAllFromBrowseDatabasePlist(b):sendAPI({cmd:"MPD_API_PLAYLIST_ADD_TRACK",data:{uri:a,plist:b}}),modalAddToPlaylist.hide()):(document.getElementById("addToPlaylistPlaylist").classList.add("is-invalid"),document.getElementById("addToPlaylistFrm").classList.add("was-validated"))}
 function addStream(){var a=document.getElementById("streamUrl").value;""!=a&&0==a.indexOf("http")?(sendAPI({cmd:"MPD_API_QUEUE_ADD_TRACK",data:{uri:a}}),modalAddToPlaylist.hide(),showNotification("Added stream "+a+"to queue","","","success")):(document.getElementById("streamUrl").classList.add("is-invalid"),document.getElementById("addStreamFrm").classList.add("was-validated"))}
 function showRenamePlaylist(a){document.getElementById("renamePlaylistFrm").classList.remove("was-validated");document.getElementById("renamePlaylistTo").classList.remove("is-invalid");modalRenamePlaylist.show();document.getElementById("renamePlaylistFrom").value=a;document.getElementById("renamePlaylistTo").value=""}
-function renamePlaylist(){var a=document.getElementById("renamePlaylistFrom").value,b=document.getElementById("renamePlaylistTo").value,c=b.replace(/[\w\-]/g,"");""!=b&&b!=a&&""==c?(sendAPI({cmd:"MPD_API_PLAYLIST_RENAME",data:{from:a,to:b}}),modalRenamePlaylist.hide()):(document.getElementById("renamePlaylistTo").classList.add("is-invalid"),document.getElementById("renamePlaylistFrm").classList.add("was-validated"))}
+function renamePlaylist(){var a=document.getElementById("renamePlaylistFrom").value,b=document.getElementById("renamePlaylistTo").value;b!=a&&1==validate_plname(b)&&1==validate_plname(a)?(sendAPI({cmd:"MPD_API_PLAYLIST_RENAME",data:{from:a,to:b}}),modalRenamePlaylist.hide()):(document.getElementById("renamePlaylistTo").classList.add("is-invalid"),document.getElementById("renamePlaylistFrm").classList.add("was-validated"))}
 function showSmartPlaylist(a){sendAPI({cmd:"MPD_API_SMARTPLS_GET",data:{playlist:a}},parseSmartPlaylist)}
 function parseBookmarks(a){for(var b='<table class="table table-sm table-dark table-borderless mb-0">',c=0;c<a.data.length;c++)b+='<tr data-id="'+a.data[c].id+'" data-type="'+a.data[c].type+'" data-uri="'+encodeURI(a.data[c].uri)+'"><td class="nowrap"><a class="text-light" href="#" data-href="goto">'+a.data[c].name+'</a></td><td><a class="text-light material-icons material-icons-small" href="#" data-href="edit">edit</a></td><td><a class="text-light material-icons material-icons-small" href="#" data-href="delete">delete</a></td></tr>';0==
 a.data.length&&(b+='<tr><td class="text-light nowrap">No bookmarks found.</td></tr>');b+="</table>";document.getElementById("BrowseFilesystemBookmarks").innerHTML=b}
@@ -220,7 +220,7 @@ function addAllFromBrowseFilesystem(){sendAPI({cmd:"MPD_API_QUEUE_ADD_TRACK",dat
 function addAllFromSearchPlist(a){var b=parseInt(document.getElementById("panel-heading-search").innerText);!isNaN(b)&&0<b&&(settings.featAdvsearch?sendAPI({cmd:"MPD_API_DATABASE_SEARCH_ADV",data:{plist:a,sort:"",sortdesc:!1,expression:app.current.search,offset:0,cols:settings.colsSearch}}):sendAPI({cmd:"MPD_API_DATABASE_SEARCH",data:{plist:a,filter:app.current.filter,searchstr:app.current.search,offset:0,cols:settings.colsSearch}}),showNotification("Added "+b+" songs from search to "+a,"","","success"))}
 function addAllFromBrowseDatabasePlist(a){2<=app.current.search.length&&(sendAPI({cmd:"MPD_API_DATABASE_SEARCH",data:{plist:a,filter:app.current.view,searchstr:app.current.search,offset:0,cols:settings.colsSearch}}),showNotification("Added songs from database selection to "+a,"","","success"))}function scrollTo(a){document.body.scrollTop=a;document.documentElement.scrollTop=a}
 function gotoPage(a){switch(a){case "next":app.current.page+=settings.maxElementsPerPage;break;case "prev":app.current.page-=settings.maxElementsPerPage;0>app.current.page&&(app.current.page=0);break;default:app.current.page=a}appGoto(app.current.app,app.current.tab,app.current.view,app.current.page+"/"+app.current.filter+"/"+app.current.sort+"/"+app.current.search)}
-function saveQueue(){var a=document.getElementById("saveQueueName").value,b=a.replace(/[\w\-]/g,"");""!=a&&""==b?(sendAPI({cmd:"MPD_API_QUEUE_SAVE",data:{plist:a}}),modalSavequeue.hide()):(alert(b),document.getElementById("saveQueueName").classList.add("is-invalid"),document.getElementById("saveQueueFrm").classList.add("was-validated"))}function toggleAlert(a,b,c){a=document.getElementById(a);0==b?(a.innerHTML="",a.classList.add("hide")):(a.innerHTML=c,a.classList.remove("hide"))}
+function saveQueue(){var a=document.getElementById("saveQueueName").value;1==validate_plname(from)?(sendAPI({cmd:"MPD_API_QUEUE_SAVE",data:{plist:a}}),modalSavequeue.hide()):(document.getElementById("saveQueueName").classList.add("is-invalid"),document.getElementById("saveQueueFrm").classList.add("was-validated"))}function toggleAlert(a,b,c){a=document.getElementById(a);0==b?(a.innerHTML="",a.classList.add("hide")):(a.innerHTML=c,a.classList.remove("hide"))}
 function showNotification(a,b,c,d){1==settings.notificationWeb&&(b=new Notification(a,{icon:"assets/favicon.ico",body:b}),setTimeout(function(a){a.close()},3E3,b));1==settings.notificationPage&&(document.getElementById("alertBox")?b=document.getElementById("alertBox"):(b=document.createElement("div"),b.setAttribute("id","alertBox"),b.addEventListener("click",function(){hideNotification()},!1)),b.classList.remove("alert-success","alert-danger"),b.classList.add("alert","alert-"+d),b.innerHTML="<div><strong>"+
 a+"</strong><br/>"+c+"</div>",document.getElementsByTagName("main")[0].append(b),document.getElementById("alertBox").classList.add("alertBoxActive"),alertTimeout&&clearTimeout(alertTimeout),alertTimeout=setTimeout(function(){hideNotification()},3E3))}function hideNotification(){document.getElementById("alertBox")&&(document.getElementById("alertBox").classList.remove("alertBoxActive"),setTimeout(function(){var a=document.getElementById("alertBox");a&&a.remove()},600))}
 function notificationsSupported(){return"Notification"in window}
@@ -233,4 +233,5 @@ function addFilterLetter(a){for(var b='<button class="mr-1 mb-1 btn btn-sm btn-s
 app.current.tab,app.current.view,"0/"+b+"/"+app.current.sort+"/"+app.current.search)},!1)}function selectTag(a,b,c){a=document.getElementById(a);var d=a.querySelector(".active");d&&d.classList.remove("active");if(d=a.querySelector("[data-tag="+c+"]"))d.classList.add("active"),document.getElementById(b).innerText=d.innerText}
 function addTagList(a,b){var c="";"searchtags"==b&&(1==settings.featTags&&(c+='<button type="button" class="btn btn-secondary btn-sm btn-block" data-tag="any">Any Tag</button>'),c+='<button type="button" class="btn btn-secondary btn-sm btn-block" data-tag="filename">Filename</button>');for(var d=0;d<settings[b].length;d++)c+='<button type="button" class="btn btn-secondary btn-sm btn-block" data-tag="'+settings[b][d]+'">'+settings[b][d]+"</button>";document.getElementById(a).innerHTML=c}
 function gotoTagList(){appGoto(app.current.app,app.current.tab,app.current.view,"0/-/-/")}function openModal(a){window[a].show()}function openDropdown(a){window[a].toggle()}function focusSearch(){"Queue"==app.current.app?document.getElementById("searchqueuestr").focus():"Search"==app.current.app?domCache.searchstr.focus():appGoto("Search")}
-function chVolume(a){a=parseInt(domCache.volumeBar.value)+a;0>a?a=0:100<a&&(a=100);domCache.volumeBar.value=a;sendAPI({cmd:"MPD_API_PLAYER_VOLUME_SET",data:{volume:a}})}function beautifyDuration(a){var b=Math.floor(a/86400),c=Math.floor(a/3600)-24*b,d=Math.floor(a/60)-60*c-1440*b;a=a-86400*b-3600*c-60*d;return(0<b?b+"\u2009d ":"")+(0<c?c+"\u2009h "+(10>d?"0":""):"")+d+"\u2009m "+(10>a?"0":"")+a+"\u2009s"}function genId(a){return"id"+a.replace(/[^\w\-]/g,"")}appInitStart();
+function chVolume(a){a=parseInt(domCache.volumeBar.value)+a;0>a?a=0:100<a&&(a=100);domCache.volumeBar.value=a;sendAPI({cmd:"MPD_API_PLAYER_VOLUME_SET",data:{volume:a}})}function beautifyDuration(a){var b=Math.floor(a/86400),c=Math.floor(a/3600)-24*b,d=Math.floor(a/60)-60*c-1440*b;a=a-86400*b-3600*c-60*d;return(0<b?b+"\u2009d ":"")+(0<c?c+"\u2009h "+(10>d?"0":""):"")+d+"\u2009m "+(10>a?"0":"")+a+"\u2009s"}function genId(a){return"id"+a.replace(/[^\w\-]/g,"")}
+function validate_plname(a){return""==a?!1:null==a.match(/\/|\r|\n/)?!0:!1}appInitStart();
diff --git a/htdocs/js/mympd.js b/htdocs/js/mympd.js
index 60aa8115f..084ab9b69 100644
--- a/htdocs/js/mympd.js
+++ b/htdocs/js/mympd.js
@@ -2760,9 +2760,8 @@ function chkInt(el, frm) {
 function saveSmartPlaylist() {
     var name = document.getElementById('saveSmartPlaylistName').value;
     var type = document.getElementById('saveSmartPlaylistType').value;
-    var valid = name.replace(/[\w\-]/g, '');
     var frm = document.getElementById('saveSmartPlaylistFrm');
-    if (name != '' && valid == '') {
+    if (validate_plname(name) == true) {
         if (type == 'search') {
             var tagEl = document.getElementById('selectSaveSmartPlaylistTag');
             var tag = tagEl.options[tagEl.selectedIndex].value;
@@ -2845,8 +2844,7 @@ function addToPlaylist() {
     var plist = plistEl.options[plistEl.selectedIndex].text;
     if (plist == 'New Playlist') {
         var newPl = document.getElementById('addToPlaylistNewPlaylist').value;
-        var valid = newPl.replace(/[\w\-]/g, '');
-        if (newPl != '' && valid == '') {
+        if (validate_plname(newPl) == true) {
             plist = newPl;
         } else {
             document.getElementById('addToPlaylistNewPlaylist').classList.add('is-invalid');
@@ -2893,8 +2891,7 @@ function showRenamePlaylist(from) {
 function renamePlaylist() {
     var from = document.getElementById('renamePlaylistFrom').value;
     var to = document.getElementById('renamePlaylistTo').value;
-    var valid = to.replace(/[\w\-]/g, '');
-    if (to != '' && to != from && valid == '') {
+    if (to != from && validate_plname(to) == true && validate_plname(from) == true) {
         sendAPI({"cmd": "MPD_API_PLAYLIST_RENAME", "data": {"from": from, "to": to}});
         modalRenamePlaylist.hide();
     }
@@ -3336,13 +3333,11 @@ function gotoPage(x) {
 
 function saveQueue() {
     var plName = document.getElementById('saveQueueName').value;
-    var valid = plName.replace(/[\w\-]/g, '');
-    if (plName != '' && valid == '') {
+    if (validate_plname(from) == true) {
         sendAPI({"cmd": "MPD_API_QUEUE_SAVE", "data": {"plist": plName}});
         modalSavequeue.hide();
     }
     else {
-        alert(valid);
         document.getElementById('saveQueueName').classList.add('is-invalid');
         document.getElementById('saveQueueFrm').classList.add('was-validated');
     }
@@ -3589,5 +3584,17 @@ function genId(x) {
     return 'id' + x.replace(/[^\w\-]/g, '');
 }
 
+function validate_plname(x) {
+    if (x == '') {
+        return false;
+    }
+    else if (x.match(/\/|\r|\n/) == null) {
+        return true;
+    }
+    else {
+        return false;
+    }
+}
+
 //Init app
 appInitStart();
diff --git a/src/global.c b/src/global.c
index 716ef88c2..056fa4f80 100644
--- a/src/global.c
+++ b/src/global.c
@@ -55,13 +55,7 @@ int randrange(int n) {
 }
 
 bool validate_string(const char *data) {
-    static char ok_chars[] = "abcdefghijklmnopqrstuvwxyz"
-                             "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
-                             "1234567890_-. ";
-    const char *cp = data;
-    const char *end = data + strlen(data);
-    for (cp += strspn(cp, ok_chars); cp != end; cp += strspn(cp, ok_chars)) {
-        LOG_ERROR("Invalid character in string");
+    if (strchr(data, '/') != NULL || strchr(data, '\n') != NULL || strchr(data, '\r') != NULL) {
         return false;
     }
     return true;

From 1cc6c61b7fd1a1bfb520be9e92ccbd3264ff01eb Mon Sep 17 00:00:00 2001
From: jcorporation <mail@jcgames.de>
Date: Thu, 25 Apr 2019 22:17:00 +0100
Subject: [PATCH 2/6] Fix: playlist handling, disallow empty names and
 following characters: \r \n / " '

---
 dist/htdocs/js/mympd.min.js | 2 +-
 htdocs/js/mympd.js          | 2 +-
 src/global.c                | 3 ++-
 src/mpd_client.c            | 2 +-
 4 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/dist/htdocs/js/mympd.min.js b/dist/htdocs/js/mympd.min.js
index 3bba1a522..ce014cf56 100644
--- a/dist/htdocs/js/mympd.min.js
+++ b/dist/htdocs/js/mympd.min.js
@@ -234,4 +234,4 @@ app.current.tab,app.current.view,"0/"+b+"/"+app.current.sort+"/"+app.current.sea
 function addTagList(a,b){var c="";"searchtags"==b&&(1==settings.featTags&&(c+='<button type="button" class="btn btn-secondary btn-sm btn-block" data-tag="any">Any Tag</button>'),c+='<button type="button" class="btn btn-secondary btn-sm btn-block" data-tag="filename">Filename</button>');for(var d=0;d<settings[b].length;d++)c+='<button type="button" class="btn btn-secondary btn-sm btn-block" data-tag="'+settings[b][d]+'">'+settings[b][d]+"</button>";document.getElementById(a).innerHTML=c}
 function gotoTagList(){appGoto(app.current.app,app.current.tab,app.current.view,"0/-/-/")}function openModal(a){window[a].show()}function openDropdown(a){window[a].toggle()}function focusSearch(){"Queue"==app.current.app?document.getElementById("searchqueuestr").focus():"Search"==app.current.app?domCache.searchstr.focus():appGoto("Search")}
 function chVolume(a){a=parseInt(domCache.volumeBar.value)+a;0>a?a=0:100<a&&(a=100);domCache.volumeBar.value=a;sendAPI({cmd:"MPD_API_PLAYER_VOLUME_SET",data:{volume:a}})}function beautifyDuration(a){var b=Math.floor(a/86400),c=Math.floor(a/3600)-24*b,d=Math.floor(a/60)-60*c-1440*b;a=a-86400*b-3600*c-60*d;return(0<b?b+"\u2009d ":"")+(0<c?c+"\u2009h "+(10>d?"0":""):"")+d+"\u2009m "+(10>a?"0":"")+a+"\u2009s"}function genId(a){return"id"+a.replace(/[^\w\-]/g,"")}
-function validate_plname(a){return""==a?!1:null==a.match(/\/|\r|\n/)?!0:!1}appInitStart();
+function validate_plname(a){return""==a?!1:null==a.match(/\/|\r|\n|"|'/)?!0:!1}appInitStart();
diff --git a/htdocs/js/mympd.js b/htdocs/js/mympd.js
index 084ab9b69..e84734343 100644
--- a/htdocs/js/mympd.js
+++ b/htdocs/js/mympd.js
@@ -3588,7 +3588,7 @@ function validate_plname(x) {
     if (x == '') {
         return false;
     }
-    else if (x.match(/\/|\r|\n/) == null) {
+    else if (x.match(/\/|\r|\n|"|'/) == null) {
         return true;
     }
     else {
diff --git a/src/global.c b/src/global.c
index 056fa4f80..6679af762 100644
--- a/src/global.c
+++ b/src/global.c
@@ -55,7 +55,8 @@ int randrange(int n) {
 }
 
 bool validate_string(const char *data) {
-    if (strchr(data, '/') != NULL || strchr(data, '\n') != NULL || strchr(data, '\r') != NULL) {
+    if (strchr(data, '/') != NULL || strchr(data, '\n') != NULL || strchr(data, '\r') != NULL ||
+        strchr(data, '"') != NULL || strchr(data, '\'') != NULL) {
         return false;
     }
     return true;
diff --git a/src/mpd_client.c b/src/mpd_client.c
index d34482204..415c8fb56 100644
--- a/src/mpd_client.c
+++ b/src/mpd_client.c
@@ -2543,7 +2543,7 @@ static int mpd_client_rename_playlist(t_config *config, t_mpd_state *mpd_state,
     }
     
     if (mpd_run_rename(mpd_state->conn, old_playlist, new_playlist)) {
-        len = json_printf(&out, "{type: result, data: %Q}", "Renamed playlist %s to %s");
+        len = json_printf(&out, "{type: result, data: %Q}", "Sucessfully renamed playlist");
     }
     else {
         RETURN_ERROR_AND_RECOVER("mpd_run_rename");

From 016c4b24b1e2f43c83d41c10144caecb5f5c3466 Mon Sep 17 00:00:00 2001
From: jcorporation <mail@juergenmang.de>
Date: Fri, 26 Apr 2019 21:31:38 +0200
Subject: [PATCH 3/6] Fix: debian packaging, use DESTDIR

---
 CMakeLists.txt |  8 ++++----
 debian/rules   | 10 ++--------
 2 files changed, 6 insertions(+), 12 deletions(-)

diff --git a/CMakeLists.txt b/CMakeLists.txt
index 7c0a5fc19..41ba9eb9e 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -15,11 +15,11 @@ else()
 endif()
 
 if(CMAKE_BUILD_TYPE MATCHES RELEASE)
-    if("${CMAKE_INSTALL_PREFIX}" STREQUAL "../debian/tmp")
-        set(ASSETS_PATH "/usr/share/${PROJECT_NAME}/htdocs")
-    else()
+#    if("${CMAKE_INSTALL_PREFIX}" STREQUAL "../debian/tmp")
+#        set(ASSETS_PATH "/usr/share/${PROJECT_NAME}/htdocs")
+#    else()
         set(ASSETS_PATH "${CMAKE_INSTALL_PREFIX}/share${SUBDIR}/htdocs")
-    endif()
+#    endif()
     set(DEBUG "OFF")
 else()
     set(ASSETS_PATH "${PROJECT_SOURCE_DIR}/htdocs")
diff --git a/debian/rules b/debian/rules
index f022610ee..9e7e47489 100755
--- a/debian/rules
+++ b/debian/rules
@@ -5,7 +5,7 @@ BUILDDIR = release
 
 build:
 	mkdir $(BUILDDIR)
-	cd $(BUILDDIR); cmake -DCMAKE_INSTALL_PREFIX:PATH=../debian/tmp -DCMAKE_BUILD_TYPE=RELEASE ..
+	cd $(BUILDDIR); cmake -DCMAKE_INSTALL_PREFIX:PATH=/usr -DCMAKE_BUILD_TYPE=RELEASE ..
 	make -C $(BUILDDIR)
 
 binary: binary-indep binary-arch
@@ -13,14 +13,8 @@ binary: binary-indep binary-arch
 binary-indep:
 
 binary-arch:
-	cd $(BUILDDIR); cmake -P cmake_install.cmake
+	cd $(BUILDDIR); make install DESTDIR=../debian/tmp
 	mkdir -p debian/tmp/DEBIAN
-	mv debian/debian/tmp/var debian/tmp/var
-	mkdir -p debian/tmp/usr/
-	mv debian/debian/tmp/bin debian/tmp/usr
-	mv debian/debian/tmp/share debian/tmp/usr/
-	mv debian/debian/tmp/etc debian/tmp/
-	rm -rf debian/debian
 	cp debian/postinst debian/tmp/DEBIAN
 	cp debian/postrm debian/tmp/DEBIAN
 	dpkg-gencontrol -pmympd

From cd95e10c65c0df36d51a7ff8927860e10e92aade Mon Sep 17 00:00:00 2001
From: jcorporation <mail@juergenmang.de>
Date: Fri, 26 Apr 2019 21:33:37 +0200
Subject: [PATCH 4/6] Fix: formating

---
 CMakeLists.txt | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/CMakeLists.txt b/CMakeLists.txt
index 41ba9eb9e..272f267aa 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -15,11 +15,7 @@ else()
 endif()
 
 if(CMAKE_BUILD_TYPE MATCHES RELEASE)
-#    if("${CMAKE_INSTALL_PREFIX}" STREQUAL "../debian/tmp")
-#        set(ASSETS_PATH "/usr/share/${PROJECT_NAME}/htdocs")
-#    else()
-        set(ASSETS_PATH "${CMAKE_INSTALL_PREFIX}/share${SUBDIR}/htdocs")
-#    endif()
+    set(ASSETS_PATH "${CMAKE_INSTALL_PREFIX}/share${SUBDIR}/htdocs")
     set(DEBUG "OFF")
 else()
     set(ASSETS_PATH "${PROJECT_SOURCE_DIR}/htdocs")

From 67fc02e970c5dac516cab27a7bbac7c0ae4ce217 Mon Sep 17 00:00:00 2001
From: jcorporation <mail@juergenmang.de>
Date: Fri, 26 Apr 2019 21:36:49 +0200
Subject: [PATCH 5/6] Fix: bump version to 5.3.1

---
 CMakeLists.txt     | 2 +-
 PKGBUILD           | 2 +-
 contrib/myMPD.spec | 2 +-
 debian/changelog   | 4 ++--
 htdocs/sw.js       | 2 +-
 5 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/CMakeLists.txt b/CMakeLists.txt
index 272f267aa..e8480513f 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -6,7 +6,7 @@ project (mympd)
 set(CMAKE_MODULE_PATH ${CMAKE_MODULE_PATH} "${PROJECT_SOURCE_DIR}/cmake/")
 set(CPACK_PACKAGE_VERSION_MAJOR "5")
 set(CPACK_PACKAGE_VERSION_MINOR "3")
-set(CPACK_PACKAGE_VERSION_PATCH "0")
+set(CPACK_PACKAGE_VERSION_PATCH "1")
 
 if("${CMAKE_INSTALL_PREFIX}" MATCHES "/usr")
   set(SUBDIR "/${PROJECT_NAME}")
diff --git a/PKGBUILD b/PKGBUILD
index 34af36c90..94854de2a 100644
--- a/PKGBUILD
+++ b/PKGBUILD
@@ -4,7 +4,7 @@
 
 pkgname=mympd
 _pkgname=myMPD
-pkgver=5.3.0
+pkgver=5.3.1
 pkgrel=1
 pkgdesc="myMPD is a standalone and mobile friendly web mpdclient."
 arch=('x86_64' 'armv7h' 'aarch64')
diff --git a/contrib/myMPD.spec b/contrib/myMPD.spec
index 6acfc1170..b100ac530 100644
--- a/contrib/myMPD.spec
+++ b/contrib/myMPD.spec
@@ -4,7 +4,7 @@
 # (c) 2018-2019 Juergen Mang <mail@jcgames.de>
 
 Name:           myMPD
-Version:        5.3.0
+Version:        5.3.1
 Release:        0 
 License:        GPL-2.0 
 Group:          Productivity/Multimedia/Sound/Players
diff --git a/debian/changelog b/debian/changelog
index 08ab0d98a..0851fa758 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,5 +1,5 @@
-mympd (5.3.0-1) stable; urgency=medium
+mympd (5.3.1-1) stable; urgency=medium
 
   * Release from master
 
- -- Juergen Mang <mail@jcgames.de>  Thu, 25 Apr 2019 21:04:48 +0200
+ -- Juergen Mang <mail@jcgames.de>  Fri, 26 Apr 2019 21:04:28 +0200
diff --git a/htdocs/sw.js b/htdocs/sw.js
index f0a07305a..64279131b 100644
--- a/htdocs/sw.js
+++ b/htdocs/sw.js
@@ -1,4 +1,4 @@
-var CACHE = 'myMPD-cache-v5.3.0';
+var CACHE = 'myMPD-cache-v5.3.1';
 var subdir = self.location.pathname.replace('/sw.min.js', '').replace(/\/$/, '');
 var urlsToCache = [
     subdir + '/',

From 67ac189c54658ae95ac5962a8b96315d7a5c452f Mon Sep 17 00:00:00 2001
From: jcorporation <mail@juergenmang.de>
Date: Fri, 26 Apr 2019 21:54:01 +0200
Subject: [PATCH 6/6] Fix: improve docker build

---
 Dockerfile   | 4 ++--
 mkrelease.sh | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index 0167c3a95..c9098d465 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -16,9 +16,9 @@ RUN ninja -C output install
 WORKDIR /
 RUN tar -czvf /libmpdclient-master.tar.gz -C /libmpdclient-dist .
 COPY . /myMPD/
-ENV MYMPD_INSTALL_PREFIX=/myMPD-dist/usr
+ENV DESTDIR=/myMPD-dist
 ENV DOCKER=true
-RUN mkdir -p $MYMPD_INSTALL_PREFIX
+RUN mkdir -p $DESTDIR
 WORKDIR /myMPD
 RUN ./mkrelease.sh
 WORKDIR /
diff --git a/mkrelease.sh b/mkrelease.sh
index b39f23968..3a78a2ff5 100755
--- a/mkrelease.sh
+++ b/mkrelease.sh
@@ -55,12 +55,12 @@ echo "Compiling and installing mympd"
 install -d release
 cd release
 export INSTALL_PREFIX="${MYMPD_INSTALL_PREFIX:-/usr}"
-cmake -DCMAKE_INSTALL_PREFIX:PATH=$INSTALL_PREFIX -DCMAKE_BUILD_TYPE=RELEASE ..
+cmake -DCMAKE_INSTALL_PREFIX:PATH=${INSTALL_PREFIX} -DCMAKE_BUILD_TYPE=RELEASE ..
 make
 if [ "$DOCKER" = "true" ]
 then
   # Container build
-  make install
+  make install DESTDIR=$DESTDIR
   cd ..
 else
   sudo -E make install