@Seth , you Comment 17 : I had a look on audacious the db-file access :
for collection in os.listdir(AUDACIOUS_DBFILE): dbfile = '%s/%s' % (AUDACIOUS_DBFILE, collection) database = open(dbfile, "r") database = database.read() if not database.startswith("title:Library"): records = database[14:] records = records.split("uri=") else: records = "" What i can see are some bugs like this : 1) On my PC, the Database entry is not english "title:Library", but in my language "title=Sammlung" , notice it is written with "=" not with ":" 2) So "records = database[14:]" should be somewhat like "records = database[5:]" 3) There is no filter to use files with ".audpl" extension only. 4) There is a "//" in the dbfile Path is it that what you mean ? -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1483037 Title: Possible Shell Command Injection in daemon To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/unity-scope-audacious/+bug/1483037/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs