fixed a bug where the relayevent.sh would compute a wrong signature with

special characters in passwords

motioneye/mediafiles.py

@@ -23,6 +23,7 @@
 import logging
 import multiprocessing
 import os.path
+import pipes
 import re
 import signal
 import stat
@@ -211,7 +212,7 @@ def make_movie_preview(camera_config, full_path):
             'path': full_path, 'offs': offs})
 
     cmd = 'ffmpeg -i %(path)s -f mjpeg -vframes 1 -ss %(offs)s -y %(path)s.thumb'
-    actual_cmd = cmd % {'path': full_path, 'offs': offs}
+    actual_cmd = cmd % {'path': pipes.quote(full_path), 'offs': offs}
     logging.debug('running command "%s"' % actual_cmd)
 
     try:

motioneye/relayevent.py

@@ -13,7 +13,16 @@
 # GNU General Public License for more details.
 # 
 # You should have received a copy of the GNU General Public License
-# along with this program.  If not, see <http://www.gnu.org/licenses/>. 
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+
+
+# THIS SCRIPT IS NO LONGER USED BUT IS KEPT FOR COMPATIBILITY REASONS,
+# AS OLDER CONFIGS MIGHT STILL REFERENCE IT
+# NEWER CONFIGS WILL USE motioneye/scripts/relayevent.sh,
+# AS IT'S CONSIDERABLY FASTER 
+
+
 
 import errno
 import json

motioneye/scripts/relayevent.sh

@@ -13,7 +13,7 @@ if [ -f "$motioneye_conf" ]; then
         motion_conf="$conf_path/motion.conf"
         if [ -r "$motion_conf" ]; then
             username=$(cat $motion_conf | grep 'admin_username' | cut -d ' ' -f 3)
-            password=$(cat $motion_conf | grep 'admin_password' | cut -d ' ' -f 3)
+            password=$(cat $motion_conf | grep 'admin_password' | cut -d ' ' -f 3 | sed -r 's/[^a-zA-Z0-9\/?_.=&{}":, _]/-/g')
         fi
     fi
 fi
@@ -31,4 +31,3 @@ signature=$(echo -n "POST:$uri:$data:$password" | sha1sum | cut -d ' ' -f 1)
 
 curl -H "Content-Type: application/json" -X POST "http://127.0.0.1:$port$uri&_signature=$signature" -d "$data" &>/dev/null
 
-