Add subsonic playlist functionality

[theandrewbailey]

Connects to a Subsonic server and displays the user's playlists as icons on the demo desktop. The playlists can be activated and loaded into Webamp and played from Subsonic. (Creating and saving playlists not supported.) This should live in a media library window mentioned in #627 but fake files are good enough for now.

The URL must have parameters u, s, t, and (optionally) d for the username, salt, token, and domain respectively (if omitted, defaults to current page's domain). Token is md5(user's password + salt) in hexadecimal encoding, see http://www.subsonic.org/pages/api.jsp for more. Subsonic server may need proper CORS configuration.

I built and used this with a personal Funkwhale instance.

[captbaritone]

Cool! I'll admit I had to Google Subsonic and Funkwhale (links below for others like me who are uninitiated).

• Funkwhale
• Subsonic

This is a cool idea, thanks for sharing the code! I don't personally use Subsonic so I'm hesitant to merge this in since I won't be able to test it or validate that it doesn't break moving forward. That said, I can imagine folks who do use Subsonic might find this fun. If you'd like to setup a public instance of Webamp that includes this feature, by all means do.

One question/piece of feedback: Is it save to include the password hash in the URL?

From https://neilmadden.blog/2019/01/16/can-you-ever-safely-include-credentials-in-a-url/:

• URLs may be saved in the history of a browser, making them potentially accessible to the next user of a public terminal. Most browsers support private browsing modes that can be used on public browsers to prevent this, but use of a public terminal is always a risk. If somebody gains access to your computer or phone, then this may also be a threat even on your own device. Using time-limited tokens in URLs can help mitigate against these threats.
• URLs within page content may be cached by the browser and by web proxies. Use of TLS and proper Cache-Control headers can reduce this risk.
• URLs in the content of a HTML page may be sniffed by other scripts running in the page. Sandboxing untrusted 3rd-party scripts in iframes can help, but a more general technique is to avoid links directly in HTML, as we shall see later.

Note: The Netlify build failure is not your fault. I broke that. If you rebase on top of #1084 it should be fixed.

[theandrewbailey]

I'll look into setting up something small for Subsonic functionality.

URL parameters are likely not the best solution, but they were the fastest to implement, particularly in the use case of clicking a link in the main Funkwhale interface to switch to Webamp. A form would probably be ideal for security, but I didn't see any existing forms to copy and build from. (right?)

Re the build: I read the log, and figured I didn't do it, heh.

[theandrewbailey]

I've implemented a form to enter credentials, and deployed it to my Funkwhale instance, and set up a demo account there.

https://music.theandrewbailey.com/webamp/

I'll email you credentials for the login.