release v0.19.20

-----BEGIN PGP SIGNATURE-----
 
 iQJEBAABCAAuFiEEA5IzWngIOJSkMBxDI26KWMbbRRIFAlhLAzUQHG1heEBtdXNp
 Y3BkLm9yZwAKCRAjbopYxttFEp8ED/92V7el1LsuifbIKP4xFmHfENxB5bzBCQHZ
 f4DlGybr7pA4FZQIR5Z0qulvVr+sdY0Y8hgSoOCKzmHGuOgQ6zxHVGVMWLY5N0JN
 ExOrSGUhIjNV+L06LA/YDOE4Z9VUuSi6ZLx1KSLvFbYWULmoqoQREo001YyrfmYr
 pSq+MosGX7i/lFEOrOzw1keEnOUIlqoEJ8IpPks+Xtkk8159TJS2z2FsgWBnlG5W
 qO/N/Nn+TBZZjsDkOoJcdsQ6ot1ThJgxMWY+fduNP5Fe8s2oCHc8dAdYMyfhQiky
 0xq139T8tLRRJUkv9inK63Zd0sn06/pemDD+XZGNE6arwvTsqriEwPcJHgsJYfaQ
 wqGWv+DrMTGVSZnH+XUACLpUexmd8M6q1MZ3g12tRjQHNM06Yn6PePdHUm4IuclJ
 eGsXEb1+jgr6/tMxYkmjUIs8SacpTK2ZUx4aYIG7+tVNmfGompK1gYlYT86ZVEEh
 byzy7A67C9BpSkuC/4YzXT/oHBpDf7T4WVz1TEKZT3vke6l0CDTwYCQyBcG0NFCe
 Pic45q4RgLbkH6NR4bJ1oX/XRCgh8V2QkLKdgcpzS4Lv+TE2hHRlBf9a7SVufIPT
 yBNlY91nT8zUfws/7LBwfZtYQB7VcudUMlmSigtlrvr9CvpRCuGCCY5vdLxi4LYz
 3lm6wOrp5g==
 =opJg
 -----END PGP SIGNATURE-----

Merge tag 'v0.19.20'

release v0.19.20

NEWS

@@ -59,7 +59,9 @@ ver 0.20 (not yet released)
 * switch the code base to C++14
   - GCC 4.9 or clang 3.4 (or newer) recommended
 
-ver 0.19.20 (not yet released)
+ver 0.19.20 (2016/12/09)
+* protocol
+  - "setprio" re-enqueues old song if priority has been raised
 * decoder
   - ffmpeg: ignore empty packets
   - pcm: fix corruption bug with partial frames (after short read)
@@ -67,6 +69,7 @@ ver 0.19.20 (not yet released)
 * output
   - winmm: fix 8 bit playback
 * fix gcc 7.0 -Wimplicit-fallthrough
+* systemd: paranoid security settings
 
 ver 0.19.19 (2016/08/23)
 * decoder

src/LogInit.cxx

@@ -45,7 +45,7 @@ static constexpr Domain log_domain("log");
 
 #ifndef ANDROID
 
-static int out_fd;
+static int out_fd = -1;
 static AllocatedPath out_path = AllocatedPath::Null();
 
 static void redirect_logs(int fd)

src/queue/Queue.cxx

@@ -427,14 +427,15 @@ Queue::SetPriority(unsigned position, uint8_t priority, int after_order,
 
 		if (_order < (unsigned)after_order) {
 			/* the specified song has been played already
-			   - enqueue it only if its priority has just
-			   become bigger than the current one's */
+			   - enqueue it only if its priority has been
+			   increased and is now bigger than the
+			   current one's */
 
 			const unsigned after_position =
 				OrderToPosition(after_order);
 			const Item *after_item =
 				&items[after_position];
-			if (old_priority > after_item->priority ||
+			if (priority <= old_priority ||
 			    priority <= after_item->priority)
 				/* priority hasn't become bigger */
 				return true;

systemd/mpd.service.in

@@ -14,6 +14,15 @@ LimitRTTIME=infinity
 # disallow writing to /usr, /bin, /sbin, ...
 ProtectSystem=yes
 
+# more paranoid security settings
+NoNewPrivileges=yes
+ProtectKernelTunables=yes
+ProtectControlGroups=yes
+ProtectKernelModules=yes
+# AF_NETLINK is required by libsmbclient, or it will exit() .. *sigh*
+RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX AF_NETLINK
+RestrictNamespaces=yes
+
 [Install]
 WantedBy=multi-user.target
 Also=mpd.socket