[WebUI] File selection & others

[István Kondor]

File selection:
Going to the Files tab in the webui and changing the priority of a file in a torrent is ineffective. It seems at first that it is done, but then in qB 2.0.6 it switches back immediately to its original state, in qB 2.1.0rc6 it changes back only if I click on an other torrent then I go back. No effect whatsoever in any case.

Icons:
The small qB icon should be displayed in its tab and next to its url. Plus it should show up if I create a bookmark for it. (For the bookmark I got the blue ktorrent icon, which you use for downloads in the preferences tab with qB 2.0.6, but nothing with 2.1rc6.) Please see attachment.

Preferences:
Being able to change the webui login information in the webui preference tab can cause security issues in my opinion. Maybe you should consider removing it.

Main window:
(Not the webui!) I get this ugly scrollbar for the predefined labels, but I can't resize that area to get rid of it.

[István Kondor (kondor)]

Attachment to show the unnecessary scrollbar in the main window.

[Christophe Dumez (hydr0g3n)]

> File selection:
> Going to the Files tab in the webui and changing the priority of a file in a torrent is ineffective. It seems at first that it is done,
> but then in qB 2.0.6 it switches back immediately to its original state, in qB 2.1.0rc6 it changes back only if I click on an other
> torrent then I go back. No effect whatsoever in any case.

Cannot reproduce here. Make sure the torrent is not complete yet. libtorrent does not allow to filter files in a torrent that is complete (because there is no point in doing so).

> Icons:
> The small qB icon should be displayed in its tab and next to its url. Plus it should show up if I create a bookmark for it. (For
> the bookmark I got the blue ktorrent icon, which you use for downloads in the preferences tab with qB 2.0.6, but nothing
> with 2.1rc6.) Please see attachment.
You're talking about the favicon I think. I have just fixed it in SVN. Thanks.

> Preferences:
> Being able to change the webui login information in the webui preference tab can cause security issues in my opinion.
> Maybe you should consider removing it.
We will have to agree to disagree :) I don't see why this is a security risk. You need to have access credentials in order to edit Web UI preferences. So I don't see how people can exploit this. Moreover, qBittorrent can now run without GUI and the Web UI is the only way to control it. Thus, all preferences must be editable via the Web UI, especially the Web UI credentials because the user have to change the default values.

> Main window:
> (Not the webui!) I get this ugly scrollbar for the predefined labels, but I can't resize that area to get rid of it.
Should be fixed in svn. Thanks.

[leigh123linux (leigh123linux-deactivatedaccount)]

>We will have to agree to disagree :) I don't see why this is a security risk. You need to have access credentials in >order to edit Web UI preferences. So I don't see how people can exploit this. Moreover, qBittorrent can now run >without GUI and the Web UI is the only way to control it. Thus, all preferences must be editable via the Web UI, >especially the Web UI credentials because the user have to change the default values.

The Web UI is open to a brute force attack as there is no cut off point for failed logins , it would be good to limit it to 5 attempts before locking the IP out.

[Christophe Dumez (hydr0g3n)]

Yes, I want to make the Web UI more secure too. I'll work on this soon. I'm also considering HTTPS but it requires generating keys.

[István Kondor (kondor)]

Thanks for the fixes!

The problem with the file priorities are the following:
-- I have to log into the remote machine to add a file in paused mode. This is necessary e.g. if I have less space than the torrent (I don't want to download the whole thing).
-- Torrent is added in paused mode -> I started to download 1 file in the given torrent.
-- That file finished -> I wanted to start an other one, so tried to change priority.
-- I failed as written in the initial report.

Any ideas?

[István Kondor (kondor)]

I feel really silly now. I retested everything and it *just works*. Sorry about this.

By the way, an "Add in paused mode" option would be nice in the webui when adding torrents.

[István Kondor (kondor)]

OK, I managed to reproduce the problem. You were right, it must be connected to libtorrent-rasterbar. When the already started file finishes libtorrent assumes that it's a seeding only torrent which is simply not the case, because I don't have all the files.
Though it's still possible to change the priority in the main window, but not in the webui. So I assume you should be able to do something about it.

Thanks for your time and efforts!

[Christophe Dumez (hydr0g3n)]

Ok, I filed a bug against libtorrent:
http://code.google.com/p/libtorrent/issues/detail?id=18

Depending on the libtorrent version you have, you can indeed do it from the GUI (but not the Web UI). This is because the GUI and the Web UI use two different libtorrent functions for this. Libtorrent author forgot the check in one of the two functions (but he fixed it in recent svn).

I do agree that the check is incorrect though, thus the bug report against libtorrent.

[Christophe Dumez (hydr0g3n)]

1) File selection from Web UI has been fixed in SVN.

2) Web UI has been protected against brute forcing (3 failed attempts and you're banned until qBittorrent is restarted)