Skip to content

[plugin.audio.classicalradio] v1.0.0 - #4837

Open
edouardduliege wants to merge 3 commits into
xbmc:omegafrom
edouardduliege:plugin.audio.classicalradio
Open

edouardduliege wants to merge 3 commits into
xbmc:omegafrom
edouardduliege:plugin.audio.classicalradio

Conversation

@edouardduliege

Copy link
Copy Markdown

Initial submission of the ClassicalRadio community add-on for Kodi.

The add-on provides linear ClassicalRadio playback for AudioAddict account holders, including:

  • channel browsing
  • Popular and New views
  • favourites synchronisation
  • Premium stream quality selection
  • bounded stream-server probing and conservative fallback
  • dynamic Now Playing metadata
  • secure session reuse
  • English and French localisation

The add-on targets Linux and uses kernel-managed playback-state locking with flock.

This is an unofficial community add-on and is not affiliated with, endorsed by, or supported by ClassicalRadio or AudioAddict.

The add-on uses original community artwork and does not redistribute the official ClassicalRadio logo.

@coderabbitai

coderabbitai Bot commented Sep 25, 2026 •

Copy link
Copy Markdown

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: c999b7c5-658f-4b67-ac46-7b35f49e664d

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@greptile-apps

greptile-apps Bot commented Sep 25, 2026 •

Copy link
Copy Markdown

RetriggerConfidence Score: 4/5

[Medium risk] New Kodi audio plugin for ClassicalRadio streaming.

The PR is not ready to merge while the Favorites view cannot reliably remove favorites.

Findings

  1. P1 Favorites show the wrong action ▶
  2. P2 Security Playlist URLs can reach private services ▶
  3. P2 Security Redirects can expose session keys ▶
  4. P2 Redirected streams may lose metadata ▶
  5. P2 Restarts can receive stale metadata ▶
Summary

Adds a Linux-targeted ClassicalRadio Kodi add-on with account authentication, channel and favorites browsing, Premium stream selection, and a background Now Playing service.

  • Favorites removal is broken in the Favorites view when channel IDs are numeric.
  • Stream and authenticated API redirects need tighter destination handling; playback identity and redirected-stream metadata need attention.
Diagram
%%{init: {'theme': 'neutral'}}%%
flowchart LR
  A[Kodi directory plugin] --> B[AudioAddict client]
  B --> C[Channels and favorites API]
  B --> D[PLS playlist]
  D --> E[Stream probe]
  E --> F[Kodi playback]
  A --> G[Playback state]
  G --> H[Metadata service]
  H --> B
  H --> F
Loading

Reviews (1) · Last reviewed commit: "[plugin.audio.classicalradio] v1.0.0"

Comment thread plugin.audio.classicalradio/default.py
line = raw_line.strip()
if line.lower().startswith("file") and "=" in line:
candidate = line.split("=", 1)[1].strip()
if candidate.startswith("http"):

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 security Playlist URLs can reach private services If a remote playlist supplies a loopback or private-network URL, or redirects to one, opening the channel makes the Kodi device send a GET to that destination. Checking only that the entry starts with http does not restrict where the probe goes. Validate destinations, including redirects, before requesting or playing them. How this was verified: Playlist entries flow directly into a redirect-following GET without a host or address check.

)

try:
response = self.http.get(

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 security Redirects can expose session keys If the API redirects an authenticated request to another origin, the request follows that redirect with its custom X-Session-Key header, exposing the user's session key to the destination. Restrict authenticated redirects to the API origin or remove the header before following them. How this was verified: The authenticated request sets X-Session-Key and follows redirects without checking the destination origin.

Comment on lines +181 to +189

if playing_file != expected_stream:
xbmc.log(
"[plugin.audio.classicalradio] playing stream mismatch in service loop: "
f"getPlayingFile={safe_url_for_log(playing_file)!r}, "
f"state_stream_url={safe_url_for_log(expected_stream)!r}",
xbmc.LOGDEBUG,
)
continue

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Redirected streams may lose metadata If Kodi reports a redirected or normalized playing URL, it will differ from the original playlist URL saved in playback state. This exact comparison then skips every Now Playing update. Test redirected streams against Kodi's reported URL and use a playback check that accommodates the difference.

Comment on lines +33 to +38
if (
latest_state.get("mode") != "linear"
or latest_state.get("channel_key") != channel
or latest_state.get("stream_url") != state.get("stream_url")
):
return

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Restarts can receive stale metadata If a channel restarts with the same stream URL while a metadata lookup is in progress, this check treats the new playback as the old one. The earlier lookup can then update the new playing item and its saved track ID. Give each playback a unique identifier and check it before applying the update.

Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>
@romanvm

romanvm commented Sep 26, 2026

Copy link
Copy Markdown

PUBLICATION_CHECKLIST.md here as well.

@edouardduliege

Copy link
Copy Markdown
Author

PUBLICATION_CHECKLIST.md has been removed

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants