SageTV Web Interface

[EnterNoEscape]

Originally Posted by wayner

A request for the future would be the option to not require a user/password for the web UI. I don't think that is possible in the current version.

I would rather this be that there isn't a default username and password, but when you first access the web server, you are strongly encouraged to create one before you start doing anything. If people want to place not even the simplest of of barriers to being able to access their recordings, that's on them, but at least we tried to encourage it. What we have right now with a default username and password isn't really much better than just not having a password if the user never changes it. I've lost count of how many routers and access points I've come across where the password was not changed from the default.

Being able to create users and change passwords easily through the web interface is strongly desired. Even if there aren't any permissions associated with the users I would still want this since I'm not into sharing passwords even within my own family.

[wayner]

I recently installed the letsencrypt/nginx docker so I use that as the front end for accessing SageTV remotely. From my LAN I don't care about a password. And I also have a VPN installed on my router and VPN clients on all of my portable devices so I can also use that to access my systems remotely.

One of the reasons to want to turn off the password is that there is a driver for my Control4 home automation system for SageTV and it is very old and only works if you don't have a user/pass on your server.

By the way there are systems out there right now with ports forwarded to the internet that are using sage/frey where anyone could log in and start playing around with metadata using BMT, or schedule recordings with the web UI. In about 2 minutes I found two such systems.

edit - Speaking of security - is it a risk that Jetty shows all of the applications that you have running on a port without requiring any credentials? If you know the
IP address and port of anyone running sage you can hit that site and see that they have /sage, /sagem, /bmt, /sagealert, etc running. It is only when you try to hit one of those applications that you get challenged for credentials.

[Taddeusz]

Maybe I'm not that skilled with doing proxy pass on Nginx but because of the SageTV Web Interface using quite a lot of absolute paths I could never get it working correctly when passing a virtual path to / in SageTV. I ended up needing to have separate sage and bmt paths set for each.

[KarylFStein]

Originally Posted by wayner

One of the reasons to want to turn off the password is that there is a driver for my Control4 home automation system for SageTV and it is very old and only works if you don't have a user/pass on your server.

You should be able to configure Nginx to pass the password for you if e.g. the source is your home subnet.

[pjwerdna]

Originally Posted by wayner

edit - Speaking of security - is it a risk that Jetty shows all of the applications that you have running on a port without requiring any credentials? If you know the IP address and port of anyone running sage you can hit that site and see that they have /sage, /sagem, /bmt, /sagealert, etc running...

This is "fixable" by creating a folder called static in SageTV's "jetty" folder then putting an empty file called "index.jsp" in the static folder. Jetty then returns a 403 error.

Ive not found any unwanted side effects of this yet, but there may be some I havent noticed.

[Phydeaux]

For several years I've been using the web interface to SageTV with no issues. I have it bookmarked in my browswer including the username and password like this:

http://username:password@192.168.168.128:8080/sage/Recordings

For some reason in the last couple months when I use that bookmark I end up at a page that looks like this:

SageTV1.jpg

The right page, but not correctly formatted. If I do something on this page, for example set a recorded show as Watched and click Execute, the resulting page loads fine.

There has obviously been some sort of update a few months back that has caused this. Java 7 Update 80 is the only Java on the server and has been the same way before this issue started.

Ideas?

Cheers,
RLW

[Dargason]

Try clearing the cache and reloading the page. If you're using Chrome, you can usually click-and-hold the reload button and a menu will popup allowing you to do this.

[Phydeaux]

Sadly, clearing the browser cache made no difference. Good thought though...

RLW

[stuckless]

Originally Posted by Phydeaux

Sadly, clearing the browser cache made no difference. Good thought though...

RLW

If you are in Chome/Firefox (and possibly IE), there is usually a developer console where it can show the network requests, and in your case, you'd likely be seeing some "404" Not Found entries for some files. If that were the case, then I'd suspect that your webserver files are corrupt/deleted and you might just need to re-install. Based on your screenshot it looks like it's not downloading the css file for the page.

[Phydeaux]

Thanks Stuckless, but after getting that page subsequent loads of that and other pages are formatted fine. That's the odd thing, it's only when I initially go there using the containing my login credentials. If I omit the credentials from the URL, I'm prompted to login then the page loads fine. This is using Chrome from Linux Mint and Chrome is up to date.

If I use Firefox with the URL containing login credentials, it works fine. So seems like it may be Chrome related. Not sure what's going on...

RLW

[gary201]

Does anyone know how to change the Web Interface favorites manager so that there's a delete option for a favorite? Somehow I only have a "disable" option.

[skiingwiz]

Originally Posted by gary201

Does anyone know how to change the Web Interface favorites manager so that there's a delete option for a favorite? Somehow I only have a "disable" option.

I'm sure you saw this answer in the other thread, but this is fixed in the forthcoming version 3.2.2.

I've just subscribed to this thread, so hopefully I see these sorts of issues more quickly.

[archibael]

Originally Posted by waylo

I looked and also did not see an uninstall option. On my system, it is used by sagex-services, BMT, sagetv mobile web interface, media streaming services, and Sagetv web interface, so it's linked to many other plugins. Not sure if uninstalling all of them would open that option.

EDIT:
Okay, I figured it out.

For some reason with the upgrade, something happens to jetty in that it just won't recognize/initialize those plugins. (Also, an additional extension sagex-api wasn't running).

I have the plugin "remove plugin and dependencies" installed, a fantastic tool for determining what dependencies are associated with each plugin.

As noted above, I had several plugins associated with jetty. I uninstalled all of them, making sure to select the "Uninstall plugin and unneeded dependencies" option.

Eventually, jetty was uninstalled.

Restart Sage, and re-install the plugins you had previously uninstalled.

Done!

Unfortunately, the reinstall of Jetty and all associated plugins did not work for me, I'm still getting the complaints about "No context on this server to handle this request".

Any other ideas?

[guho]

Sometimes old jar files accumulate in the JARs directory under SageTV. That is what happened to me when I upgraded to Sage Web Server 4.0. The old 3.3.1 jar was still there and many other old JARs. After housecleaning my web server works again (it broke after plugin updates).