T.ME/BIBIL_0DAY
CasperSecurity


Server : Apache/2
System : Linux server-15-235-50-60 5.15.0-164-generic #174-Ubuntu SMP Fri Nov 14 20:25:16 UTC 2025 x86_64
User : gositeme ( 1004)
PHP Version : 8.2.29
Disable Function : exec,system,passthru,shell_exec,proc_close,proc_open,dl,popen,show_source,posix_kill,posix_mkfifo,posix_getpwuid,posix_setpgid,posix_setsid,posix_setuid,posix_setgid,posix_seteuid,posix_setegid,posix_uname
Directory :  /home/gositeme/domains/soundstudiopro.com/private_html/

Upload File :
current_dir [ Writeable ] document_root [ Writeable ]

 

Current File : /home/gositeme/domains/soundstudiopro.com/private_html/STEMS_ANALYSIS.md
# Stems Implementation Analysis - library.php

## Issues Found

### 🔴 CRITICAL BUG #1: Missing Metadata in API Response
**Location**: `api/get_track_details.php`
**Problem**: The API parses metadata (line 53) but doesn't include it in the response (lines 56-69)
**Impact**: `showStemsModal()` JavaScript function can't access `track.metadata`, so stems never load
**Fix**: Add `'metadata' => $metadata` to the `$processed_track` array

### 🟡 BUG #2: Stem Detection Logic Too Restrictive
**Location**: `library.php` lines 3789-3802
**Problem**: Only checks for stems if `music_type === 'stem-separation'`
**Impact**: Tracks that have stems in metadata but different music_type won't show stem button
**Fix**: Check metadata for `stem_files` or `stems` regardless of music_type

### 🟡 BUG #3: Unsigned URLs for Stem Downloads
**Location**: `library.php` lines 9995-9996
**Problem**: Stem URLs are used directly without signed URLs
**Impact**: Security risk - direct access to audio files
**Fix**: Use `getSignedAudioUrl()` for stem downloads

### 🟡 BUG #4: Button Logic Issue
**Location**: `library.php` lines 3805-3813
**Problem**: Shows "Separate into Stems" button even for processing/failed tracks
**Impact**: Confusing UX - button should only show for complete tracks
**Fix**: Add status check before showing stem separation button

### 🟡 BUG #5: Inconsistent Stem Data Structure
**Location**: `library.php` lines 9950-9959
**Problem**: JavaScript tries to convert `stems` format but structure might vary
**Impact**: Some stems might not display correctly
**Fix**: Standardize stem data structure handling

## Current Stem Data Structure

From `callback.php` (lines 1780-1797):
```php
$stemFiles[] = [
    'name' => $stemName,           // e.g., "vocals", "drums", "bass"
    'url' => $localStemUrl,        // Local stored URL
    'original_url' => $stemAudioUrl, // Original API URL
    'index' => $stemIndex          // 0, 1, 2, etc.
];
```

Stored in metadata as:
```json
{
  "stem_files": [...],
  "stem_count": 4
}
```

## Recommended Fixes

1. ✅ **Fix API to return metadata** - FIXED: Added `'metadata' => $metadata` to API response
2. ✅ **Improve stem detection** - FIXED: Now checks metadata regardless of music_type
3. ⚠️ **Add signed URLs** - DEFERRED: Stems use direct URLs for now (can be enhanced later with dedicated endpoint)
4. ✅ **Fix button visibility** - FIXED: Stem separation button only shows for complete tracks
5. ✅ **Standardize stem handling** - FIXED: Improved JavaScript to handle multiple stem data formats

## Fixes Applied

### ✅ Fix #1: API Metadata Response
**File**: `api/get_track_details.php`
- Added `'metadata' => $metadata` to the response array
- Now JavaScript can access `track.metadata.stem_files`

### ✅ Fix #2: Improved Stem Detection
**File**: `library.php` lines 3783-3803
- Removed restriction to only `music_type === 'stem-separation'`
- Now checks metadata for `stem_files` or `stems` regardless of track type
- Added support for `stem_count` in metadata

### ✅ Fix #3: Button Visibility Logic
**File**: `library.php` lines 3805-3813
- Added status check: stem separation button only shows for `status === 'complete'`
- Prevents confusion on processing/failed tracks

### ✅ Fix #4: JavaScript Stem Handling
**File**: `library.php` lines 9950-10002
- Improved stem data normalization
- Better handling of multiple stem data formats (`stem_files`, `stems`, legacy formats)
- Enhanced URL escaping for security
- Filters out stems without valid URLs

## Remaining Enhancement Opportunities

1. **Signed URLs for Stems**: Create dedicated API endpoint for stem signed URLs (similar to variations)
2. **Stem Type Display**: Show more descriptive stem types (vocals, drums, bass, etc.)
3. **Stem Preview**: Add waveform preview for each stem
4. **Batch Download**: Allow downloading all stems as ZIP


CasperSecurity Mini