"Leaking" inaccessible music info to other users

[Tonch_MS 4]

I couldn't figure out how to phrase this, but I was wondering if it's known or intended behavior for Emby to show music info to users who are unable to access the files. My music library consists of multiple folders, some accessible to some users and some not.

For instance, say I have a private and a public music folder, and I have all the Beatles albums in the private folder so User A can access it, but User B can't. User B can access the music library, but only the "public" folder. However, in my case User B still gets suggestions in search for "The Beatles" as an artist entry, and can see their albums as well. However, User B still can't play the songs, but knows what the artists and albums are in the "private" folder. This does NOT happen if I remove User B's access to the whole music library entirely, although on a blank search page such info will still be suggested at random from seemingly anything in any of the libraries.

This also seems to happen with shows and movies where people can see actors and possibly other metadata in the database that comes from files they have no access to.
For example, if I, as User A, added a custom made-up actor to a show or movie that User B has no access to, they can still search for and find the entry for that custom actor, even though they can't see what it belongs to.

Is there a way to mitigate this that I missed?

Edited August 15, 2024 by Tonch_MS

[Abobader 3464]

Hello Tonch_MS,

** This is an auto reply **

Please wait for someone from staff support or our members to reply to you.

It's recommended to provide more info, as it explain in this thread:

Thank you.

Emby Team

[Happy2Play 9780]

What server version?  But if I remember correctly, these are fixed in beta but will double check when I get a chance.

[Tonch_MS 4]

Ah sorry, I should have mentioned. I've only been using stable, it's 4.8.8.0.

[Tigga5 39]

Given that I’ve discovered three different ways to bypass user authentication since version 4.8, I would advise against using Emby for anything that you want to keep private.

[Luke 42077]

Hi, what folder paths are added to you music library?

[Tonch_MS 4]

2 hours ago, Luke said:

Hi, what folder paths are added to you music library?

I've got it set up like:

Music > Music A, Music B

Where one user has access to both Music A and B, and the other user only has access to Music B.

[Luke 42077]

What are the exact folder paths?

[Tonch_MS 4]

The libraries are spread across multiple drives passed through Proxmox, though the music is all on one drive currently. (Also pay no attention that the paths are still named "plex", I obviously never renamed them after switching to Emby and they've been that way since, ha ha)

 

The paths as Emby sees them are:

/plex-e/Plex/Music/MusicA

and then the same but MusicB alongside MusicA.

Edit: to give a bit more detail, Emby is running in a LXC container on a Proxmox server. The server is mounting the drive inside the container at the root of the path I showed.

Edited August 16, 2024 by Tonch_MS

[Luke 42077]

OK, how many Emby libraries have you created, and what folder paths are added to each one?

[Tonch_MS 4]

I have movies, music, shows, and YouTube.

There are many paths across multiple drives:

• /plex-4k1/Movies
• /plex-c/Plex/Movies
• /plex-c/Plex/Movies2
• /plex-d/Plex/Movies
• /plex-e/Plex/Movies
• /plex-e/Plex/Movies2

 

• /plex-e/Plex/Music/MusicA
• /plex-e/Plex/Music/MusicB

 

• /plex-4k1/Shows
• /plex-c/Plex/Shows
• /plex-c/Plex/Shows2
• /plex-d/Plex/Shows
• /plex-e/Plex/Shows
• /plex-e/Plex/Shows2

 

• /plex-d/Plex/YouTube
• /plex-e/Plex/YouTube
• /plex-c/Plex/YouTube
• /plex-d/Plex/YouTube2

[Luke 42077]

Hi @Tonch_MShave you updated to Emby Server 4.8.10? Has that helped?

[Tonch_MS 4]

I haven't yet, I can try updating tonight and see.

[Tonch_MS 4]

@LukeI updated, and nothing related to this issue seems to have changed. The search still displays artists and albums (but not the actual tracks) for users who are unable to access them.

[Happy2Play 9780]

On 10/22/2024 at 11:51 AM, Luke said:

Hi @Tonch_MShave you updated to Emby Server 4.8.10? Has that helped?

With a quick test I can say it works in 4.9.0.30 but not 4.8.10.0.

Tested with music in both folders but the artist/group only existed in one folder for the test.  User A saw all and User B did not see the test artist/group/album that was in the library they were restricted from.

[Tonch_MS 4]

Right, I should have mentioned I only updated to the latest stable release. Hopefully it really does work in the newer version though, I look forward to testing it myself.