Changelog

All notable changes to MüüsP3Player will be documented in this file.

[0.9.0] - 2025-10-22

Changed - Statistics Visualization Improvements

• 🎨 Paintball Splatter Effect - Position heatmap now shows colorful "paint impacts" instead of simple dots
• 📊 Multi-Color Visualization - 5 vibrant colors (Orange, Red, Gold, Hot Pink, Purple) randomly assigned to points
• 📏 Optimized Chart Height - Position heatmap reduced from 400px to 250px for better layout
• 🎯 Splatter Details - Each 2-second point creates main impact (6-8px) plus 3-5 small splatter points (2-4px)

Added

• ✨ Realistic paint splatter effect with randomized spread (±2s horizontal, ±10 units vertical)
• 🎨 Color-grouped datasets for better rendering performance
• 📊 Fixed Y-axis range (0-100) for consistent visualization height

Technical Details

• Position heatmap uses Chart.js scatter plot with multiple datasets
• Main impact points: 6-8px radius with 0.7 alpha transparency
• Splatter points: 2-4px radius with 0.5 alpha transparency
• Random color assignment from paintballColors array
• Creates "point clouds" at frequently played positions

[0.8.0] - 2025-10-22

Changed - Login Redesign - See Flow Diagram

• 🎨 Login als Overlay - Nicht mehr separate Seite, erscheint über der App
• ⚡ Direkter Apache Auth Test - Kein login.py mehr, Authentication via geschütztem File
• 🌍 UTF-8 Passwörter - NFC Normalisierung für Umlaute (ä, ö, ü)
• 📱 Custom Dropdown nur für Android - Natives Dropdown für iOS/Desktop
• 👁️ Password Show/Hide Toggle - Bessere UX mit Auge-Icon

Added

• ✨ Loading Spinner während Login
• ✨ Smooth Fade-In/Out Animationen für Login Overlay
• ✨ Auto-Focus auf Username-Feld
• ✨ Enter-Taste submittet Login-Form
• 🔒 .auth-test File für Apache Auth Validierung

Changed

• ⚙️ Statistik Minimum - Erhöht von 3 auf 10 Sekunden
• 🔒 Security - Require valid-user statt hardcoded username
• 🔒 Security - .auth-test in root .htaccess geschützt

Removed

• ❌ login.py - Nicht mehr benötigt (Apache Auth direkt)
• ❌ login.html - Ersetzt durch Overlay in index.html

Technical Details

• Login Overlay zeigt sich automatisch wenn keine Credentials in localStorage
• JavaScript testet Auth mit fetch('Repertoire/.auth-test')
• UTF-8 NFC Normalisierung: password.normalize('NFC')
• Base64 Encoding: btoa(unescape(encodeURIComponent(...)))
• Custom Dropdown nur via isAndroid() User-Agent Detection

[0.7.0] - 2025-10-21

Changed - Major Authentication Overhaul

• 🔐 Migrated to Apache HTTP Basic Authentication (from session-based auth) - See Flow Diagram
• ⚡ Files now served directly by Apache (native speed, no Python CGI overhead)
• 💾 Credentials stored in browser localStorage (persistent login)
• 🔑 One password for everything (.htpasswd file managed with htpasswd command)
• 🚀 JavaScript automatically sends Basic Auth headers with fetch requests

Added

• 📦 Cache busting for songs.py to prevent stale data
• 🛡️ CSP updated to allow blob: URLs for authenticated media loading
• ✅ Password validation using htpasswd -v command (100% Apache compatibility)

Fixed

• 🐛 Browser hang issue when loading large MP3 files (4MB+)
• 🔧 UTF-8 encoding issues with passwords (ASCII-only recommended)
• 🎵 Audio playback now uses fetch() + Blob URLs for authenticated requests

Removed

• ❌ serve-file.py - No longer needed (Apache serves files directly)
• ❌ check-auth.py - No longer needed
• ❌ sessions.dat - Session-based auth replaced with HTTP Basic Auth
• ❌ Debug logging from production code

Technical Details

• Authentication: Apache Basic Auth via .htpasswd + Repertoire/.htaccess
• Note: In v0.7.0, login.py validated credentials (removed in v0.8.0)
• Frontend stores credentials in localStorage and sends via Authorization header
• MP3/PDF files fetched with auth, converted to Blob URLs for playback

[0.6.0] - 2025-10-21

Added

• 📄 PDF sheet music viewer (automatically matches PDF to track name)
• 🎯 Smart PDF matching algorithm based on string similarity
• 🎨 Icon-based speed control buttons (▼ ▲ ↺)
• 🏷️ "Speed:" label matching Song/Track label style
• 🚀 Caching headers for PDFs and MP3 files (1 month)

Changed

• 🔧 Backend API now includes PDF listing for each song
• ⚡ Speed control redesigned: replaced slider with +/- buttons for better mobile UX
• 🎨 Speed control uses Unicode symbols instead of text labels
• 📝 Button text improvements: "Clear Loop" → "Reset", "PDF" → "View PDF"
• 🔄 PDF opens in new tab using link-element trick (avoids popup blocker)
• 📱 Speed display moved to info panel (removed redundant display)

Fixed

• 🐛 Songs with dots in name (e.g., "Nr. 1", "Nr. 3") now work correctly
• 🔒 Added dot (.) to allowed characters in path validation

[0.5.0] - 2025-10-20

Added

• 🍪 Environment-specific cookies (dev/prod separation)
• 📅 Deployment date display in footer
• 🔄 Automatic README.md to README.html conversion
• ⚙️ Automatic environment configuration (config.py)
• 🎨 Favicon support in all pages
• 📊 Server-side statistics tracking (shared across all users)

Fixed

• 🐛 Cookie conflicts between dev and prod environments
• 🐛 Race condition in play button functionality
• 🔒 Path traversal vulnerability in songs.py
• 🔒 XSS vulnerability in statistics.html
• 🔒 Client-side only authentication

Changed

• ⚡ Progress line color changed to white for better contrast
• 🎨 Removed "auswählen" text from labels (cleaner UI)
• 📦 Improved deployment scripts with automatic config generation

Security

• 🔒 Server-side session authentication implemented
• 🔒 Password stored as SHA-256 hash (not plaintext)
• 🔒 Input validation and sanitization added
• 🔒 Security headers enabled (CSP, X-Frame-Options, etc.)
• 🔒 Debug mode disabled in production
• 🔒 CORS wildcard removed

[0.4.0] - 2025-10-20

Initial Release

• 📊 Waveform visualization with time scale
• 🔄 Draggable A-B loop markers
• ⚡ Speed control (0.4x - 1.5x) with pitch preservation
• 🔒 Password-protected access
• 📱 Mobile-optimized interface
• 📈 Basic statistics tracking (localStorage)

---

Note: Version 0.4.0 was the first documented release after initial development.