Cherrymusic

- FIXED: *Security* CVE-2015-8309 Download of arbitrary files by logged in users (thanks
feedersec)
- FIXED: *Security* CVE-2015-8310 XSS attack by logged-in users (thanks feedersec)
- FIXED: OGA files are now correctly recognized as ogg-audio files
- FIXED: Sorting tracks by track number correctly
- FIXED: Cannot load playlists containing single quotes
- FEATURE: allow reverse-sorting of playlists (thanks pando85)
- FEATURE: Enabled support of ffmpeg to decode ALAC files
- FEATURE: Added optional support for Pillow as Image Library
- IMPROVEMENT: disabled confirm-to-quit message for playlist downloads
- IMPROVEMENT: Updated TinyTag to version 0.10.1 (much faster ID3 parsing)
- IMPROVEMENT: Predictable selection of album-art images (thanks lzh9102)
- FIXED: Removed restrictions for passwords created in CLI

- FIXED: server not starting on windows

- FIXED: server not starting for python versions below 3.3

- FEATURE: Opus transcoding support (thanks to qqueue)
- FEATURE: Support for media keys (thanks to cheese83)
- FIXED: File browser crash, when listing unreadable files (thanks to Tom Clegg)
- FIXED: Album art fetching breaking for very file paths (thanks to Che-Huai Lin)
- FIXED: Broken file listing if basedir does not end with a slash
- FIXED: Proper cover art display in safari (thanks to yukip)
- FIXED: Searching for terms ending in non ASCII-characters
- FIXED: keyboard shortcut settings for unrecognized keys (thanks cheese83)
- IMPROVEMENT: devel git version detection (thanks to MartijnRas)
- IMPROVEMENT: More transcoding quality settings (thanks to Druneau)
- IMPROVEMENT: Show first track after loading playlist
- IMPROVEMENT: Allow indexing of symlinked files

- FIXED: Queue not visible due to outdated jPlayer

- FEATURE: sorting of queue and open playlists via dropdown menu
- FEATURE: option to display active album art in player (thanks to lzh9102)
- FEATURE: enable intertial scroll on mobile (thanks to tkafka)
- FIXED: updated jPlayer to version 2.7.1 to fix playback on android
- FIXED: workaround for CherryPy (>=3.3.0) bug when releasing session locks
- FIXED: authentication for /serve resource (thanks to susnux for spotting)
- FIXED: album art search works with new amazon and bestbuy web sites
- FIXED: udated tinytag to v0.7.2 to decode ID3 tags from latin1
- FIXED: admin GUI can again create new users as admin
- FIXED: restore "change password" functionality
- FIXED: various problems when filecache entries no longer exist on disk
- FIXED: some quirks in playlist age display were forcefully retired
- FIXED: server handles bad basedir configuration gracefully
- FIXED: updated jquery-ui to 1.11.1, does not ruin the js-compression anymore
- FIXED: localhost_only bind address respects server.ipv6_enabled setting
- IMPROVEMENT: transcoded tracks have a duration in player (thanks to lzh9102)
- IMPROVEMENT: "folder" items are now easier to click
- IMPROVEMENT: request meta data for one track at a time to reduce server load
- IMPROVEMENT: expand CI tests to include Python 3.4 and PyPy3
- IMPROVEMENT: expand CI tests to more versions of CherryPy
- IMPROVEMENT: easier pypi releases via auto-conversion of README.md -> .rst