Sebastian WillingandClaude Sonnet 5
42fe8e0176
fix-opera.sh runs as root and used a fixed, world-guessable temp directory (/tmp/opera-fix) created with `mkdir -p`, which succeeds silently even if the path already exists. A local unprivileged user could pre-create /tmp/opera-fix as a symlink to a directory they control and place a malicious libffmpeg.so/libwidevinecdm.so there ahead of time. When an admin later ran this script, root would copy the attacker's library into Opera's lib_extra with 0644 perms, where it gets loaded into every user's browser process on the system. Switch to `mktemp -d`, which atomically creates a private (0700), unpredictably-named directory via a bare mkdir() syscall - exclusive by nature, so it can never adopt a pre-existing path or symlink the way `mkdir -p` does. Also drop the now-redundant mkdir -p call, since mktemp already creates the directory. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Warning
Make sure, you're using latest version of this script. If not, update it (run installation steps again, say "n" when it asks for creating alias).
Since the may, 16th it doesn't get the latest libffmpeg, but checks for version compatibility.
Note
All future versions of libffmpeg will be posted in https://github.com/Ld-Hagen/nwjs-ffmpeg-prebuilt/releases instead of this repo.
Fix Opera Linux libffmpeg & WidevineCdm
- Fixes Opera html5 media content including DRM-protected one.
- This script must be executed all times opera fails on showing html5 media content.
- On Debian-based, RedHat-based and Arch-based distributions it could be started automatically after Opera each update or reinstall.
- Works only with native versions of Opera. Won't work with flatpak/snap releses.
- May not work with opera-beta and opera-develper.
Requirements
-
curl (is needed for downloading the ffmpeg lib and widevine)
unzip (is needed for unpacking the downloaded file)
git (is needed for fetching this script)
jq (is needed for parsing JSON from github)
-
(Optional) python3-dnf-plugin-post-transaction-actions (is needed for autoupdate in RedHat-based systems)
The main installer -
install.sh- auto-detects your distro and installs the both the appropriate and the optional requirements by itself, if they're missing.
Usage
-
Clone this repo
git clone https://github.com/Ld-Hagen/fix-opera-linux-ffmpeg-widevine.git -
Go to the repo root folder
cd ./fix-opera-linux-ffmpeg-widevine -
(Optional) Run script. And if it works well go to next step.
chmod +x scripts/fix-opera.sh && sudo ./scripts/fix-opera.sh -
Make install.sh executable
chmod +x ./install.sh -
Run install script and answer few questions.
sudo ./install.sh
How to uninstall
-
Clone this repo
cd /tmp && git clone https://github.com/Ld-Hagen/fix-opera-linux-ffmpeg-widevine.git -
Go to the repo root folder
cd /tmp/fix-opera-linux-ffmpeg-widevine -
Make uninstall.sh executable
chmod +x uninstall.sh -
Run uninstallation script. And if it works well go to next step.
sudo ./uninstall.sh