siftlode/backend/app/downloads
npeter83 2a44db04d8 chore(downloads): C1+C2 — drop dead target_ext; centralize path-traversal guard
- C1: remove downloads/formats.py target_ext() — defined but never called (the
  worker derives the real extension from the produced file's suffix).
- C2: the download-root containment+existence guard was copy-pasted 6× across the
  file-serving endpoints (routes/downloads.py ×3, routes/public.py ×3). Extract
  storage.safe_abs_path(root, rel) -> Path|None so this security-sensitive check
  lives in one place; behavior identical (same containment test + messages). The
  extraction also made `pathlib.Path` unused in both route modules (removed).
2026-07-11 05:41:43 +02:00
..
__init__.py fix(downloads): add the downloads package (was wrongly gitignored) + robust sanitizer 2026-07-03 00:19:22 +02:00
backfill.py fix(share): self-host og:image so link previews stay reliable 2026-07-07 22:43:18 +02:00
edit.py feat(downloads): clickable channels + poster fallback for thumbnail-less sources 2026-07-07 22:28:49 +02:00
formats.py chore(downloads): C1+C2 — drop dead target_ext; centralize path-traversal guard 2026-07-11 05:41:43 +02:00
gc.py feat(downloads): M3 — per-user quota + retention GC 2026-07-03 00:26:40 +02:00
links.py feat(downloads): clickable channels + poster fallback for thumbnail-less sources 2026-07-07 22:28:49 +02:00
og.py fix(share): self-host og:image so link previews stay reliable 2026-07-07 22:43:18 +02:00
quota.py feat(downloads): M4 — REST API (enqueue, manage, file-serve, sharing, admin) 2026-07-03 00:34:08 +02:00
service.py fix(downloads): clip long titles to fit display_name (VARCHAR 255) 2026-07-07 21:40:15 +02:00
storage.py chore(downloads): C1+C2 — drop dead target_ext; centralize path-traversal guard 2026-07-11 05:41:43 +02:00