From 7e5be6094f6fb9bc00ff3eee9e4e4b799c98ce3c Mon Sep 17 00:00:00 2001
From: Marlon Alkan <info@maluu.eu>
Date: Sun, 8 Jun 2025 16:45:34 +0200
Subject: [PATCH 1/3] docker: init: 02-postgres.sh: allow DB user to create new
 DB (for tests)

---
 docker/init/02-postgres.sh | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/docker/init/02-postgres.sh b/docker/init/02-postgres.sh
index 69a81dd4..7bb90671 100644
--- a/docker/init/02-postgres.sh
+++ b/docker/init/02-postgres.sh
@@ -57,13 +57,14 @@ if [ -z "$(ls -A $POSTGRES_DIR)" ]; then
         echo "Creating PostgreSQL database..."
         su - postgres -c "createdb -p ${POSTGRES_PORT} ${POSTGRES_DB}"
 
-        # Create user, set ownership, and grant privileges
+        # Create user, set ownership, and grant privileges, including privileges to create new databases
         echo "Creating PostgreSQL user..."
         su - postgres -c "psql -p ${POSTGRES_PORT} -d ${POSTGRES_DB}" <<EOF
 DO \$\$
 BEGIN
     IF NOT EXISTS (SELECT FROM pg_roles WHERE rolname = '$POSTGRES_USER') THEN
         CREATE ROLE $POSTGRES_USER WITH LOGIN PASSWORD '$POSTGRES_PASSWORD';
+        ALTER ROLE $POSTGRES_USER CREATEDB;
     END IF;
 END
 \$\$;

From 192edda48e627a2d17a3990fac6473520fe907e6 Mon Sep 17 00:00:00 2001
From: Marlon Alkan <info@maluu.eu>
Date: Sun, 8 Jun 2025 16:47:00 +0200
Subject: [PATCH 2/3] apps: output: change body detection logic and add tests

---
 apps/output/tests.py | 23 +++++++++++++++++++++++
 apps/output/views.py |  5 +++--
 2 files changed, 26 insertions(+), 2 deletions(-)

diff --git a/apps/output/tests.py b/apps/output/tests.py
index e1e857ee..f87c8340 100644
--- a/apps/output/tests.py
+++ b/apps/output/tests.py
@@ -14,3 +14,26 @@ class OutputM3UTest(TestCase):
         self.assertEqual(response.status_code, 200)
         content = response.content.decode()
         self.assertIn("#EXTM3U", content)
+
+    def test_generate_m3u_response_post_empty_body(self):
+        """
+        Test that a POST request with an empty body returns 200 OK.
+        """
+        url = reverse('output:generate_m3u')
+
+        response = self.client.post(url, data=None, content_type='application/x-www-form-urlencoded')
+        content = response.content.decode()
+
+        self.assertEqual(response.status_code, 200, "POST with empty body should return 200 OK")
+        self.assertIn("#EXTM3U", content)
+
+    def test_generate_m3u_response_post_with_body(self):
+        """
+        Test that a POST request with a non-empty body returns 403 Forbidden.
+        """
+        url = reverse('output:generate_m3u')
+
+        response = self.client.post(url, data={'evilstring': 'muhahaha'})
+
+        self.assertEqual(response.status_code, 403, "POST with body should return 403 Forbidden")
+        self.assertIn("POST requests with body are not allowed, body is:", response.content.decode())
diff --git a/apps/output/views.py b/apps/output/views.py
index 2b18d185..ff02560c 100644
--- a/apps/output/views.py
+++ b/apps/output/views.py
@@ -18,9 +18,10 @@ def generate_m3u(request, profile_name=None):
     The stream URL now points to the new stream_view that uses StreamProfile.
     Supports both GET and POST methods for compatibility with IPTVSmarters.
     """
-    # Check if this is a POST request with data (which we don't want to allow)
+    # Check if this is a POST request and the body is not empty (which we don't want to allow)
     if request.method == "POST" and request.body:
-        return HttpResponseForbidden("POST requests with content are not allowed")
+        if request.body.decode() != '{}':
+            return HttpResponseForbidden("POST requests with body are not allowed, body is: {}".format(request.body.decode()))
 
     if profile_name is not None:
         channel_profile = ChannelProfile.objects.get(name=profile_name)

From acbcc46a916ae031f76ec6abd8d94635f4534de1 Mon Sep 17 00:00:00 2001
From: SergeantPanda <chester.cullen@gmail.com>
Date: Fri, 14 Nov 2025 17:32:05 -0600
Subject: [PATCH 3/3] Revert "docker: init: 02-postgres.sh: allow DB user to
 create new DB (for tests)"

This reverts commit 7e5be6094f6fb9bc00ff3eee9e4e4b799c98ce3c.
---
 docker/init/02-postgres.sh | 1 -
 1 file changed, 1 deletion(-)

diff --git a/docker/init/02-postgres.sh b/docker/init/02-postgres.sh
index 93a808fa..e36dd744 100644
--- a/docker/init/02-postgres.sh
+++ b/docker/init/02-postgres.sh
@@ -122,7 +122,6 @@ DO \$\$
 BEGIN
     IF NOT EXISTS (SELECT FROM pg_roles WHERE rolname = '$POSTGRES_USER') THEN
         CREATE ROLE $POSTGRES_USER WITH LOGIN PASSWORD '$POSTGRES_PASSWORD';
-        ALTER ROLE $POSTGRES_USER CREATEDB;
     END IF;
 END
 \$\$;