SergeantPanda 7083c512be security: Fixed path traversal vulnerability in file uploads. The M3U account upload (apps/m3u/api_views.py), logo upload (apps/channels/api_views.py), and backup upload (apps/backups/api_views.py) all used the uploaded filename directly without sanitization. os.path.join() discards all preceding components when it encounters an absolute path segment, and pathlib's / operator behaves identically; a relative ../ sequence also escapes via OS path resolution at open() time. All three upload paths now strip directory components via Path(name).name and validate the resolved path remains within the intended upload directory. Exploiting any of these required admin credentials.		2026-04-09 21:32:36 -05:00
..
migrations	Bug Fix: Stream.last_seen and ChannelGroupM3UAccount.last_seen model defaults now use django.utils.timezone.now instead of datetime.datetime.now, eliminating spurious RuntimeWarning: DateTimeField received a naive datetime warnings emitted during test database creation and on new record creation when USE_TZ=True.	2026-03-15 16:59:51 -05:00
tests	fix(dvr): prevent duplicate recordings after EPG refresh	2026-03-20 11:48:06 -05:00
__init__.py	Initial commit	2025-02-18 11:14:09 -06:00
admin.py	epg refactor, new relations and matching	2025-03-26 13:28:03 -04:00
api_urls.py	Updated url path	2025-12-16 23:06:49 -06:00
api_views.py	security: Fixed path traversal vulnerability in file uploads. The M3U account upload (apps/m3u/api_views.py), logo upload (apps/channels/api_views.py), and backup upload (apps/backups/api_views.py) all used the uploaded filename directly without sanitization. os.path.join() discards all preceding components when it encounters an absolute path segment, and pathlib's / operator behaves identically; a relative ../ sequence also escapes via OS path resolution at open() time. All three upload paths now strip directory components via Path(name).name and validate the resolved path remains within the intended upload directory. Exploiting any of these required admin credentials.	2026-04-09 21:32:36 -05:00
apps.py	Refactor stats and vod proxy	2025-09-05 19:30:13 -05:00
forms.py	Forms support floats now.	2025-05-15 15:32:21 -05:00
models.py	merged in dev	2026-03-26 12:17:43 -04:00
serializers.py	Enhancement: Added stream_id (provider stream identifier) and stream_chno (provider channel number) fields to Stream model. For XC accounts, the stream hash now uses the stable stream_id instead of the URL when hashing, ensuring XC streams maintain their identity and channel associations even when account credentials or server URLs change. Supports both XC num and M3U tvg-chno/channel-number attributes.	2026-01-31 17:47:46 -06:00
signals.py	fix(dvr): add DVR search/filters, fix in-progress scheduling, prevent duplicate recordings	2026-03-04 10:21:03 -06:00
tasks.py	fix: resolve decode_responses migration bugs and user-limit regressions	2026-03-26 18:41:42 -05:00
urls.py	Initial commit	2025-02-18 11:14:09 -06:00
utils.py	Initial commit	2025-02-18 11:14:09 -06:00
views.py	m3u modifications so streams are identified by hash, configurable, also streams now have channel_groups instead of a string for groups	2025-03-19 16:35:49 -04:00