SergeantPanda 7083c512be security: Fixed path traversal vulnerability in file uploads. The M3U account upload (apps/m3u/api_views.py), logo upload (apps/channels/api_views.py), and backup upload (apps/backups/api_views.py) all used the uploaded filename directly without sanitization. os.path.join() discards all preceding components when it encounters an absolute path segment, and pathlib's / operator behaves identically; a relative ../ sequence also escapes via OS path resolution at open() time. All three upload paths now strip directory components via Path(name).name and validate the resolved path remains within the intended upload directory. Exploiting any of these required admin credentials.		2026-04-09 21:32:36 -05:00
..
migrations	Enhancement: Account expiration tracking and notifications for M3U profiles	2026-03-14 18:38:59 -05:00
tests	tests: Add backend test for expiration feature.	2026-03-15 16:42:11 -05:00
__init__.py	Initial commit	2025-02-18 11:14:09 -06:00
admin.py	Add custom properties to M3UAccountProfile and implement account info retrieval	2025-09-09 16:05:58 -05:00
api_urls.py	Ability to refresh account info from account info modal and provide notification on results.	2025-09-09 18:15:33 -05:00
api_views.py	security: Fixed path traversal vulnerability in file uploads. The M3U account upload (apps/m3u/api_views.py), logo upload (apps/channels/api_views.py), and backup upload (apps/backups/api_views.py) all used the uploaded filename directly without sanitization. os.path.join() discards all preceding components when it encounters an absolute path segment, and pathlib's / operator behaves identically; a relative ../ sequence also escapes via OS path resolution at open() time. All three upload paths now strip directory components via Path(name).name and validate the resolved path remains within the intended upload directory. Exploiting any of these required admin credentials.	2026-04-09 21:32:36 -05:00
apps.py	Initial commit	2025-02-18 11:14:09 -06:00
forms.py	Convert custom_properties to jsonb in the backend.	2025-09-02 09:41:51 -05:00
models.py	Enhancement: Account expiration tracking and notifications for M3U profiles	2026-03-14 18:38:59 -05:00
serializers.py	Update expiration date handling in M3U components to ensure UTC format	2026-03-15 16:00:23 -05:00
signals.py	Enhancement: Account expiration tracking and notifications for M3U profiles	2026-03-14 18:38:59 -05:00
tasks.py	Bug Fix: M3U profile URL rewriting now uses the regex module instead of re across all URL transform code paths (url_utils.transform_url, core/views.py, vod_proxy/_transform_url, tasks.get_transformed_credentials, and the WebSocket live-preview handler in consumers.py). The regex module natively accepts JavaScript/PCRE-style named capture groups ((?<name>...)) without any conversion, eliminating the root cause of patterns that matched in the frontend live preview but failed on the backend with a re.error. As a further improvement, regex also supports variable-length lookbehind assertions (e.g. (?<=a+)), which re rejects with an error; patterns using these will now work correctly on the backend as well. Replace-pattern JS tokens are still normalised before calling regex.sub: $<name> → \g<name> and $1/$2/… → \1/\2/… (Python replacement syntax). Also fixed a bug in the WebSocket preview handler where a pattern error was incorrectly returning the search pattern string as the preview output instead of the original URL. (Fixes #1005)	2026-03-29 17:55:08 -05:00
urls.py	Initial commit	2025-02-18 11:14:09 -06:00
utils.py	Enhancement: Adds support for UDP streams. Closes #617	2025-11-11 18:30:59 -06:00
views.py	Add ability to scan for vods during m3u refresh.	2025-08-02 12:01:26 -05:00