admin/WerkoutAPI
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Codebase hardening: 102 fixes across 35+ files

Browse Source 
Deep audit identified 106 findings; 102 fixed, 4 deferred. Covers 8 areas:

- Settings & deploy: env-gated DEBUG/SECRET_KEY, HTTPS headers, gunicorn, celery worker
- Auth (registered_user): password write_only, request.data fixes, transaction safety, proper HTTP status codes
- Workout app: IDOR protection, get_object_or_404, prefetch_related N+1 fixes, transaction.atomic
- Video/scripts: path traversal sanitization, HLS trigger guard, auth on cache wipe
- Models (exercise/equipment/muscle/superset): null-safe __str__, stable IDs, prefetch support
- Generator views: helper for registered_user lookup, logger.exception, bulk_update, transaction wrapping
- Generator core (rules/selector/generator): push-pull ratio, type affinity normalization, modality checks, side-pair exact match, word-boundary regex, equipment cache clearing
- Generator services (plan_builder/analyzer/normalizer): transaction.atomic, muscle cache, bulk_update, glutes classification fix

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
Trey t
2026-02-27 22:29:14 -06:00
parent 63b57a83ab
commit c80c66c2e5
58 changed files with 3363 additions and 1049 deletions
Download Patch File Download Diff File Expand all files Collapse all files

41
video/views.py
View File

@@ -3,7 +3,6 @@ from .serializers import *
from django.shortcuts import render
from rest_framework.decorators import api_view
from rest_framework.decorators import api_view
from rest_framework.response import Response
from rest_framework import status
from django.contrib.auth.models import User
@@ -48,17 +47,33 @@ def nsfw_videos(request):
@permission_classes([IsAuthenticated])
def hls_videos(request):
video_url = request.GET.get('video_name', '')
type = request.GET.get('video_type', '')
video_type = request.GET.get('video_type', '')
end_location = str(settings.MEDIA_ROOT) + '/hls/'+ video_url +'.m3u8'
end_file_name = '/media/hls/'+ video_url +'_720p.m3u8'
# Sanitize inputs to prevent path traversal
video_url = os.path.basename(video_url)
video_type = os.path.basename(video_type)
if not video_url or not video_type:
return Response({"error": "video_name and video_type are required"}, status=status.HTTP_400_BAD_REQUEST)
end_location = os.path.join(str(settings.MEDIA_ROOT), 'hls', video_url + '.m3u8')
end_file_name = '/media/hls/' + video_url + '_720p.m3u8'
# Verify the resolved path is within MEDIA_ROOT
if not os.path.realpath(end_location).startswith(os.path.realpath(str(settings.MEDIA_ROOT))):
return Response({"error": "Invalid path"}, status=status.HTTP_400_BAD_REQUEST)
if default_storage.exists(end_location):
return JsonResponse({'file_location': end_file_name})
media_location = os.path.join(settings.MEDIA_ROOT) + "/" + type + "/" + video_url
media_location = os.path.join(str(settings.MEDIA_ROOT), video_type, video_url)
# Verify media_location is within MEDIA_ROOT
if not os.path.realpath(media_location).startswith(os.path.realpath(str(settings.MEDIA_ROOT))):
return Response({"error": "Invalid path"}, status=status.HTTP_400_BAD_REQUEST)
video = ffmpeg_streaming.input(media_location)
hls = video.hls(Formats.h264())
#_720p = Representation(Size(1280, 720), Bitrate(2048 * 1024, 320 * 1024))
hls.auto_generate_representations()
@@ -67,9 +82,17 @@ def hls_videos(request):
# {{url}}/videos/hls_video?video_name=Recover_24.mp4&video_type=videos
return JsonResponse({'file_location': end_file_name})
@api_view(['GET'])
@api_view(['POST'])
@authentication_classes([TokenAuthentication])
@permission_classes([IsAuthenticated])
def create_hls(request):
create_hls_tasks.delay()
return JsonResponse({'running': "running"})
filename = request.data.get('filename', '')
if not filename:
return Response({"error": "filename is required"}, status=status.HTTP_400_BAD_REQUEST)
# Sanitize to prevent path traversal
filename = os.path.basename(filename)
full_path = os.path.join(str(settings.MEDIA_ROOT), 'videos', filename)
if not os.path.realpath(full_path).startswith(os.path.realpath(str(settings.MEDIA_ROOT))):
return Response({"error": "Invalid path"}, status=status.HTTP_400_BAD_REQUEST)
create_hls_tasks.delay(os.path.join('videos', filename))
return JsonResponse({'running': "running"})