danvics/metube
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

Whitelist safe config keys broadcast to clients (closes #898)

Browse source 
The socket connect handler was sending the entire config object to
every client, including YTDL_OPTIONS (which can contain proxy auth,
cookies paths, etc). Whitelist only the keys the frontend needs.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
ddmoney420 2026-03-03 14:51:57 -07:00
parent d2e6c079f9
commit c2d35afc3e
1 changed files with 9 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
app/main.py
View file

@ -345,7 +345,15 @@ async def history(request):
async def connect(sid, environ): async def connect(sid, environ):
log.info(f"Client connected: {sid}") log.info(f"Client connected: {sid}")
await sio.emit('all', serializer.encode(dqueue.get()), to=sid) await sio.emit('all', serializer.encode(dqueue.get()), to=sid)
await sio.emit('configuration', serializer.encode(config), to=sid) safe_config = {
k: getattr(config, k, None) for k in (
'CUSTOM_DIRS', 'CREATE_CUSTOM_DIRS', 'DELETE_FILE_ON_TRASHCAN',
'PUBLIC_HOST_URL', 'PUBLIC_HOST_AUDIO_URL', 'OUTPUT_TEMPLATE',
'OUTPUT_TEMPLATE_CHAPTER', 'DEFAULT_OPTION_PLAYLIST_ITEM_LIMIT',
'DOWNLOAD_DIRS_INDEXABLE', 'DEFAULT_THEME', 'URL_PREFIX',
) if hasattr(config, k)
}
await sio.emit('configuration', serializer.encode(safe_config), to=sid)
if config.CUSTOM_DIRS: if config.CUSTOM_DIRS:
await sio.emit('custom_dirs', serializer.encode(get_custom_dirs()), to=sid) await sio.emit('custom_dirs', serializer.encode(get_custom_dirs()), to=sid)
if config.YTDL_OPTIONS_FILE: if config.YTDL_OPTIONS_FILE: