d9529fc801
The first token-leak fix scrubbed the artwork URL fixer's own log
calls. This catches three more sites that ALSO leaked tokens, plus
one upstream gap that let URL-encoded tokens slip through the
redactor.
Three sites in `web_server.py` (artist endpoint at line 8765-8773):
- "Artist image before fix: '...'" -- logged the raw image_url with
the auth token in plain form.
- "Artist image after fix: '...'" -- logged the URL-encoded form
after it had been wrapped in the image proxy
(`/api/image-proxy?url=<percent-encoded-token>`).
- "Final artist data being sent: {...}" -- dumped the entire
artist_info dict on every render, including the image_url field.
All three were dev-time debug noise. Removed entirely. The "No
artist image URL found" warning at line 8770 stays (no URL, just
the artist name).
One site in `core/discovery/sync.py:402`:
- "[PLAYLIST IMAGE] image_url=..." -- logged the playlist poster URL
during sync. Same auth-token leak risk for Plex / Jellyfin
playlists. Changed to log only `has_image=True/False`.
Upstream gap in `_redact_url_secrets`:
- The original regex only matched plain query params (`?key=value`).
When an auth-bearing URL gets wrapped inside another URL's query
string (our `/api/image-proxy?url=<encoded>` flow) the auth params
end up percent-encoded -- `%3FX-Plex-Token%3D...` -- and slipped
through.
- New second pattern catches the URL-encoded form. Both passes run
on every redact call; idempotent.
Verified manually:
/api/image-proxy?url=...%3FX-Plex-Token%3DABC...
-> /api/image-proxy?url=...%3FX-Plex-Token%3D***REDACTED***
6 artwork tests pass.
|
||
|---|---|---|
| .. | ||
| docs | ||
| vendor | ||
| api-monitor.js | ||
| artists.png | ||
| automation.png | ||
| beatport-ui.js | ||
| core.js | ||
| dashboard.png | ||
| discover-section-controller.js | ||
| discover.js | ||
| discover.png | ||
| docs-images-needed.md | ||
| docs.js | ||
| downloads.js | ||
| enrichment.js | ||
| explorer.png | ||
| favicon.png | ||
| help.png | ||
| helper.js | ||
| hydrabase.png | ||
| import.png | ||
| init.js | ||
| library.js | ||
| library.png | ||
| manifest.json | ||
| media-player.js | ||
| mobile.css | ||
| pages-extra.js | ||
| particles.js | ||
| placeholder-album.png | ||
| pwa-icon-192.png | ||
| pwa-icon-512.png | ||
| search.js | ||
| search.png | ||
| settings.js | ||
| settings.png | ||
| setup-wizard.css | ||
| setup-wizard.js | ||
| shared-helpers.js | ||
| shell-bridge.js | ||
| stats-automations.js | ||
| style.css | ||
| sw.js | ||
| sync-services.js | ||
| sync-spotify.js | ||
| sync.png | ||
| trans.png | ||
| trans2.png | ||
| whisoul.png | ||
| wishlist-tools.js | ||
| worker-orbs.js | ||
