[Minimaxpower]

Items : Added dark mode, new pagination, search bar, system that show if you already have a poster/background, filter to see only posterless content.

Item : more content in the page, new systems to add posters, link to imdb and plex pages of the item, item page now show which poster you already have selected on plex..

[augmentcode]

^{PR Risk Analyzer Agent 🛡️}

👀 Human review needed

Justification

This PR is a large change from an external contributor (author_association: NONE): +1034 / -479 across 24 files, replacing the entire Plex Image Picker/ app with a new plex-image-picker/ directory, including a 659-line rewrite of app.py. It adds new user-input-driven behavior to a network-facing Flask web app, which falls outside any low-risk auto-approval class and warrants maintainer review.

Security-relevant surface introduced in plex-image-picker/app.py:

• Server-side request forgery (SSRF): /upload_url calls requests.get(image_url) on a fully user-supplied URL with no scheme/host allowlist, then writes the response to disk. /download similarly fetches arbitrary img_key values that start with http.
• Unvalidated filesystem write paths: asset_dir is taken directly from user form input (request.form["asset_dir"]) and joined into write paths (os.path.join(os.getcwd(), session["asset_dir"], ...)). Upload/download filenames are derived from uploaded/remote data without secure_filename or path-traversal guards, so files can potentially be written outside the intended asset tree.
• No CSRF protection on the new state-changing POST endpoints (/download, /upload_url, /upload_file).
• The app binds to all interfaces (app.run(host="0.0.0.0", port=5000)), broadening exposure.

A human should review the input validation, path handling, and outbound-fetch behavior of these new endpoints before merge.

_{Reviewed commit 8574302}

[augmentcode]

^{Deep Code Review Agent🐛}

Review completed with 2 suggestions.

_{Reviewed commit: 8574302}

[augmentcode]

^{Deep Code Review Agent🐛}

This process-wide asset cache is not keyed by the current session's asset directory or Plex server, so one user's manual scan is reused for every later session. That makes the poster/background badges and missing_only filtering report results for the wrong asset tree whenever the asset directory changes or more than one server/user uses the app.

Severity: medium

---

_{🤖 Was this useful? React with 👍 or 👎}

[augmentcode]

^{Deep Code Review Agent🐛}

The URL upload path fetches an arbitrary user-supplied URL server-side and writes the response, without bounding what the server can contact or how much data it accepts. If this Flask app is reachable beyond a trusted localhost, a request can make the server contact internal services or consume disk/network resources.

Severity: medium

---

_{🤖 Was this useful? React with 👍 or 👎}

[Minimaxpower]

Btw there's few lines added in the templates that will show in french on the website

[cursor]

Pushed 613b356 to this PR (maintainer push) addressing the Augment Deep Code Review items:

1. Cache keyed by Plex server + asset root — poster/background badges and missing_only no longer cross sessions.
2. Bounded / SSRF-checked URL fetches — scheme + private-IP DNS checks + 20 MiB size limit on /upload_url and remote /download URLs; Plex-relative paths stay locked to the session server.
3. Asset path sanitization — blocks .. escapes; allowlists image extensions.
4. English UI — French template/flash strings translated (per the note on this PR).

Same commit is also on chazlarson:cursor/pr67-augment-review-0166 / #69 if you prefer merging from there.