Repository navigation
Address Augment review on plex-image-picker (#67) - #69
Closed
chazlarson wants to merge 3 commits into
Closed
chazlarson wants to merge 3 commits into
chazlarson wants to merge 3 commits into
Conversation
…mode sombre, upload manuel, badges poster/background
Key asset/missing caches by Plex base URL and asset root so sessions do not share poster badges. Harden URL uploads and remote downloads with scheme/host SSRF checks, size limits, and path sanitization; keep LAN Plex fetches via a dedicated helper. Translate remaining French UI copy to English. Co-authored-by: chaz <chaz@chazlarson.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Addresses the Augment Deep Code Review findings on #67 (same tip as the updated fork PR).
Fixes
_ASSET_CACHES/_MISSING_CACHESare keyed by Plexbase_url+ resolved asset root so poster/background badges andmissing_onlyfiltering no longer leak across sessions or asset directories./upload_urland remotehttp(s)downloads validate scheme, block private/loopback/link-local hosts (DNS-resolved), and cap response size (20 MiB). Relative Plex paths still fetch only from the session’s configured server (LAN-safe helper).asset_dircannot escape the cwd via..; write paths stay under the asset root; image extensions are allowlisted.Not changed
0.0.0.0is required for the container). Worth a follow-up if this is ever exposed beyond a trusted network.This branch was also pushed to
Minimaxpower:plex-image-picker-improvements, so #67 includes the same commit. Prefer merging one of the two and closing the other.