readlines() loaded whole playlists into memory; a 336 MB file needs
roughly 500-600 MB of RAM on a VPS with ~800 MB available.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Each playlist gets a max_connections setting (default 1), editable in the
playlist modal without re-importing. Active viewings are tracked in the
shared db_iptv.viewings collection (also used by serverIPTV_2): devices
are counted from 'on'/'off' commands and their 10 s polling. When
starting a channel pushes a playlist above its limit, the web UI shows a
quota alert. The playlist list shows active/max connections.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
/upload stored files under the client-supplied filename (allowing .php
webshells and ../ traversal) and analyse_m3u_file renamed files from
unvalidated filename/id_playlist. Uploads are now always stored as
upload_<uuid>.m3u, id_playlist must be a UUID, and paths go through
safe_join.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
list_channel previously matched every playlist with one unranked
".*keyword.*" regex, so a specific channel name could be buried pages
behind unrelated names that merely contained the keyword mid-word.
Split matches into two tiers (word-boundary match first, then
anywhere-else) using a cheap count+skip/limit per tier so pagination
still avoids pulling every match into memory.
Also found while testing against a 1.19M-channel playlist: searching
scans an unindexed regex and can take several seconds, and it was
running synchronously inside the async handler, freezing every other
request/socket for that whole time. Moved it to run_in_executor;
verified a concurrent request now returns in ~2ms while a 3.6s search
is in flight.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
- Drop analyse_m3u_file2: an unrouted, unused ~90%-duplicate of
analyse_m3u_file (a bug fixed in one would never apply to the other).
- Drop the in-memory `devices` list from polling/list_devices: it was
only ever written to, never read (list_devices already returns from
devices_db, the real source of truth).
- Remove the resulting unused NUM_MAX_CHANNEL variable and duplicate
`from pymongo import MongoClient` import.
- Narrow a bare `except:` to `except KeyError:` so it can't also
swallow SystemExit/KeyboardInterrupt.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
run_xtream_import made 6 sequential synchronous requests.get() calls
(60s timeout each) directly inside an asyncio task, so the whole
event loop — and every other request/socket the server was handling
— stalled for the full duration of each Xtream import, same failure
mode as the logo-download freeze fixed earlier. Run them through
run_in_executor instead so the loop stays free.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Since TLS termination moved to nginx, aiohttp's request.remote is
nginx's own address on the docker network (172.21.0.1), a private IP
that resolve_ip_country() correctly refuses to geolocate. Nginx
already forwards the real client address via X-Real-IP
(iptv.mrk.ovh.conf); read that first so device IP/country tracking
works again.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
/init_db dropped the channels/playlists collections then crashed on
an undefined `res` variable, so the "Reset DB" button in the UI
always surfaced a 500 even though the wipe had already happened.
proxy_image used aiohttp.ClientSession without importing aiohttp and
was never routed or called from the frontend, so it's just removed.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
playlist_download, download_epg, upload_snapshot, and get_logo all
built filesystem paths by concatenating a caller-supplied string
(filename/id_channel/id_device) with no validation, so a '../'
payload could read or write files outside the intended directory.
upload_snapshot was the most exploitable: fully attacker-controlled
bytes written to an attacker-chosen path with no prior lookup gating
it. Add a safe_join() helper that resolves the path and rejects
anything that escapes the base directory, and use it at all four
call sites.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
The settings endpoint returned the raw key to any caller, and the
frontend used that response to pre-fill the input field, which also
meant saving with an untouched field would silently resubmit the
plaintext key. /gemini_key now reports only whether a key is set and
a masked preview; the UI shows that as a placeholder and only updates
the stored key when the field is actually filled in.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
requests.get() calls had no timeout and ran directly on the aiohttp
event loop, so a single dead logo host would hang for minutes and
block every other request. Add timeouts and move logo downloads in
get_logo to a thread executor so a slow/dead host no longer stalls
the whole server.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
The app now listens on plain HTTP (127.0.0.1:5023 only) instead of
binding 443 and terminating TLS itself. Nginx handles TLS for
iptv.mrk.ovh and proxies to the app internally.
IPTV.py now writes logs to a rotating file and forwards critical VLC
playback errors (start timeout, MediaPlayerEncounteredError) to the
server instead of losing everything to unredirected print() calls.
The web UI's device menu gets a working Terminal (to run diagnostic
commands like tail on the log) and a Recent errors view backed by a
capped last_errors list on each device document, keeping DB volume
bounded to the last 5 entries per device.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
