Since TLS termination moved to nginx, aiohttp's request.remote is
nginx's own address on the docker network (172.21.0.1), a private IP
that resolve_ip_country() correctly refuses to geolocate. Nginx
already forwards the real client address via X-Real-IP
(iptv.mrk.ovh.conf); read that first so device IP/country tracking
works again.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
/init_db dropped the channels/playlists collections then crashed on
an undefined `res` variable, so the "Reset DB" button in the UI
always surfaced a 500 even though the wipe had already happened.
proxy_image used aiohttp.ClientSession without importing aiohttp and
was never routed or called from the frontend, so it's just removed.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
playlist_download, download_epg, upload_snapshot, and get_logo all
built filesystem paths by concatenating a caller-supplied string
(filename/id_channel/id_device) with no validation, so a '../'
payload could read or write files outside the intended directory.
upload_snapshot was the most exploitable: fully attacker-controlled
bytes written to an attacker-chosen path with no prior lookup gating
it. Add a safe_join() helper that resolves the path and rejects
anything that escapes the base directory, and use it at all four
call sites.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
The settings endpoint returned the raw key to any caller, and the
frontend used that response to pre-fill the input field, which also
meant saving with an untouched field would silently resubmit the
plaintext key. /gemini_key now reports only whether a key is set and
a masked preview; the UI shows that as a placeholder and only updates
the stored key when the field is actually filled in.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
requests.get() calls had no timeout and ran directly on the aiohttp
event loop, so a single dead logo host would hang for minutes and
block every other request. Add timeouts and move logo downloads in
get_logo to a thread executor so a slow/dead host no longer stalls
the whole server.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
The app now listens on plain HTTP (127.0.0.1:5023 only) instead of
binding 443 and terminating TLS itself. Nginx handles TLS for
iptv.mrk.ovh and proxies to the app internally.
IPTV.py now writes logs to a rotating file and forwards critical VLC
playback errors (start timeout, MediaPlayerEncounteredError) to the
server instead of losing everything to unredirected print() calls.
The web UI's device menu gets a working Terminal (to run diagnostic
commands like tail on the log) and a Recent errors view backed by a
capped last_errors list on each device document, keeping DB volume
bounded to the last 5 entries per device.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
