fix: resolve logical errors, bugs, and security issues across codebase

- Fix is_admin() method shadowing is_admin database column in User model
- Fix check_password() crash when password_hash is None (OAuth-only users)
- Fix SystemSetting.all_settings() formatting error (missing newline)
- Fix MAIL_PORT returning string instead of int in config
- Fix AUTOMATION_TOKEN config formatting (missing newline before comment)
- Fix path traversal vulnerability in serve_user_audio using realpath validation
- Fix weak auth in process.py, replace session check with @login_required
- Fix int() crash on non-numeric priority in import_songs.py
- Add timeout to SMTP connection in email_helper.py
- Add timeouts to external API requests in metadata.py and spotify_helper.py
- Fix security tests to properly reload config module
- Fix metadata test mock data key mismatch (preview_url -> spotify_preview_url)
- Add skip decorator to integration test requiring live API credentials

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
This commit is contained in:
copilot-swe-agent[bot]
2026-03-12 00:13:30 +00:00
parent 4685e05860
commit cfe000f030
15 changed files with 66 additions and 46 deletions
+5 -5
View File
@@ -38,7 +38,7 @@
<div>
<p class="text-sm text-gray-600">Admin Status</p>
<p class="font-medium">
{% if current_user.is_admin() %}
{% if current_user.is_admin %}
<span class="text-green-600">Administrator</span>
<a href="{{ url_for('admin.index') }}" class="ml-2 text-xs text-blue-600 hover:underline">
Admin Dashboard
@@ -73,7 +73,7 @@
</div>
<!-- Spotify Connection Debug - Only for Admins -->
{% if current_user.is_admin() %}
{% if current_user.is_admin %}
<div class="mt-6 p-4 border border-gray-300 rounded-lg bg-gray-50">
<div class="flex items-center justify-between mb-3">
<h3 class="text-lg font-semibold text-navy-700">Spotify Connection Debug</h3>
@@ -144,7 +144,7 @@
<h3 class="text-lg font-semibold mb-4 text-navy-700">Connected Services</h3>
<!-- Spotify Connection - Only shown for admins -->
{% if current_user.is_admin() %}
{% if current_user.is_admin %}
<div class="bg-gray-50 p-4 rounded-lg mb-4 shadow-sm">
<div class="flex items-center mb-3">
<i class="fab fa-spotify text-[#1DB954] text-2xl mr-3"></i>
@@ -269,7 +269,7 @@
</div>
<!-- Spotify Debug Modal - Only for Admins -->
{% if current_user.is_admin() %}
{% if current_user.is_admin %}
<div id="spotifyDebugModal" class="fixed inset-0 bg-black bg-opacity-50 flex items-center justify-center z-50 hidden">
<div class="bg-white rounded-lg shadow-lg w-full max-w-2xl max-h-[80vh] overflow-y-auto">
<div class="p-6">
@@ -760,7 +760,7 @@
{% endblock %}
{% block scripts %}
{% if current_user.is_admin() %}
{% if current_user.is_admin %}
<script>
document.addEventListener('DOMContentLoaded', function() {
const modal = document.getElementById('spotifyDebugModal');