Merge branch 'master' into enhancement/epub-reader

cps/editbooks.py

@@ -27,8 +27,10 @@ from shutil import copyfile
 from uuid import uuid4
 from markupsafe import escape, Markup  # dependency of flask
 from functools import wraps
+from lxml.etree import ParserError
 
 try:
+    # at least bleach 6.0 is needed -> incomplatible change from list arguments to set arguments
     from bleach import clean_text as clean_html
     BLEACH = True
 except ImportError:
@@ -1001,10 +1003,14 @@ def edit_book_series_index(series_index, book):
 def edit_book_comments(comments, book):
     modify_date = False
     if comments:
-        if BLEACH:
-            comments = clean_html(comments, tags=None, attributes=None)
-        else:
-            comments = clean_html(comments)
+        try:
+            if BLEACH:
+                comments = clean_html(comments, tags=set(), attributes=set())
+            else:
+                comments = clean_html(comments)
+        except ParserError as e:
+            log.error("Comments of book {} are corrupted: {}".format(book.id, e))
+            comments = ""
     if len(book.comments):
         if book.comments[0].text != comments:
             book.comments[0].text = comments

cps/epub.py

@@ -102,7 +102,7 @@ def get_epub_info(tmp_file_path, original_file_name, original_file_extension):
             elif s == 'date':
                 epub_metadata[s] = tmp[0][:10]
             else:
-                epub_metadata[s] = tmp[0]
+                epub_metadata[s] = tmp[0].strip()
         else:
             epub_metadata[s] = 'Unknown'
 

cps/kobo.py

@@ -137,10 +137,13 @@ def convert_to_kobo_timestamp_string(timestamp):
 
 @kobo.route("/v1/library/sync")
 @requires_kobo_auth
-@download_required
+# @download_required
 def HandleSyncRequest():
+    if not current_user.role_download():
+        log.info("Users need download permissions for syncing library to Kobo reader")
+        return abort(403)
     sync_token = SyncToken.SyncToken.from_headers(request.headers)
-    log.info("Kobo library sync request received.")
+    log.info("Kobo library sync request received")
     log.debug("SyncToken: {}".format(sync_token))
     log.debug("Download link format {}".format(get_download_url_for_book('[bookid]','[bookformat]')))
     if not current_app.wsgi_app.is_proxied:

cps/server.py

@@ -21,6 +21,7 @@ import os
 import errno
 import signal
 import socket
+import asyncio
 
 try:
     from gevent.pywsgi import WSGIServer
@@ -326,4 +327,5 @@ class WebServer(object):
                 if restart:
                     self.wsgiserver.call_later(1.0, self.wsgiserver.stop)
                 else:
-                    self.wsgiserver.add_callback_from_signal(self.wsgiserver.stop)
+                    self.wsgiserver.asyncio_loop.call_soon_threadsafe(self.wsgiserver.stop)
+

cps/web.py

@@ -1354,21 +1354,21 @@ def login():
 @limiter.limit("3/minute", key_func=lambda: request.form.get('username', "").strip().lower())
 def login_post():
     form = request.form.to_dict()
+    username = form.get('username', "").strip().lower().replace("\n","\\n").replace("\r","")
     try:
         limiter.check()
     except RateLimitExceeded:
         flash(_(u"Please wait one minute before next login"), category="error")
-        return render_login(form.get("username", ""), form.get("password", ""))
+        return render_login(username, form.get("password", ""))
     if current_user is not None and current_user.is_authenticated:
         return redirect(url_for('web.index'))
     if config.config_login_type == constants.LOGIN_LDAP and not services.ldap:
         log.error(u"Cannot activate LDAP authentication")
         flash(_(u"Cannot activate LDAP authentication"), category="error")
-    user = ub.session.query(ub.User).filter(func.lower(ub.User.name) == form.get('username', "").strip().lower()) \
-        .first()
+    user = ub.session.query(ub.User).filter(func.lower(ub.User.name) == username).first()
     remember_me = bool(form.get('remember_me'))
     if config.config_login_type == constants.LOGIN_LDAP and services.ldap and user and form['password'] != "":
-        login_result, error = services.ldap.bind_user(form['username'], form['password'])
+        login_result, error = services.ldap.bind_user(username, form['password'])
         if login_result:
             log.debug(u"You are now logged in as: '{}'".format(user.name))
             return handle_login_user(user,
@@ -1388,7 +1388,7 @@ def login_post():
             flash(_(u"Could not login: %(message)s", message=error), category="error")
         else:
             ip_address = request.headers.get('X-Forwarded-For', request.remote_addr)
-            log.warning('LDAP Login failed for user "%s" IP-address: %s', form['username'], ip_address)
+            log.warning('LDAP Login failed for user "%s" IP-address: %s', username, ip_address)
             flash(_(u"Wrong Username or Password"), category="error")
     else:
         ip_address = request.headers.get('X-Forwarded-For', request.remote_addr)
@@ -1397,7 +1397,7 @@ def login_post():
                 ret, __ = reset_password(user.id)
                 if ret == 1:
                     flash(_(u"New Password was send to your email address"), category="info")
-                    log.info('Password reset for user "%s" IP-address: %s', form['username'], ip_address)
+                    log.info('Password reset for user "%s" IP-address: %s', username, ip_address)
                 else:
                     log.error(u"An unknown error occurred. Please try again later")
                     flash(_(u"An unknown error occurred. Please try again later."), category="error")
@@ -1413,9 +1413,9 @@ def login_post():
                                          _(u"You are now logged in as: '%(nickname)s'", nickname=user.name),
                                          "success")
             else:
-                log.warning('Login failed for user "{}" IP-address: {}'.format(form['username'], ip_address))
+                log.warning('Login failed for user "{}" IP-address: {}'.format(username, ip_address))
                 flash(_(u"Wrong Username or Password"), category="error")
-    return render_login(form.get("username", ""), form.get("password", ""))
+    return render_login(username, form.get("password", ""))
 
 
 @web.route('/logout')