krautspaceTV

url_ok() in _http.py is dead code after #19

1

#22 by paulloth1 was closed 2026-08-13 20:12:31 +00:00

Display never re-shows a slide's content if its id is unchanged, even when the HTML changed

1

#21 by paulloth1 was closed 2026-08-13 20:12:30 +00:00

No test coverage for rss.py's feed parsing or app.py's ssrf_check

1

#20 by paulloth1 was closed 2026-08-13 19:38:16 +00:00

Same is_available/render double-fetch bug as #17 exists in 4 more slide types

1

#19 by paulloth1 was closed 2026-08-13 19:38:16 +00:00

Duplicated owner/forwarder branching across 4 endpoints in app.py

1

#18 by paulloth1 was closed 2026-08-13 19:29:59 +00:00

RSS slides fetch their feed twice per rotation (is_available + render)

1

#17 by paulloth1 was closed 2026-08-13 19:29:58 +00:00

Security: /proxy endpoint is an open SSRF proxy

#16 by paulloth1 was closed 2026-08-13 19:29:59 +00:00

move_slide raises unhandled ValueError if the slide was already deleted

bug

1

#15 by paulloth1 was closed 2026-07-28 21:51:26 +00:00

GET /proxy with no parameters raises an unhandled exception (500)

bug

1

#14 by paulloth1 was closed 2026-07-28 21:51:25 +00:00

edit_slide_form/update_slide crash if a slide's stored type is no longer in REGISTRY

bug

1

#13 by paulloth1 was closed 2026-07-28 21:42:44 +00:00

Rotation-owner forwarding calls have no error handling — owner process being down 500s the other 3 ports

bug

1

#12 by paulloth1 was closed 2026-07-28 21:42:43 +00:00

Rotation loop permanently dies on a malformed rotation_interval_seconds value

bug

1

#11 by paulloth1 was closed 2026-07-28 21:42:43 +00:00

No automated tests

enhancement

1

#10 by paulloth1 was closed 2026-07-28 21:22:30 +00:00

Duplicated is_available/render boilerplate across slide types

enhancement

1

#9 by paulloth1 was closed 2026-07-28 21:23:04 +00:00

Deprecated scrolling="no" iframe attribute used instead of CSS

enhancement

1

#8 by paulloth1 was closed 2026-07-28 21:23:01 +00:00

requirements.txt has no version pins

enhancement

1

#7 by paulloth1 was closed 2026-07-28 21:19:14 +00:00

bypass_csp cookies are passed through the URL query string instead of looked up server-side

enhancement

1

#6 by paulloth1 was closed 2026-07-28 21:22:59 +00:00

/proxy's regex-based HTML rewriting is fragile and applies site-specific hacks to every proxied page

enhancement

1

#5 by paulloth1 was closed 2026-07-28 21:22:57 +00:00

SQLite accessed via a fresh connection per call, no WAL mode — risk of 'database is locked' under concurrent access

bug

1

#4 by paulloth1 was closed 2026-07-28 21:19:30 +00:00

No authentication on admin UI or any mutating endpoint

bug

1

#3 by paulloth1 was closed 2026-07-28 21:12:24 +00:00