marvin8/cang
Watch
1
0
Fork
You've already forked cang
 0
Code Issues 1 Pull requests Releases 28 Activity Actions

Clip video static mount serves the whole output_dir without authentication #113

New issue
Closed
opened 2026-07-14 19:50:21 +00:00 by coding-agent-marvin8 · 1 comment
coding-agent-marvin8 commented 2026-07-14 19:50:21 +00:00 (Migrated from codeberg.org)
Copy link

create_app mounts StaticFiles(directory=output_dir) at /clips/video without the require_auth dependency (Starlette mounts do not inherit router dependencies). With auth enabled, GET /clips/video/cang.db returns the SQLite database, and every file under output_dir is fetchable unauthenticated. Once snapshots move into output_dir (#112) this exposure grows to all snapshots. Clip videos need to be served through an authenticated route instead of a blanket static mount.

create_app mounts StaticFiles(directory=output_dir) at /clips/video without the require_auth dependency (Starlette mounts do not inherit router dependencies). With auth enabled, GET /clips/video/cang.db returns the SQLite database, and every file under output_dir is fetchable unauthenticated. Once snapshots move into output_dir (#112) this exposure grows to all snapshots. Clip videos need to be served through an authenticated route instead of a blanket static mount.
coding-agent-marvin8 commented 2026-07-14 19:50:47 +00:00 (Migrated from codeberg.org)
Copy link

Plan: remove the StaticFiles mount from create_app and add GET /clips/{clip_id}/video on the clips router (which already carries the require_auth dependency). Path is built server-side from the clip row via the new storage helpers — no client-supplied paths. day.html switches to the new URL. Needs a test that Range requests still get 206 for the

Plan: remove the StaticFiles mount from create_app and add GET /clips/{clip_id}/video on the clips router (which already carries the require_auth dependency). Path is built server-side from the clip row via the new storage helpers — no client-supplied paths. day.html switches to the new URL. Needs a test that Range requests still get 206 for the <video> element; will verify Starlette FileResponse range support during implementation. Fixed on the same branch as #112.
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
pages
2026.8.4
2026.7.25
2026.7.24
2026.7.23
2026.7.22
0.10.1
0.10.0
0.9.0
0.8.0
0.7.0
0.6.0
0.5.0
0.4.2
0.4.1
0.4.0
0.3.12
0.3.11
0.3.10
0.3.9
0.3.8
0.3.7
0.3.6
0.3.5
0.3.4
0.3.3
0.3.2
0.3.1
0.3.0
0.2.0
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
marvin8/cang#113
No description provided.