Prepare release

SECURITY.md

@@ -11,7 +11,7 @@ To receive fixes for security vulnerabilities it is required to always upgrade t
 ## History
 
 | Fixed in      | Description                                                                                                                    |CVE number |
-|---------------|--------------------------------------------------------------------------------------------------------------------|---------|
+|---------------|--------------------------------------------------------------------------------------------------------------------------------|---------|
 | 3rd July 2018 | Guest access acts as a backdoor                                                                                                ||
 | V 0.6.7       | Hardcoded secret key for sessions                                                                                              |CVE-2020-12627 |
 | V 0.6.13      | Calibre-Web Metadata cross site scripting                                                                                      |CVE-2021-25964|
@@ -45,6 +45,11 @@ To receive fixes for security vulnerabilities it is required to always upgrade t
 | V 0.6.21      | Cross-site scripting (XSS) stored in href bypasses filter using data wrapper no longer possible                                ||
 | V 0.6.21      | Cross-site scripting (XSS) is no longer possible via pathchooser                                                               ||
 | V 0.6.21      | Error Handling at non existent rating, language, and user downloaded books was fixed                                           ||
+| V 0.6.22      | Upload mimetype is checked to prevent malicious file content in the books library                                              ||
+| V 0.6.22      | Cross-site scripting (XSS) stored in comments section is prevented better (switching from lxml to bleach for sanitizing strings) ||
+| V 0.6.23      | Cookies are no longer stored for opds basic authentication and proxy authentication                                            ||
+
+
 
 
 ## Statement regarding Log4j (CVE-2021-44228 and related)

cps/constants.py

@@ -175,7 +175,7 @@ BookMeta = namedtuple('BookMeta', 'file_path, extension, title, author, cover, d
                                   'series_id, languages, publisher, pubdate, identifiers')
 
 # python build process likes to have x.y.zbw -> b for beta and w a counting number
-STABLE_VERSION = {'version': '0.6.23b'}
+STABLE_VERSION = {'version': '0.6.23'}
 
 NIGHTLY_VERSION = dict()
 NIGHTLY_VERSION[0] = '$Format:%H$'

test/Calibre-Web TestSummary_Linux.html

@@ -37,14 +37,14 @@
       <div class="row">
         <div class="col-xs-6 col-md-6 col-sm-offset-3" style="margin-top:50px;">
             
-            <p class='text-justify attribute'><strong>Start Time: </strong>2024-08-03 20:30:20</p>
+            <p class='text-justify attribute'><strong>Start Time: </strong>2024-08-04 21:24:21</p>
             
         </div>
       </div>
       <div class="row">
         <div class="col-xs-6 col-md-6 col-sm-offset-3">
             
-            <p class='text-justify attribute'><strong>Stop Time: </strong>2024-08-04 04:01:30</p>
+            <p class='text-justify attribute'><strong>Stop Time: </strong>2024-08-05 04:56:20</p>
             
         </div>
       </div>
@@ -972,11 +972,11 @@
     
 
 
-    <tr id="su" class="failClass">
+    <tr id="su" class="passClass">
         <td>TestEbookConvertGDriveKepubify</td>
         <td class="text-center">3</td>
-        <td class="text-center">2</td>
+        <td class="text-center">3</td>
-        <td class="text-center">1</td>
+        <td class="text-center">0</td>
         <td class="text-center">0</td>
         <td class="text-center">0</td>
         <td class="text-center">
@@ -995,33 +995,11 @@
     
     
     
-        <tr id="ft11.2" class="none bg-danger">
+        <tr id='pt11.2' class='hiddenRow bg-success'>
             <td>
                 <div class='testcase'>TestEbookConvertGDriveKepubify - test_convert_only</div>
             </td>
-            <td colspan='6'>
+            <td colspan='6' align='center'>PASS</td>
-                <div class="text-center">
-                    <a class="popup_link text-center" onfocus='blur()' onclick="showTestDetail('div_ft11.2')">FAIL</a>
-                </div>
-                <!--css div popup start-->
-                <div id="div_ft11.2" class="popup_window test_output" style="display:block;">
-                    <div class='close_button pull-right'>
-                        <button type="button" class="close" aria-label="Close" onfocus="this.blur();"
-                                onclick="document.getElementById('div_ft11.2').style.display='none'"><span
-                                aria-hidden="true">&times;</span></button>
-                    </div>
-                    <div class="text-left pull-left">
-                        <pre class="text-left">Traceback (most recent call last):
-  File &#34;/home/ozzie/Development/calibre-web-test/test/test_ebook_convert_kepubify_gdrive.py&#34;, line 239, in test_convert_only
-    task_len, ret = self.wait_tasks(tasks, 1)
-  File &#34;/home/ozzie/Development/calibre-web-test/test/helper_ui.py&#34;, line 1636, in wait_tasks
-    self.assertEqual(expected, task_len)
-AssertionError: 1 != 3</pre>
-                    </div>
-                    <div class="clearfix"></div>
-                </div>
-                <!--css div popup end-->
-            </td>
         </tr>
     
     
@@ -1639,12 +1617,12 @@ AssertionError: 1 != 3</pre>
     
 
 
-    <tr id="su" class="errorClass">
+    <tr id="su" class="passClass">
         <td>TestEditAuthors</td>
         <td class="text-center">9</td>
-        <td class="text-center">5</td>
+        <td class="text-center">9</td>
+        <td class="text-center">0</td>
         <td class="text-center">0</td>
-        <td class="text-center">4</td>
         <td class="text-center">0</td>
         <td class="text-center">
             <a onclick="showClassDetail('c14', 9)">Detail</a>
@@ -1662,118 +1640,38 @@ AssertionError: 1 != 3</pre>
     
     
     
-        <tr id="et14.2" class="none bg-info">
+        <tr id='pt14.2' class='hiddenRow bg-success'>
             <td>
                 <div class='testcase'>TestEditAuthors - test_change_capital_one_author_one_book</div>
             </td>
-            <td colspan='6'>
+            <td colspan='6' align='center'>PASS</td>
-                <div class="text-center">
-                    <a class="popup_link text-center" onfocus='blur()' onclick="showTestDetail('div_et14.2')">ERROR</a>
-                </div>
-                <!--css div popup start-->
-                <div id="div_et14.2" class="popup_window test_output" style="display:block;">
-                    <div class='close_button pull-right'>
-                        <button type="button" class="close" aria-label="Close" onfocus="this.blur();"
-                                onclick="document.getElementById('div_et14.2').style.display='none'"><span
-                                aria-hidden="true">&times;</span></button>
-                    </div>
-                    <div class="text-left pull-left">
-                        <pre class="text-left">Traceback (most recent call last):
-  File &#34;/home/ozzie/Development/calibre-web-test/test/test_edit_books_author.py&#34;, line 62, in test_change_capital_one_author_one_book
-    self.assertFalse(&#39;Leo Baskerville&#39; in os.listdir(SMB_LIB))
-NameError: name &#39;SMB_LIB&#39; is not defined</pre>
-                    </div>
-                    <div class="clearfix"></div>
-                </div>
-                <!--css div popup end-->
-            </td>
         </tr>
     
     
     
-        <tr id="et14.3" class="none bg-info">
+        <tr id='pt14.3' class='hiddenRow bg-success'>
             <td>
                 <div class='testcase'>TestEditAuthors - test_change_capital_one_author_two_books</div>
             </td>
-            <td colspan='6'>
+            <td colspan='6' align='center'>PASS</td>
-                <div class="text-center">
-                    <a class="popup_link text-center" onfocus='blur()' onclick="showTestDetail('div_et14.3')">ERROR</a>
-                </div>
-                <!--css div popup start-->
-                <div id="div_et14.3" class="popup_window test_output" style="display:block;">
-                    <div class='close_button pull-right'>
-                        <button type="button" class="close" aria-label="Close" onfocus="this.blur();"
-                                onclick="document.getElementById('div_et14.3').style.display='none'"><span
-                                aria-hidden="true">&times;</span></button>
-                    </div>
-                    <div class="text-left pull-left">
-                        <pre class="text-left">Traceback (most recent call last):
-  File &#34;/home/ozzie/Development/calibre-web-test/test/test_edit_books_author.py&#34;, line 111, in test_change_capital_one_author_two_books
-    self.assertFalse(&#39;Peter Parker&#39; in os.listdir(SMB_LIB))
-NameError: name &#39;SMB_LIB&#39; is not defined</pre>
-                    </div>
-                    <div class="clearfix"></div>
-                </div>
-                <!--css div popup end-->
-            </td>
         </tr>
     
     
     
-        <tr id="et14.4" class="none bg-info">
+        <tr id='pt14.4' class='hiddenRow bg-success'>
             <td>
                 <div class='testcase'>TestEditAuthors - test_change_capital_one_author_two_books_coauthor</div>
             </td>
-            <td colspan='6'>
+            <td colspan='6' align='center'>PASS</td>
-                <div class="text-center">
-                    <a class="popup_link text-center" onfocus='blur()' onclick="showTestDetail('div_et14.4')">ERROR</a>
-                </div>
-                <!--css div popup start-->
-                <div id="div_et14.4" class="popup_window test_output" style="display:block;">
-                    <div class='close_button pull-right'>
-                        <button type="button" class="close" aria-label="Close" onfocus="this.blur();"
-                                onclick="document.getElementById('div_et14.4').style.display='none'"><span
-                                aria-hidden="true">&times;</span></button>
-                    </div>
-                    <div class="text-left pull-left">
-                        <pre class="text-left">Traceback (most recent call last):
-  File &#34;/home/ozzie/Development/calibre-web-test/test/test_edit_books_author.py&#34;, line 164, in test_change_capital_one_author_two_books_coauthor
-    self.assertFalse(&#39;Norbert Halagal&#39; in os.listdir(SMB_LIB))
-NameError: name &#39;SMB_LIB&#39; is not defined</pre>
-                    </div>
-                    <div class="clearfix"></div>
-                </div>
-                <!--css div popup end-->
-            </td>
         </tr>
     
     
     
-        <tr id="et14.5" class="none bg-info">
+        <tr id='pt14.5' class='hiddenRow bg-success'>
             <td>
                 <div class='testcase'>TestEditAuthors - test_change_capital_rename_co_author</div>
             </td>
-            <td colspan='6'>
+            <td colspan='6' align='center'>PASS</td>
-                <div class="text-center">
-                    <a class="popup_link text-center" onfocus='blur()' onclick="showTestDetail('div_et14.5')">ERROR</a>
-                </div>
-                <!--css div popup start-->
-                <div id="div_et14.5" class="popup_window test_output" style="display:block;">
-                    <div class='close_button pull-right'>
-                        <button type="button" class="close" aria-label="Close" onfocus="this.blur();"
-                                onclick="document.getElementById('div_et14.5').style.display='none'"><span
-                                aria-hidden="true">&times;</span></button>
-                    </div>
-                    <div class="text-left pull-left">
-                        <pre class="text-left">Traceback (most recent call last):
-  File &#34;/home/ozzie/Development/calibre-web-test/test/test_edit_books_author.py&#34;, line 294, in test_change_capital_rename_co_author
-    self.assertFalse(&#39;Hector Gonçalves&#39; in os.listdir(SMB_LIB))
-NameError: name &#39;SMB_LIB&#39; is not defined</pre>
-                    </div>
-                    <div class="clearfix"></div>
-                </div>
-                <!--css div popup end-->
-            </td>
         </tr>
     
     
@@ -2206,8 +2104,8 @@ NameError: name &#39;SMB_LIB&#39; is not defined</pre>
                     </div>
                     <div class="text-left pull-left">
                         <pre class="text-left">Traceback (most recent call last):
-  File &#34;/home/ozzie/Development/calibre-web-test/test/test_edit_books_metadata.py&#34;, line 69, in test_load_metadata
+  File &#34;/home/ozzie/Development/calibre-web-test/test/test_edit_books_metadata.py&#34;, line 90, in test_load_metadata
-    if &#39;https://comicvine.gamespot.com/&#39; == results[10][&#39;source&#39;]:
+    elif len(results)&gt;19 and &#39;https://amazon.com/&#39; == results[20][&#39;source&#39;]:
 IndexError: list index out of range</pre>
                     </div>
                     <div class="clearfix"></div>
@@ -2396,13 +2294,13 @@ IndexError: list index out of range</pre>
     
 
 
-    <tr id="su" class="failClass">
+    <tr id="su" class="passClass">
         <td>TestLoadMetadataScholar</td>
         <td class="text-center">1</td>
-        <td class="text-center">0</td>
         <td class="text-center">1</td>
         <td class="text-center">0</td>
         <td class="text-center">0</td>
+        <td class="text-center">0</td>
         <td class="text-center">
             <a onclick="showClassDetail('c20', 1)">Detail</a>
         </td>
@@ -2410,41 +2308,21 @@ IndexError: list index out of range</pre>
 
     
     
-        <tr id="ft20.1" class="none bg-danger">
+        <tr id='pt20.1' class='hiddenRow bg-success'>
             <td>
                 <div class='testcase'>TestLoadMetadataScholar - test_load_metadata</div>
             </td>
-            <td colspan='6'>
+            <td colspan='6' align='center'>PASS</td>
-                <div class="text-center">
-                    <a class="popup_link text-center" onfocus='blur()' onclick="showTestDetail('div_ft20.1')">FAIL</a>
-                </div>
-                <!--css div popup start-->
-                <div id="div_ft20.1" class="popup_window test_output" style="display:block;">
-                    <div class='close_button pull-right'>
-                        <button type="button" class="close" aria-label="Close" onfocus="this.blur();"
-                                onclick="document.getElementById('div_ft20.1').style.display='none'"><span
-                                aria-hidden="true">&times;</span></button>
-                    </div>
-                    <div class="text-left pull-left">
-                        <pre class="text-left">Traceback (most recent call last):
-  File &#34;/home/ozzie/Development/calibre-web-test/test/test_edit_metadata_scholar.py&#34;, line 74, in test_load_metadata
-    self.assertEqual(30, len(results))
-AssertionError: 30 != 0</pre>
-                    </div>
-                    <div class="clearfix"></div>
-                </div>
-                <!--css div popup end-->
-            </td>
         </tr>
     
     
 
 
-    <tr id="su" class="failClass">
+    <tr id="su" class="passClass">
         <td>TestSTARTTLS</td>
         <td class="text-center">3</td>
-        <td class="text-center">2</td>
+        <td class="text-center">3</td>
-        <td class="text-center">1</td>
+        <td class="text-center">0</td>
         <td class="text-center">0</td>
         <td class="text-center">0</td>
         <td class="text-center">
@@ -2454,33 +2332,11 @@ AssertionError: 30 != 0</pre>
 
     
     
-        <tr id="ft21.1" class="none bg-danger">
+        <tr id='pt21.1' class='hiddenRow bg-success'>
             <td>
                 <div class='testcase'>TestSTARTTLS - test_STARTTLS</div>
             </td>
-            <td colspan='6'>
+            <td colspan='6' align='center'>PASS</td>
-                <div class="text-center">
-                    <a class="popup_link text-center" onfocus='blur()' onclick="showTestDetail('div_ft21.1')">FAIL</a>
-                </div>
-                <!--css div popup start-->
-                <div id="div_ft21.1" class="popup_window test_output" style="display:block;">
-                    <div class='close_button pull-right'>
-                        <button type="button" class="close" aria-label="Close" onfocus="this.blur();"
-                                onclick="document.getElementById('div_ft21.1').style.display='none'"><span
-                                aria-hidden="true">&times;</span></button>
-                    </div>
-                    <div class="text-left pull-left">
-                        <pre class="text-left">Traceback (most recent call last):
-  File &#34;/home/ozzie/Development/calibre-web-test/test/test_email_STARTTLS.py&#34;, line 83, in test_STARTTLS
-    task_len, ret = self.wait_tasks(tasks, 1)
-  File &#34;/home/ozzie/Development/calibre-web-test/test/helper_ui.py&#34;, line 1636, in wait_tasks
-    self.assertEqual(expected, task_len)
-AssertionError: 1 != 2</pre>
-                    </div>
-                    <div class="clearfix"></div>
-                </div>
-                <!--css div popup end-->
-            </td>
         </tr>
     
     
@@ -4682,11 +4538,11 @@ AssertionError: 1 != 2</pre>
     
 
 
-    <tr id="su" class="skipClass">
+    <tr id="su" class="failClass">
         <td>TestThumbnails</td>
         <td class="text-center">8</td>
-        <td class="text-center">7</td>
+        <td class="text-center">6</td>
-        <td class="text-center">0</td>
+        <td class="text-center">1</td>
         <td class="text-center">0</td>
         <td class="text-center">1</td>
         <td class="text-center">
@@ -4759,11 +4615,31 @@ AssertionError: 1 != 2</pre>
     
     
     
-        <tr id='pt51.8' class='hiddenRow bg-success'>
+        <tr id="ft51.8" class="none bg-danger">
             <td>
                 <div class='testcase'>TestThumbnails - test_sideloaded_book</div>
             </td>
-            <td colspan='6' align='center'>PASS</td>
+            <td colspan='6'>
+                <div class="text-center">
+                    <a class="popup_link text-center" onfocus='blur()' onclick="showTestDetail('div_ft51.8')">FAIL</a>
+                </div>
+                <!--css div popup start-->
+                <div id="div_ft51.8" class="popup_window test_output" style="display:block;">
+                    <div class='close_button pull-right'>
+                        <button type="button" class="close" aria-label="Close" onfocus="this.blur();"
+                                onclick="document.getElementById('div_ft51.8').style.display='none'"><span
+                                aria-hidden="true">&times;</span></button>
+                    </div>
+                    <div class="text-left pull-left">
+                        <pre class="text-left">Traceback (most recent call last):
+  File &#34;/home/ozzie/Development/calibre-web-test/test/test_thumbnails.py&#34;, line 316, in test_sideloaded_book
+    self.assertAlmostEqual(diff(BytesIO(list_cover), BytesIO(old_list_cover), delete_diff_file=True), 0.0,
+AssertionError: 0.005925365701836291 != 0.0 within 0.0001 delta (0.005925365701836291 difference)</pre>
+                    </div>
+                    <div class="clearfix"></div>
+                </div>
+                <!--css div popup end-->
+            </td>
         </tr>
     
     
@@ -4951,11 +4827,11 @@ AssertionError: 1 != 2</pre>
     
 
 
-    <tr id="su" class="failClass">
+    <tr id="su" class="passClass">
         <td>TestUserList</td>
         <td class="text-center">18</td>
-        <td class="text-center">17</td>
+        <td class="text-center">18</td>
-        <td class="text-center">1</td>
+        <td class="text-center">0</td>
         <td class="text-center">0</td>
         <td class="text-center">0</td>
         <td class="text-center">
@@ -5019,31 +4895,11 @@ AssertionError: 1 != 2</pre>
     
     
     
-        <tr id="ft54.7" class="none bg-danger">
+        <tr id='pt54.7' class='hiddenRow bg-success'>
             <td>
                 <div class='testcase'>TestUserList - test_user_list_edit_button</div>
             </td>
-            <td colspan='6'>
+            <td colspan='6' align='center'>PASS</td>
-                <div class="text-center">
-                    <a class="popup_link text-center" onfocus='blur()' onclick="showTestDetail('div_ft54.7')">FAIL</a>
-                </div>
-                <!--css div popup start-->
-                <div id="div_ft54.7" class="popup_window test_output" style="display:block;">
-                    <div class='close_button pull-right'>
-                        <button type="button" class="close" aria-label="Close" onfocus="this.blur();"
-                                onclick="document.getElementById('div_ft54.7').style.display='none'"><span
-                                aria-hidden="true">&times;</span></button>
-                    </div>
-                    <div class="text-left pull-left">
-                        <pre class="text-left">Traceback (most recent call last):
-  File &#34;/home/ozzie/Development/calibre-web-test/test/test_user_list.py&#34;, line 161, in test_user_list_edit_button
-    self.assertTrue(self.check_element_on_page((By.ID, &#34;user_delete_selection&#34;)), &#34;Press cancel in User edit leads not back to user table&#34;)
-AssertionError: False is not true : Press cancel in User edit leads not back to user table</pre>
-                    </div>
-                    <div class="clearfix"></div>
-                </div>
-                <!--css div popup end-->
-            </td>
         </tr>
     
     
@@ -5376,11 +5232,11 @@ AssertionError: False is not true : Press cancel in User edit leads not back to
     
 
 
-    <tr id="su" class="failClass">
+    <tr id="su" class="passClass">
         <td>TestCalibreWebVisibilitys</td>
         <td class="text-center">35</td>
-        <td class="text-center">34</td>
+        <td class="text-center">35</td>
-        <td class="text-center">1</td>
+        <td class="text-center">0</td>
         <td class="text-center">0</td>
         <td class="text-center">0</td>
         <td class="text-center">
@@ -5408,31 +5264,11 @@ AssertionError: False is not true : Press cancel in User edit leads not back to
     
     
     
-        <tr id="ft57.3" class="none bg-danger">
+        <tr id='pt57.3' class='hiddenRow bg-success'>
             <td>
                 <div class='testcase'>TestCalibreWebVisibilitys - test_admin_add_user</div>
             </td>
-            <td colspan='6'>
+            <td colspan='6' align='center'>PASS</td>
-                <div class="text-center">
-                    <a class="popup_link text-center" onfocus='blur()' onclick="showTestDetail('div_ft57.3')">FAIL</a>
-                </div>
-                <!--css div popup start-->
-                <div id="div_ft57.3" class="popup_window test_output" style="display:block;">
-                    <div class='close_button pull-right'>
-                        <button type="button" class="close" aria-label="Close" onfocus="this.blur();"
-                                onclick="document.getElementById('div_ft57.3').style.display='none'"><span
-                                aria-hidden="true">&times;</span></button>
-                    </div>
-                    <div class="text-left pull-left">
-                        <pre class="text-left">Traceback (most recent call last):
-  File &#34;/home/ozzie/Development/calibre-web-test/test/test_visiblilitys.py&#34;, line 480, in test_admin_add_user
-    self.assertIsNone(&#34;Error creating new users&#34;)
-AssertionError: &#39;Error creating new users&#39; is not None</pre>
-                    </div>
-                    <div class="clearfix"></div>
-                </div>
-                <!--css div popup end-->
-            </td>
         </tr>
     
     
@@ -5887,9 +5723,9 @@ AssertionError: &#39;Error creating new users&#39; is not None</pre>
     <tr id='total_row' class="text-center bg-grey">
         <td>Total</td>
         <td>510</td>
-        <td>490</td>
+        <td>498</td>
-        <td>5</td>
+        <td>1</td>
-        <td>5</td>
+        <td>1</td>
         <td>10</td>
         <td>&nbsp;</td>
     </tr>
@@ -6422,7 +6258,7 @@ AssertionError: &#39;Error creating new users&#39; is not None</pre>
 </div>
 
 <script>
-    drawCircle(490, 5, 5, 10);
+    drawCircle(498, 1, 1, 10);
     showCase(5);
 </script>