Because this makes more sense to reuse the logic and also because APIRequest is now only locally accessible in the tmdb package, to stop me from using anywhere else, should always use an exposed function from the package so it can be reused.
Since the default CheckRedirect has been replaced with ours, we won't get the default protection of erroring after 10 redirects, so i've copied that back in from the std implementation
The Plex integration used bare http.Client values with no CheckRedirect
policy, so they followed redirects automatically. net/http strips the
standard sensitive headers on a cross-host redirect but not custom-named
headers, so the Plex token carried in X-Plex-Token was forwarded verbatim
to any host the configured PLEX_HOST redirected to, disclosing the
credential.
Route all Plex outbound calls through a shared client whose CheckRedirect
policy deletes X-Plex-Token when the redirect target host differs from the
original request host. Includes a regression test.
Signed-off-by: tonghuaroot <tonghuaroot@gmail.com>
- Create a better (more) re-usable flow for downloading images to disk and inserting images into the db
- Validate images properly by reading them fully and using DecodeConfig
- Fix some security issues by re-encoding images
- Always outputs one format `jpeg`, which keeps everything "normalized" and adds compression to images (mainly user uploads which might be big).
it isn't used and is only a way for others to potentially add activity to other peoples watched entries since user owning the watched entry is not validated on the endpoint.
Co-Authored-By: Dreddy <24421368+dredsen@users.noreply.github.com>
We don't use these columns and won't in the foreseeable future. Query speed seems be to be faster now that we aren't filtering for the extra deleted_at cols.
IRHM
tonghuaroot