Merge branch 'master' into cover_thumbnail

# Conflicts:
#	cps/editbooks.py
#	cps/helper.py
#	cps/web.py
#	test/Calibre-Web TestSummary_Linux.html

README.md

@@ -40,16 +40,12 @@ Calibre-Web is a web app providing a clean interface for browsing, reading and d
 ## Installation
 
 #### Installation via pip (recommended)
-1. Install calibre web via pip with the command `pip install calibreweb` (Depending on your OS and or distro the command could also be `pip3`). 
-2. Optional features can also be installed via pip, please refer to [this page](https://github.com/janeczku/calibre-web/wiki/Dependencies-in-Calibre-Web-Linux-Windows) for details 
-3. Calibre-Web can be started afterwards by typing `cps` or `python3 -m cps` 
+1. To avoid problems with already installed python dependencies, it's recommended to create a virtual environment for Calibre-Web
+2. Install Calibre-Web via pip with the command `pip install calibreweb` (Depending on your OS and or distro the command could also be `pip3`). 
+3. Optional features can also be installed via pip, please refer to [this page](https://github.com/janeczku/calibre-web/wiki/Dependencies-in-Calibre-Web-Linux-Windows) for details 
+4. Calibre-Web can be started afterwards by typing `cps` or `python3 -m cps` 
 
-#### Manual installation
-1. Install dependencies by running `pip3 install --target vendor -r requirements.txt` (python3.x). Alternativly set up a python virtual environment.
-2. Execute the command: `python3 cps.py` (or `nohup python3 cps.py` - recommended if you want to exit the terminal window)
-
-Issues with Ubuntu:
-Please note that running the above install command can fail on some versions of Ubuntu, saying `"can't combine user with prefix"`. This is a [known bug](https://github.com/pypa/pip/issues/3826) and can be remedied by using the command `pip install --system --target vendor -r requirements.txt` instead.
+In the Wiki there are also examples for a [manual installation](https://github.com/janeczku/calibre-web/wiki/Manual-installation) and for installation on [Linux Mint](https://github.com/janeczku/calibre-web/wiki/How-To:Install-Calibre-Web-in-Linux-Mint-19-or-20)
 
 ## Quick start
 

SECURITY.md

@@ -32,6 +32,8 @@ To receive fixes for security vulnerabilities it is required to always upgrade t
 | V 0.6.16      | JavaScript could get executed on authors page. Thanks to @alicaz                                                   ||
 | V 0.6.16      | Localhost can no longer be used to upload covers. Thanks to @scara31                                               ||
 | V 0.6.16      | Another case where public shelfs could be created without permission is prevented. Thanks to @nhiephon             ||
+| V 0.6.17      | The SSRF Protection can no longer be bypassed via an HTTP redirect. Thanks to @416e6e61                            ||
+| V 0.6.17      | The SSRF Protection can no longer be bypassed via 0.0.0.0 and it's ipv6 equivalent. Thanks to @r0hanSH             ||
 
 
 ## Staement regarding Log4j (CVE-2021-44228 and related)

cps.py

@@ -40,7 +40,7 @@
 from cps.shelf import shelf
 from cps.admin import admi
 from cps.gdrive import gdrive
-from cps.editbooks import editbook
+from cps.editbooks import EditBook
 from cps.remotelogin import remotelogin
 from cps.search_metadata import meta
 from cps.error_handler import init_errorhandler
@@ -74,7 +74,7 @@ def main():
     app.register_blueprint(remotelogin)
     app.register_blueprint(meta)
     app.register_blueprint(gdrive)
-    app.register_blueprint(editbook)
+    app.register_blueprint(EditBook)
     if kobo_available:
         app.register_blueprint(kobo)
         app.register_blueprint(kobo_auth)

cps/__init__.py

@@ -156,7 +156,7 @@ def create_app():
         services.goodreads_support.connect(config.config_goodreads_api_key,
                                            config.config_goodreads_api_secret,
                                            config.config_use_goodreads)
-    config.store_calibre_uuid(calibre_db, db.Library_Id)
+    config.store_calibre_uuid(calibre_db, db.LibraryId)
     return app
 
 

cps/comic.py

@@ -1,7 +1,7 @@
 # -*- coding: utf-8 -*-
 
 #   This file is part of the Calibre-Web (https://github.com/janeczku/calibre-web)
-#     Copyright (C) 2018 OzzieIsaacs
+#     Copyright (C) 2018-2022 OzzieIsaacs
 #
 #   This program is free software: you can redistribute it and/or modify
 #   it under the terms of the GNU General Public License as published by
@@ -18,19 +18,16 @@
 
 import os
 
-from . import logger, isoLanguages
+from . import logger, isoLanguages, cover
 from .constants import BookMeta
 
-
-log = logger.create()
-
-
 try:
     from wand.image import Image
     use_IM = True
 except (ImportError, RuntimeError) as e:
     use_IM = False
 
+log = logger.create()
 
 try:
     from comicapi.comicarchive import ComicArchive, MetaDataStyle
@@ -51,37 +48,16 @@
         use_rarfile = False
     use_comic_meta = False
 
-NO_JPEG_EXTENSIONS = ['.png', '.webp', '.bmp']
-COVER_EXTENSIONS = ['.png', '.webp', '.bmp', '.jpg', '.jpeg']
-
-def _cover_processing(tmp_file_name, img, extension):
-    tmp_cover_name = os.path.join(os.path.dirname(tmp_file_name), 'cover.jpg')
-    if extension in NO_JPEG_EXTENSIONS:
-        if use_IM:
-            with Image(blob=img) as imgc:
-                imgc.format = 'jpeg'
-                imgc.transform_colorspace('rgb')
-                imgc.save(filename=tmp_cover_name)
-                return tmp_cover_name
-        else:
-            return None
-    if img:
-        with open(tmp_cover_name, 'wb') as f:
-            f.write(img)
-        return tmp_cover_name
-    else:
-        return None
-
 
-def _extract_Cover_from_archive(original_file_extension, tmp_file_name, rarExecutable):
+def _extract_cover_from_archive(original_file_extension, tmp_file_name, rar_executable):
     cover_data = extension = None
     if original_file_extension.upper() == '.CBZ':
         cf = zipfile.ZipFile(tmp_file_name)
         for name in cf.namelist():
             ext = os.path.splitext(name)
             if len(ext) > 1:
                 extension = ext[1].lower()
-                if extension in COVER_EXTENSIONS:
+                if extension in cover.COVER_EXTENSIONS:
                     cover_data = cf.read(name)
                     break
     elif original_file_extension.upper() == '.CBT':
@@ -90,44 +66,44 @@ def _extract_Cover_from_archive(original_file_extension, tmp_file_name, rarExecu
             ext = os.path.splitext(name)
             if len(ext) > 1:
                 extension = ext[1].lower()
-                if extension in COVER_EXTENSIONS:
+                if extension in cover.COVER_EXTENSIONS:
                     cover_data = cf.extractfile(name).read()
                     break
     elif original_file_extension.upper() == '.CBR' and use_rarfile:
         try:
-            rarfile.UNRAR_TOOL = rarExecutable
+            rarfile.UNRAR_TOOL = rar_executable
             cf = rarfile.RarFile(tmp_file_name)
-            for name in cf.getnames():
+            for name in cf.namelist():
                 ext = os.path.splitext(name)
                 if len(ext) > 1:
                     extension = ext[1].lower()
-                    if extension in COVER_EXTENSIONS:
+                    if extension in cover.COVER_EXTENSIONS:
                         cover_data = cf.read(name)
                         break
         except Exception as ex:
-            log.debug('Rarfile failed with error: %s', ex)
+            log.debug('Rarfile failed with error: {}'.format(ex))
     return cover_data, extension
 
 
-def _extractCover(tmp_file_name, original_file_extension, rarExecutable):
+def _extract_cover(tmp_file_name, original_file_extension, rar_executable):
     cover_data = extension = None
     if use_comic_meta:
-        archive = ComicArchive(tmp_file_name, rar_exe_path=rarExecutable)
+        archive = ComicArchive(tmp_file_name, rar_exe_path=rar_executable)
         for index, name in enumerate(archive.getPageNameList()):
             ext = os.path.splitext(name)
             if len(ext) > 1:
                 extension = ext[1].lower()
-                if extension in COVER_EXTENSIONS:
+                if extension in cover.COVER_EXTENSIONS:
                     cover_data = archive.getPage(index)
                     break
     else:
-        cover_data, extension = _extract_Cover_from_archive(original_file_extension, tmp_file_name, rarExecutable)
-    return _cover_processing(tmp_file_name, cover_data, extension)
+        cover_data, extension = _extract_cover_from_archive(original_file_extension, tmp_file_name, rar_executable)
+    return cover.cover_processing(tmp_file_name, cover_data, extension)
 
 
-def get_comic_info(tmp_file_path, original_file_name, original_file_extension, rarExecutable):
+def get_comic_info(tmp_file_path, original_file_name, original_file_extension, rar_executable):
     if use_comic_meta:
-        archive = ComicArchive(tmp_file_path, rar_exe_path=rarExecutable)
+        archive = ComicArchive(tmp_file_path, rar_exe_path=rar_executable)
         if archive.seemsToBeAComicArchive():
             if archive.hasMetadata(MetaDataStyle.CIX):
                 style = MetaDataStyle.CIX
@@ -137,31 +113,31 @@ def get_comic_info(tmp_file_path, original_file_name, original_file_extension, r
                 style = None
 
             # if style is not None:
-            loadedMetadata = archive.readMetadata(style)
+            loaded_metadata = archive.readMetadata(style)
 
-            lang = loadedMetadata.language or ""
-            loadedMetadata.language = isoLanguages.get_lang3(lang)
+            lang = loaded_metadata.language or ""
+            loaded_metadata.language = isoLanguages.get_lang3(lang)
 
             return BookMeta(
                 file_path=tmp_file_path,
                 extension=original_file_extension,
-                title=loadedMetadata.title or original_file_name,
+                title=loaded_metadata.title or original_file_name,
                 author=" & ".join([credit["person"]
-                                   for credit in loadedMetadata.credits if credit["role"] == "Writer"]) or u'Unknown',
-                cover=_extractCover(tmp_file_path, original_file_extension, rarExecutable),
-                description=loadedMetadata.comments or "",
+                                   for credit in loaded_metadata.credits if credit["role"] == "Writer"]) or 'Unknown',
+                cover=_extract_cover(tmp_file_path, original_file_extension, rar_executable),
+                description=loaded_metadata.comments or "",
                 tags="",
-                series=loadedMetadata.series or "",
-                series_id=loadedMetadata.issue or "",
-                languages=loadedMetadata.language,
+                series=loaded_metadata.series or "",
+                series_id=loaded_metadata.issue or "",
+                languages=loaded_metadata.language,
                 publisher="")
 
     return BookMeta(
         file_path=tmp_file_path,
         extension=original_file_extension,
         title=original_file_name,
         author=u'Unknown',
-        cover=_extractCover(tmp_file_path, original_file_extension, rarExecutable),
+        cover=_extract_cover(tmp_file_path, original_file_extension, rar_executable),
         description="",
         tags="",
         series="",

cps/constants.py

@@ -161,7 +161,7 @@ def selected_roles(dictionary):
 BookMeta = namedtuple('BookMeta', 'file_path, extension, title, author, cover, description, tags, series, '
                                   'series_id, languages, publisher')
 
-STABLE_VERSION = {'version': '0.6.17 Beta'}
+STABLE_VERSION = {'version': '0.6.18 Beta'}
 
 NIGHTLY_VERSION = dict()
 NIGHTLY_VERSION[0] = '$Format:%H$'

cps/converter.py

@@ -27,7 +27,6 @@
 log = logger.create()
 
 # _() necessary to make babel aware of string for translation
-_NOT_CONFIGURED = _('not configured')
 _NOT_INSTALLED = _('not installed')
 _EXECUTION_ERROR = _('Execution permissions missing')
 
@@ -48,14 +47,16 @@ def _get_command_version(path, pattern, argument=None):
 
 
 def get_calibre_version():
-    return _get_command_version(config.config_converterpath, r'ebook-convert.*\(calibre', '--version') \
-           or _NOT_CONFIGURED
+    return _get_command_version(config.config_converterpath, r'ebook-convert.*\(calibre', '--version')
 
 
 def get_unrar_version():
-    return _get_command_version(config.config_rarfile_location, r'UNRAR.*\d') or _NOT_CONFIGURED
+    unrar_version = _get_command_version(config.config_rarfile_location, r'UNRAR.*\d')
+    if unrar_version == "not installed":
+        unrar_version = _get_command_version(config.config_rarfile_location, r'unrar.*\d','-V')
+    return unrar_version
 
 def get_kepubify_version():
-    return _get_command_version(config.config_kepubifypath, r'kepubify\s','--version') or _NOT_CONFIGURED
+    return _get_command_version(config.config_kepubifypath, r'kepubify\s','--version')
 
 

cps/cover.py

@@ -0,0 +1,48 @@
+# -*- coding: utf-8 -*-
+
+#   This file is part of the Calibre-Web (https://github.com/janeczku/calibre-web)
+#     Copyright (C) 2022 OzzieIsaacs
+#
+#   This program is free software: you can redistribute it and/or modify
+#   it under the terms of the GNU General Public License as published by
+#   the Free Software Foundation, either version 3 of the License, or
+#   (at your option) any later version.
+#
+#   This program is distributed in the hope that it will be useful,
+#   but WITHOUT ANY WARRANTY; without even the implied warranty of
+#   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+#   GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public License
+#   along with this program. If not, see <http://www.gnu.org/licenses/>.
+
+import os
+
+try:
+    from wand.image import Image
+    use_IM = True
+except (ImportError, RuntimeError) as e:
+    use_IM = False
+
+
+NO_JPEG_EXTENSIONS = ['.png', '.webp', '.bmp']
+COVER_EXTENSIONS = ['.png', '.webp', '.bmp', '.jpg', '.jpeg']
+
+
+def cover_processing(tmp_file_name, img, extension):
+    tmp_cover_name = os.path.join(os.path.dirname(tmp_file_name), 'cover.jpg')
+    if extension in NO_JPEG_EXTENSIONS:
+        if use_IM:
+            with Image(blob=img) as imgc:
+                imgc.format = 'jpeg'
+                imgc.transform_colorspace('rgb')
+                imgc.save(filename=tmp_cover_name)
+                return tmp_cover_name
+        else:
+            return None
+    if img:
+        with open(tmp_cover_name, 'wb') as f:
+            f.write(img)
+        return tmp_cover_name
+    else:
+        return None