[pull] main from meeb:main

tubesync/sync/utils.py

@@ -3,6 +3,7 @@
 import math
 from operator import itemgetter
 from pathlib import Path
+from tempfile import NamedTemporaryFile
 import requests
 from PIL import Image
 from django.conf import settings
@@ -99,24 +100,34 @@ def file_is_editable(filepath):
     '''
     allowed_paths = (
         # Media item thumbnails
-        os.path.commonpath([os.path.abspath(str(settings.MEDIA_ROOT))]),
+        Path(str(settings.MEDIA_ROOT)).resolve(),
+
         # Downloaded media files
-        os.path.commonpath([os.path.abspath(str(settings.DOWNLOAD_ROOT))]),
+        Path(str(settings.DOWNLOAD_ROOT)).resolve(),
     )
-    filepath = os.path.abspath(str(filepath))
-    if not os.path.isfile(filepath):
+    filepath = Path(str(filepath)).resolve()
+    if not filepath.is_file():
         return False
     for allowed_path in allowed_paths:
-        if allowed_path == os.path.commonpath([allowed_path, filepath]):
+        if str(allowed_path) == os.path.commonpath([allowed_path, filepath]):
             return True
     return False
 
 
 def write_text_file(filepath, filedata):
     if not isinstance(filedata, str):
-        raise ValueError(f'filedata must be a str, got "{type(filedata)}"')
-    with open(filepath, 'wt') as f:
+        raise TypeError(f'filedata must be a str, got "{type(filedata)}"')
+    filepath_dir = str(Path(filepath).parent)
+    with NamedTemporaryFile(mode='wt', suffix='.tmp', prefix='', dir=filepath_dir, delete=False) as f:
+        new_filepath = Path(f.name)
         bytes_written = f.write(filedata)
+    # chmod a+r temp_file
+    old_mode = new_filepath.stat().st_mode
+    new_filepath.chmod(0o444 | old_mode)
+    if not file_is_editable(new_filepath):
+        new_filepath.unlink()
+        raise ValueError(f'File cannot be edited or removed: {filepath}')
+    new_filepath.replace(filepath)
     return bytes_written
 
 

tubesync/sync/youtube.py

@@ -49,7 +49,6 @@ def get_channel_image_info(url):
     opts = get_yt_opts()
     opts.update({
         'skip_download': True,
-        'forcejson': True,
         'simulate': True,
         'logger': log,
         'extract_flat': True,  # Change to False to get detailed info
@@ -84,7 +83,6 @@ def get_media_info(url):
     opts = get_yt_opts()
     opts.update({
         'skip_download': True,
-        'forcejson': True,
         'simulate': True,
         'logger': log,
         'extract_flat': True,

tubesync/tubesync/settings.py

@@ -165,7 +165,7 @@
 YOUTUBE_DL_CACHEDIR = None
 YOUTUBE_DL_TEMPDIR = None
 YOUTUBE_DEFAULTS = {
-    'no_color': True,       # Do not use colours in output
+    'color': 'never',       # Do not use colours in output
     'age_limit': 99,        # 'Age in years' to spoof
     'ignoreerrors': True,   # Skip on errors (such as unavailable videos in playlists)
     'cachedir': False,      # Disable on-disk caching