feat: bring a picture in from a web address, and the Files pages (#1181) #1213

Merged

claude-bot merged 17 commits from feat/1181-pictures-and-files into main 2026-10-17 12:55:20 +00:00

Conversation 0 Commits 17 Files changed 54 +6652 -75

claude-bot commented 2026-10-17 12:06:03 +00:00

Collaborator

Copy link

Fixes #1181: bring a picture in from a web address, saved as an upload, and the Files pages. The owner's decisions are on #1181, including Q181 (a) and support access (17 Oct).

Server

• Migration a1181f11e5a1 (now revising a1190e7e0a01): where a stored picture came from (source_url, fetched_at, plus who added a page picture and when), and campaigns.media_add_mode (editors or gm_only). The mode is enforced on every upload route.
• Bring it in (POST …/lore/{eid}/attachments/from-url), for anyone who can edit the page. Suggesters can't.
• Wiki health: "Pictures still on other sites", with a GM-only bring-in that rewrites the text as an undoable edit.
• Campaign Files (GM only):
  • list, filters, previews and thumbnails;
  • removal shows the text that would break;
  • orphans are listed separately.
• Admin → Files shows the list only. Opening or previewing another campaign's file is a POST that writes files.opened_by_admin to the audit log and returns a 120 s token bound to that admin.

The fetcher (shared with the page-picture "from a web address")

• The existing page-picture fetch followed redirects without checking them. It's fixed here: every hop is re-checked, connections are pinned to the checked address, https only, and the size cap is enforced while streaming.
• An independent security review found that a gzip bomb could inflate about 190 MiB before the cap fired. Now Accept-Encoding: identity is sent, any Content-Encoding is refused, and the cap counts wire bytes.
• Also from the review:
  • NAT64, 6to4, Teredo, fec0::/10, ::/96 and multicast are blocked, and embedded IPv4 addresses are checked;
  • thumbnails are pixel-bounded;
  • a test proves the pool uses the guard;
  • trust_env=False.
• Rate limits: 30 per person and 60 per campaign per 10 minutes.

Screens

• Settings → Files: grid or table, a viewer with zoom, removal, orphans.
• Settings → Wiki: "Who can add pictures and files".
• The editor's "Bring it in", and the Wiki health row with Undo.
• Admin → Files with audited Preview and Open.
• One line on the Privacy page.

Tests

• Backend: tests/wiki and friends, 1768 passed; then the security fixes, 132 passed.
• Frontend: targeted vitest, with load timeouts rerun.
• Journeys on docker-test: a11y admin and campaign pages, J8 pictures and Link it, 15 passed on desktop, phone and keyboard.
• The 4.6.0 integration rehearsal (integ/4.6.0): 10,333 backend tests and 187 journeys passed.

CATALOGUE ids renumbered for 4.6.0: CAMP-22 and IS-515 to IS-521 (the line of the night's row is now IS-515).

🤖 Generated with Claude Code

Fixes #1181: bring a picture in from a web address, saved as an upload, and the Files pages. The owner's decisions are on #1181, including Q181 (a) and support access (17 Oct). **Server** - **Migration `a1181f11e5a1`** (now revising `a1190e7e0a01`): where a stored picture came from (`source_url`, `fetched_at`, plus who added a page picture and when), and `campaigns.media_add_mode` (`editors` or `gm_only`). The mode is enforced on every upload route. - **Bring it in** (`POST …/lore/{eid}/attachments/from-url`), for anyone who can edit the page. Suggesters can't. - **Wiki health:** "Pictures still on other sites", with a GM-only bring-in that rewrites the text as an undoable edit. - **Campaign Files** (GM only): - list, filters, previews and thumbnails; - removal shows the text that would break; - orphans are listed separately. - **Admin → Files** shows the list only. Opening or previewing another campaign's file is a POST that writes `files.opened_by_admin` to the audit log and returns a 120 s token bound to that admin. **The fetcher (shared with the page-picture "from a web address")** - The existing page-picture fetch followed redirects without checking them. It's fixed here: every hop is re-checked, connections are pinned to the checked address, https only, and the size cap is enforced while streaming. - An independent security review found that a gzip bomb could inflate about 190 MiB before the cap fired. Now `Accept-Encoding: identity` is sent, any `Content-Encoding` is refused, and the cap counts wire bytes. - Also from the review: - NAT64, 6to4, Teredo, `fec0::/10`, `::/96` and multicast are blocked, and embedded IPv4 addresses are checked; - thumbnails are pixel-bounded; - a test proves the pool uses the guard; - `trust_env=False`. - Rate limits: 30 per person and 60 per campaign per 10 minutes. **Screens** - Settings → Files: grid or table, a viewer with zoom, removal, orphans. - Settings → Wiki: "Who can add pictures and files". - The editor's "Bring it in", and the Wiki health row with Undo. - Admin → Files with audited Preview and Open. - One line on the Privacy page. **Tests** - Backend: `tests/wiki` and friends, 1768 passed; then the security fixes, 132 passed. - Frontend: targeted vitest, with load timeouts rerun. - Journeys on docker-test: a11y admin and campaign pages, J8 pictures and Link it, 15 passed on desktop, phone and keyboard. - The 4.6.0 integration rehearsal (`integ/4.6.0`): 10,333 backend tests and 187 journeys passed. CATALOGUE ids renumbered for 4.6.0: CAMP-22 and IS-515 to IS-521 (the line of the night's row is now IS-515). 🤖 Generated with [Claude Code](https://claude.com/claude-code)

claude-bot added 17 commits 2026-10-17 12:06:03 +00:00

wip: pictures from a web address and the Files pages (backend, untested) ... bc4db135e1

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

feat(webapp): bring a picture in from a web address, and the Files pages (#1181) ... 2aa68db646

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

fix(webapp): refuse NAT64, 6to4 and Teredo addresses in the picture fetcher (#1181) ... f9a006193e

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

fix: import LoreEntry in campaigns router ... bdcfd79c93

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

fix: member lookup, tests ... 111477973f

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

test: admin files and wiki health bring-in; CLAUDE.md head ... 7db9ba5013

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

wip: files page reads through entries; list readers ... 885fa5a860

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

test: list the Files page's title reads ... 49fbcea96f

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

test: title read count ... ea87558417

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

style: ruff format ... 4950885fac

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

fix(webapp): refuse compressed picture fetches, bound thumbnail decode, block more ranges (#1181) ... 5601788dba

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

test: stream mock bodies as a real connection does; ruff format ... 8773fe3e1b

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

wip(webapp): catalogue rows, changelog, ref fix (#1181) ... b3526a591e

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

wip(webapp): lint fixes (#1181) ... 7a8a3a754b

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

fix: restore the security fixes from 5601788d and 8773fe3e that my earlier commit dropped (#1181) ... 96add4e6de

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

test: locale-proof dates, clear mocks, read the latest text between pictures (#1181) ... f9c3eedde2

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Merge main into feat/1181-pictures-and-files; its migration follows a1190e7e0a01; catalogue ids renumbered (CAMP-22, IS-515 to IS-521) ... 9e0e13f1f3

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

claude-bot scheduled this pull request to auto merge when all checks succeed 2026-10-17 12:06:06 +00:00

claude-bot merged commit bac7112652 into main 2026-10-17 12:55:20 +00:00

claude-bot referenced this pull request from a commit 2026-10-17 12:55:22 +00:00

Merge PR #1213: bring a picture in from a web address, and the Files pages (#1181)

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

backend

Issue related to the backend

  

bot

Issue related to the bot

  

bug

Something is not working

  

duplicate

This issue or pull request already exists

  

enhancement

New feature

  

frontend

Issue related to the frontend

  

help wanted

Need some help

  

invalid

Something is wrong

  

question

More information is needed

  

recording

Issue related to the recording system

  

security

Security hardening / vulnerability work

  

wontfix

This won't be fixed

No labels

backend

bot

bug

duplicate

enhancement

frontend

help wanted

invalid

question

recording

security

wontfix

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

rbrooks/Quest-Board!1213

No description provided.