When constructing paths to image files to serve, we previously spliced
strings from URL requests directly into the path to be opened. This is
theoretically worrisome because it could allow clients to read other
files that they are not supposed to read.
I'm not actually sure this is a real security problem because Flask's
URL parsing should probably rule out IDs that have `/` in them anyway.
But out of an abundance of caution, this now prevents paths from showing
up in IDs at all---and also prevents `.` and `..` from being valid
names.
Unit test may fails when path to temprorary library contains `.`; to
garantue that bug wasn't here, it forces to use one more `.` inside path.
Fixes: https://github.com/beetbox/beets/issues/4151
Making these types and queries available is part of fully loading the plugins,
so the event should not be sent until this work is done. This allows plugins
to make use of those types and queries in a pluginload listener.
remove interlacing by default when resizing/down-scaling, the
`deinterlace` option is to remove interlace when otherwise no processing
would have happened.
The idea of this changes is simple: let move file to some temporary name
inside distance folder, and after the file is already copy it renames to
expected name.
When someone tries to save anything it also moves file to trigger OS
level notification for change FS.
This commit also enforce that `beets.util.move` shouldn't be used to
move directories as it described in comment.
Thus, this is fixed#3849
This allows for the use of differing replacements for destinations other than
the library, which is useful for beets-alternatives in the case where
filesystem requirements differ between the two paths.
Signed-off-by: Christopher Larson <kergoth@gmail.com>