Fix critical bugs in app_urls

- init_db.py: parameterize SQL queries to prevent SQL injection
- scheduled_tasks.json: resolve duplicate periodic task pk (4 -> 15)
- db_utils.py: use function parameter in _get_status_pattern_matching
  instead of capturing the enclosing scope variable
- url_detail.html: fix wrong field name image_urls -> images_url
- settings.py: align Celery queues (default/light/heavy) with the task
  queues and supervisord workers
- Add /task/publish_<id>/ route to fix broken publish links in templates

app_urls/init_db.py

@@ -210,10 +210,9 @@ def initialize_data():
             for list_pattern_status_priority in data_json.get("REGEX_PATTERN_STATUS_PRIORITY", []):
                 # Decode
                 pattern, status, priority = list_pattern_status_priority
-                # Query
-                query = "INSERT INTO STATUS_PATTERN_MATCHING (pattern, priority, status) VALUES ('{}', {}, '{}');".format(pattern, priority, status)
-                print(query)
-                cur.execute(query)
+                # Query (parameterized to avoid SQL injection)
+                query = "INSERT INTO STATUS_PATTERN_MATCHING (pattern, priority, status) VALUES (%s, %s, %s);"
+                cur.execute(query, (pattern, priority, status))
 
     # Connect to an existing database
     with psycopg.connect(connection_info) as conn:
@@ -222,9 +221,8 @@ def initialize_data():
             # Feeds, URL host, keyword search
             for search_type, list_searches in data_json.get("SEARCH", {}).items():
                 for search in list_searches:
-                    query = "INSERT INTO SEARCH (search, type) VALUES ('{}', '{}');".format(search, search_type)
-                    print(query)
-                    cur.execute(query)
+                    insert_search_sql = "INSERT INTO SEARCH (search, type) VALUES (%s, %s);"
+                    cur.execute(insert_search_sql, (search, search_type))
 
                     # Try finding RSS feed
                     if (search_type == "url_host"):
@@ -232,9 +230,8 @@ def initialize_data():
                         list_feeds = find_feeds(url_host)
                         # If not exists, insert feed
                         for feed in list_feeds:
-                            query = "INSERT INTO SEARCH (search, type) VALUES ('{}', '{}') ON CONFLICT DO NOTHING;".format(feed, "rss_feed")
-                            print(query)
-                            cur.execute(query)
+                            insert_feed_sql = "INSERT INTO SEARCH (search, type) VALUES (%s, %s) ON CONFLICT DO NOTHING;"
+                            cur.execute(insert_feed_sql, (feed, "rss_feed"))
 
 
 if __name__ == '__main__':