Fixes six critical bugs found during a code review of the app_urls service.
SQL injection (init_db.py)
Replaced string-formatted SQL INSERT statements with parameterized queries in insert_status_pattern_matching and search insertion, preventing SQL injection from arbitrary values in init_data.json.
"Notify status" and "Process MissingKids URLs - batch=50" both declared pk: 4. Reassigned "Notify status" to a unique pk: 15 so loaddata no longer overwrites/collides on load.
Undefined variable in closure (db_utils.py)
_get_status_pattern_matching accepted a url parameter but used obj_url.url captured from the enclosing scope. Now uses its own parameter, making the function self-contained and correct regardless of the caller scope.
Wrong model field in template (url_detail.html)
Replaced url_content.image_urls with the actual field name url_content.images_url so image URLs render correctly.
Celery queue mismatch (settings.py)
CELERY_TASK_QUEUES declared queues (default, low) but tasks route to light/heavy and supervisord runs workers on default/light/heavy. Updated settings to (default, light, heavy) so tasks are delivered to the running consumers.
Broken publish route
Templates link to /task/publish_<id> but no such route existed, returning 404. Added a publish view and URL route that invokes Publisher().publish(id).
Verification
python -m py_compile passes for all modified Python files
scheduled_tasks.json validates as JSON with no duplicate periodic-task primary keys
## Summary
Fixes six critical bugs found during a code review of the `app_urls` service.
### SQL injection (init_db.py)
Replaced string-formatted SQL INSERT statements with parameterized queries in `insert_status_pattern_matching` and search insertion, preventing SQL injection from arbitrary values in `init_data.json`.
### Duplicate periodic task primary key (scheduled_tasks.json)
"Notify status" and "Process MissingKids URLs - batch=50" both declared `pk: 4`. Reassigned "Notify status" to a unique `pk: 15` so `loaddata` no longer overwrites/collides on load.
### Undefined variable in closure (db_utils.py)
`_get_status_pattern_matching` accepted a `url` parameter but used `obj_url.url` captured from the enclosing scope. Now uses its own parameter, making the function self-contained and correct regardless of the caller scope.
### Wrong model field in template (url_detail.html)
Replaced `url_content.image_urls` with the actual field name `url_content.images_url` so image URLs render correctly.
### Celery queue mismatch (settings.py)
`CELERY_TASK_QUEUES` declared queues `(default, low)` but tasks route to `light`/`heavy` and supervisord runs workers on `default`/`light`/`heavy`. Updated settings to `(default, light, heavy)` so tasks are delivered to the running consumers.
### Broken publish route
Templates link to `/task/publish_<id>` but no such route existed, returning 404. Added a `publish` view and URL route that invokes `Publisher().publish(id)`.
## Verification
- `python -m py_compile` passes for all modified Python files
- `scheduled_tasks.json` validates as JSON with no duplicate periodic-task primary keys
The Gitea CI runner has no outbound access to github.com.
Mirror the repository on the local Gitea instance so pip install
succeeds in CI.
Co-Authored-By: opencode <noreply@opencode.ai>
Wrap gnews, GoogleNews, and search_engines imports in try/except
so the module loads without those packages installed. This allows
the test suite to run on the Gitea runner without outbound GitHub
access.
Also revert requirements.txt back to the GitHub URL for the
Search-Engines-Scraper dependency.
Co-Authored-By: opencode <noreply@opencode.ai>
The Gitea runner can't clone github.com repos via pip.
Since the tests don't need Search-Engines-Scraper, exclude
git+ lines from requirements during CI install.
Co-Authored-By: opencode <noreply@opencode.ai>
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Summary
Fixes six critical bugs found during a code review of the
app_urlsservice.SQL injection (init_db.py)
Replaced string-formatted SQL INSERT statements with parameterized queries in
insert_status_pattern_matchingand search insertion, preventing SQL injection from arbitrary values ininit_data.json.Duplicate periodic task primary key (scheduled_tasks.json)
"Notify status" and "Process MissingKids URLs - batch=50" both declared
pk: 4. Reassigned "Notify status" to a uniquepk: 15soloaddatano longer overwrites/collides on load.Undefined variable in closure (db_utils.py)
_get_status_pattern_matchingaccepted aurlparameter but usedobj_url.urlcaptured from the enclosing scope. Now uses its own parameter, making the function self-contained and correct regardless of the caller scope.Wrong model field in template (url_detail.html)
Replaced
url_content.image_urlswith the actual field nameurl_content.images_urlso image URLs render correctly.Celery queue mismatch (settings.py)
CELERY_TASK_QUEUESdeclared queues(default, low)but tasks route tolight/heavyand supervisord runs workers ondefault/light/heavy. Updated settings to(default, light, heavy)so tasks are delivered to the running consumers.Broken publish route
Templates link to
/task/publish_<id>but no such route existed, returning 404. Added apublishview and URL route that invokesPublisher().publish(id).Verification
python -m py_compilepasses for all modified Python filesscheduled_tasks.jsonvalidates as JSON with no duplicate periodic-task primary keys- Add fetcher/tests/ with 21 tests covering all bug fixes: - test_utils: get_with_protocol URL normalization (5 tests) - test_config: scheduled_tasks.json PK uniqueness, Celery queue settings (7 tests) - test_publish: URL routing and view for /task/publish_<id>/ (4 tests) - test_template_field: url_detail.html renders images_url field (2 tests) - test_search_postprocess: URL host filtering and param stripping (3 tests) - Replace empty fetcher/tests.py with tests/ package - Add .gitea/workflows/test.yml: runs on PRs and pushes to main, installs dependencies and runs `manage.py test fetcher.tests`View command line instructions
Checkout
From your project repository, check out a new branch and test the changes.