byrongamatos and Claude Opus 4.8
47085991de
fix(pack overwrite): reject revert-original on non-package targets (mirror write-path guard)
...
The POST /api/song/{fn}/revert-original handler restored a .bak over its
target after only checking that a backup existed — unlike the write path
(gap-fill/overwrite), which refuses non-sloppak targets via is_sloppak. A
non-package path under DLC_DIR with a sibling .bak (or a plain directory
carrying manifest.yaml.bak) could therefore be mutated by a feature meant
only for song packages.
Add the same is_sloppak guard after path resolution and before any restore
or DB resync, returning the 404 the art/source endpoints use for a
non-package target. Existing behaviors (404 when no backup, .bak preserved
after a successful revert, demo-block, path-traversal safety) are intact.
Regression test: a non-package file under the DLC dir with a sibling .bak is
refused (404) and left byte-for-byte unchanged.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com >
2026-07-03 08:13:33 +02:00
..
2026-06-29 12:26:29 +02:00
2026-06-16 18:49:40 +01:00
2026-07-02 20:50:56 +02:00
2026-07-02 09:35:18 +02:00
2026-06-16 18:47:13 +02:00
2026-06-23 11:03:01 +02:00
2026-07-02 15:57:26 +02:00
2026-07-02 20:55:43 +02:00
2026-07-02 13:32:51 +02:00
2026-07-02 20:51:33 +02:00
2026-06-23 11:03:01 +02:00
2026-06-23 11:03:01 +02:00
2026-06-23 11:03:01 +02:00
2026-06-16 18:47:13 +02:00
2026-07-02 13:29:05 +02:00
2026-06-23 11:03:01 +02:00
2026-06-29 10:42:41 +02:00
2026-07-02 18:36:00 +02:00
2026-06-23 11:03:01 +02:00
2026-07-02 13:38:06 +02:00
2026-07-02 20:55:43 +02:00
2026-06-23 11:03:01 +02:00
2026-06-23 11:03:01 +02:00
2026-06-23 11:03:01 +02:00
2026-06-16 19:36:53 +01:00
2026-07-02 13:39:10 +02:00
2026-06-23 11:03:01 +02:00
2026-06-23 11:03:01 +02:00
2026-07-02 20:53:36 -05:00
2026-06-23 11:03:01 +02:00
2026-07-02 08:40:20 +02:00
2026-06-16 18:47:13 +02:00
2026-06-26 18:58:35 +02:00
2026-06-23 11:03:01 +02:00
2026-06-16 18:47:13 +02:00
2026-07-02 20:51:33 +02:00
2026-06-16 18:47:13 +02:00
2026-06-28 22:08:44 +02:00
2026-07-01 08:58:50 +02:00
2026-06-23 11:03:01 +02:00
2026-06-29 08:49:01 +02:00
2026-07-02 20:51:33 +02:00
2026-06-29 08:49:01 +02:00
2026-06-16 18:47:13 +02:00
2026-06-23 11:03:01 +02:00
2026-06-23 11:03:01 +02:00
2026-06-16 19:36:53 +01:00
2026-06-16 19:36:53 +01:00
2026-07-02 20:52:11 +02:00
2026-07-02 13:47:55 +02:00
2026-06-16 18:47:13 +02:00
2026-06-16 18:47:13 +02:00
2026-06-23 11:03:01 +02:00
2026-06-16 18:47:13 +02:00
2026-07-02 08:40:20 +02:00
2026-06-16 18:47:13 +02:00
2026-07-03 08:13:33 +02:00
2026-06-23 11:03:01 +02:00
2026-06-28 14:10:15 +02:00
2026-06-23 11:03:01 +02:00
2026-06-23 11:03:01 +02:00
2026-06-25 00:02:16 +02:00
2026-07-02 13:31:19 +02:00
2026-06-23 11:03:01 +02:00
2026-06-16 18:47:13 +02:00
2026-06-23 11:03:01 +02:00
2026-06-16 19:36:53 +01:00
2026-06-16 18:47:13 +02:00
2026-07-02 20:57:42 +02:00
2026-06-24 17:00:30 +02:00
2026-06-29 09:34:47 +02:00
2026-06-23 11:03:01 +02:00
2026-06-23 11:03:01 +02:00
2026-06-16 18:47:13 +02:00
2026-06-23 11:03:01 +02:00
2026-06-16 18:47:13 +02:00
2026-06-20 21:59:04 +02:00
2026-06-23 11:03:01 +02:00
2026-06-20 14:10:04 -07:00
2026-06-20 21:23:48 +02:00
2026-06-16 18:47:13 +02:00
2026-06-23 18:05:45 +02:00
2026-06-20 21:35:07 +02:00
2026-06-16 18:47:13 +02:00
2026-06-23 11:03:01 +02:00
2026-07-02 13:25:18 +02:00
2026-06-23 11:03:01 +02:00
2026-07-02 20:51:57 +02:00
2026-06-23 11:03:01 +02:00
2026-06-23 11:03:01 +02:00
2026-06-16 18:47:13 +02:00
2026-06-16 18:47:13 +02:00
2026-06-23 11:03:01 +02:00
2026-06-16 18:47:13 +02:00
2026-06-29 09:36:02 +02:00
2026-07-02 13:37:15 +02:00
2026-07-02 20:51:33 +02:00
2026-06-16 18:47:13 +02:00