ChuckandClaude Fable 5 72b443d541 fix(dev-server): allowlist plugin_id before any path lookup ...

CodeQL (py/path-injection): plugin_id arrives in request input and flows
into filesystem paths via find_plugin_dir. Gate it with the same
^[a-zA-Z0-9_-]{1,64}$ allowlist the web UI's pages_v3 uses, at the
single choke point every route resolves through.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FqzC1nzTWL4kaqgMaQZFam

2026-07-11 12:30:17 -04:00

..

debug

fix(web-ui): fix quick actions not firing, add toast feedback, suppress install handler warning (#346)

2026-05-24 09:29:53 -04:00

dev

fix: Codacy security fixes, CVE dependency bumps, and code quality cleanup (#331)

2026-05-15 10:19:55 -04:00

fix_perms

Fix: plugin/base requirements installed as web-user, invisible to root-run display service (#380)

2026-07-06 08:04:49 -04:00

install

Fix: plugin/base requirements installed as web-user, invisible to root-run display service (#380)

2026-07-06 08:04:49 -04:00

templates

feat(harness): scale-up fill check, config variants, multi-size dev gallery

2026-07-11 09:00:37 -04:00

utils

fix: Codacy security fixes, CVE dependency bumps, and code quality cleanup (#331)

2026-05-15 10:19:55 -04:00

add_defaults_to_schemas.py

fix: Codacy security fixes, CVE dependency bumps, and code quality cleanup (#331)

2026-05-15 10:19:55 -04:00

analyze_plugin_schemas.py

fix: Codacy security fixes, CVE dependency bumps, and code quality cleanup (#331)

2026-05-15 10:19:55 -04:00

check_plugin.py

feat(harness): scale-up fill check, config variants, multi-size dev gallery

2026-07-11 09:00:37 -04:00

check_system_compatibility.sh

Plugins (#145)

2025-12-27 14:15:49 -05:00

dev_server.py

fix(dev-server): allowlist plugin_id before any path lookup

2026-07-11 12:30:17 -04:00

diagnose_dependencies.sh

Plugins (#145)

2025-12-27 14:15:49 -05:00

diagnose_plugin_permissions.sh

fix: Codacy security fixes, CVE dependency bumps, and code quality cleanup (#331)

2026-05-15 10:19:55 -04:00

diagnose_web_interface.sh

fix: Codacy security fixes, CVE dependency bumps, and code quality cleanup (#331)

2026-05-15 10:19:55 -04:00

diagnose_web_ui.sh

fix: Codacy security fixes, CVE dependency bumps, and code quality cleanup (#331)

2026-05-15 10:19:55 -04:00

download_nba_logos.py

Fix NBA leaderboard team ID field for logo fetching (#116)

2025-10-10 18:27:36 -04:00

download_pixlet.sh

fix: pixlet install false-failure, force render in web service, web UI perf (#328)

2026-05-13 14:14:48 -04:00

emergency_reconnect.sh

Plugins (#145)

2025-12-27 14:15:49 -05:00

fix_internet_connectivity.sh

Plugins (#145)

2025-12-27 14:15:49 -05:00

install_dependencies_apt.py

fix(web): repair news ticker custom-feeds save for JSON path (#376)

2026-06-29 14:21:05 -04:00

install_plugin_dependencies.sh

Plugins (#145)

2025-12-27 14:15:49 -05:00

README_NBA_LOGOS.md

docs: refresh and correct stale documentation across repo (#306)

2026-04-07 21:04:25 -04:00

remove_plugin_backups.sh

Plugins (#145)

2025-12-27 14:15:49 -05:00

render_plugin.py

Add cross-size/cross-screen plugin safety harness (#361)

2026-06-05 14:32:52 -04:00

run_plugin_tests.py

fix: Codacy security fixes, CVE dependency bumps, and code quality cleanup (#331)

2026-05-15 10:19:55 -04:00

setup_plugin_repos.py

fix: post-merge monorepo hardening and cleanup (#239)

2026-02-12 11:59:23 -05:00

test_captive_portal.sh

Plugins (#145)

2025-12-27 14:15:49 -05:00

troubleshoot_captive_portal.sh

Plugins (#145)

2025-12-27 14:15:49 -05:00

update_plugin_repos.py

Feat/monorepo migration (#238)

2026-02-11 18:57:30 -05:00

verify_installation.sh

Plugins (#145)

2025-12-27 14:15:49 -05:00

verify_web_ui.sh

Plugins (#145)

2025-12-27 14:15:49 -05:00

verify_wifi_before_testing.sh

Plugins (#145)

2025-12-27 14:15:49 -05:00

verify_wifi_setup.sh

Feature/wifi setup improvements (#187)

2026-01-19 16:43:02 -05:00