mirror of https://github.com/ChuckBuilds/LEDMatrix.git synced 2026-04-10 13:02:59 +00:00

Files

5ymb01 f718305886 fix(security): stop leaking Python tracebacks to HTTP clients (#283 )

* fix(security): stop leaking Python tracebacks to HTTP clients

Replace 13 instances where traceback.format_exc() was sent in API
JSON responses (via `details=`, `traceback:`, or `details:` keys).

- 5 error_response(details=traceback.format_exc()) → generic message
- 6 jsonify({'traceback': traceback.format_exc()}) → removed key
- 2 jsonify({'details': error_details}) → logger.error() instead

Tracebacks in debug mode (app.py error handlers) are preserved as
they are guarded by app.debug and expected during development.

Co-Authored-By: 5ymb01 <noreply@github.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fix(security): sanitize str(e) from client responses, add server-side logging

Address CodeRabbit review findings:
- Replace str(e) in error_response message fields with generic messages
- Replace import logging/traceback + manual format with logger.exception()
- Add logger.exception() to 6 jsonify handlers that were swallowing errors
- All exception details now logged server-side only, not sent to clients

Co-Authored-By: 5ymb01 <noreply@github.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fix: remove duplicate traceback logging, sanitize secrets config error

Address CodeRabbit nitpicks:
- Remove manual import logging/traceback + logging.error() that duplicated
  the logger.exception() call in save_raw_main_config
- Apply same fix to save_raw_secrets_config: replace str(e) in client
  response with generic message, use logger.exception() for server-side

Co-Authored-By: 5ymb01 <noreply@github.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

---------

Co-authored-by: 5ymb01 <5ymb01@users.noreply.github.com>
Co-authored-by: 5ymb01 <noreply@github.com>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

2026-03-20 14:51:05 -04:00

blueprints

fix(security): stop leaking Python tracebacks to HTTP clients (#283 )

2026-03-20 14:51:05 -04:00

static/v3

feat(web): add Google Calendar picker widget for dynamic multi-calendar selection (#274 )

2026-02-25 18:19:32 -05:00

templates/v3

feat(web): add Google Calendar picker widget for dynamic multi-calendar selection (#274 )

2026-02-25 18:19:32 -05:00

__init__.py

Plugins (#145 )

2025-12-27 14:15:49 -05:00

app.py

fix(web-ui): Fix file upload widget and plugin action buttons (#165 )

2025-12-30 19:04:21 -05:00

cache.py

Plugins (#145 )

2025-12-27 14:15:49 -05:00

logging_config.py

Plugins (#145 )

2025-12-27 14:15:49 -05:00

README.md

Plugins (#145 )

2025-12-27 14:15:49 -05:00

requirements.txt

Plugins (#145 )

2025-12-27 14:15:49 -05:00

run.sh

Plugins (#145 )

2025-12-27 14:15:49 -05:00

start.py

Plugins (#145 )

2025-12-27 14:15:49 -05:00

README.md

LED Matrix Web Interface V3

Modern, production web interface for controlling the LED Matrix display.

Overview

This directory contains the active V3 web interface with the following features:

Real-time display preview via Server-Sent Events (SSE)
Plugin management and configuration
System monitoring and logs
Modern, responsive UI
RESTful API

Directory Structure

web_interface/
├── app.py                    # Main Flask application
├── start.py                  # Startup script
├── run.sh                    # Shell runner script
├── requirements.txt          # Python dependencies
├── blueprints/               # Flask blueprints
│   ├── api_v3.py            # API endpoints
│   └── pages_v3.py          # Page routes
├── templates/                # HTML templates
│   └── v3/
│       ├── base.html
│       ├── index.html
│       └── partials/
└── static/                   # CSS/JS assets
    └── v3/
        ├── app.css
        └── app.js

Running the Web Interface

Standalone (Development)

From the project root:

python3 web_interface/start.py

Or using the shell script:

./web_interface/run.sh

As a Service (Production)

The web interface can run as a systemd service that starts automatically based on the web_display_autostart configuration setting:

sudo systemctl start ledmatrix-web
sudo systemctl enable ledmatrix-web  # Start on boot

Accessing the Interface

Once running, access the web interface at:

Local: http://localhost:5000
Network: http://:5000

Configuration

The web interface reads configuration from:

config/config.json - Main configuration
config/secrets.json - API keys and secrets

API Documentation

The V3 API is available at /api/v3/ with the following endpoints:

Configuration

GET /api/v3/config/main - Get main configuration
POST /api/v3/config/main - Save main configuration
GET /api/v3/config/secrets - Get secrets configuration
POST /api/v3/config/secrets - Save secrets configuration

Display Control

POST /api/v3/display/start - Start display service
POST /api/v3/display/stop - Stop display service
POST /api/v3/display/restart - Restart display service
GET /api/v3/display/status - Get display service status

Plugins

GET /api/v3/plugins - List installed plugins
GET /api/v3/plugins/<id> - Get plugin details
POST /api/v3/plugins/<id>/config - Update plugin configuration
GET /api/v3/plugins/<id>/enable - Enable plugin
GET /api/v3/plugins/<id>/disable - Disable plugin

Plugin Store

GET /api/v3/store/plugins - List available plugins
POST /api/v3/store/install/<id> - Install plugin
POST /api/v3/store/uninstall/<id> - Uninstall plugin
POST /api/v3/store/update/<id> - Update plugin

Real-time Streams (SSE)

GET /api/v3/stream/stats - System statistics stream
GET /api/v3/stream/display - Display preview stream
GET /api/v3/stream/logs - Service logs stream

Development

When making changes to the web interface:

Edit files in this directory
Test changes by running python3 web_interface/start.py
Restart the service if running: sudo systemctl restart ledmatrix-web

Notes

Templates and static files use the v3/ prefix to allow for future versions
The interface uses Flask blueprints for modular organization
SSE streams provide real-time updates without polling