"""Routes for serving sound files and thumbnails.""" import os from flask import Blueprint, send_from_directory, abort from app.services.decorators import require_auth bp = Blueprint("sounds", __name__) @bp.route("//thumbnails/") def serve_thumbnail(sound_type, filename): """Serve thumbnail files for sounds.""" try: # Map sound type codes to directory names type_mapping = { "str": "stream", "sdb": "soundboard", "say": "say" } # Security: validate sound type if sound_type not in type_mapping: abort(404) # Basic filename validation (no path traversal) if ".." in filename or "/" in filename or "\\" in filename: abort(404) if not filename or not filename.strip(): abort(404) # Get the actual directory name directory_name = type_mapping[sound_type] # Construct the thumbnail directory path sounds_dir = os.path.join(os.getcwd(), "sounds") thumbnail_dir = os.path.join(sounds_dir, directory_name, "thumbnails") # Check if thumbnail directory exists if not os.path.exists(thumbnail_dir): abort(404) # Check if file exists file_path = os.path.join(thumbnail_dir, filename) if not os.path.exists(file_path): abort(404) # Serve the file return send_from_directory(thumbnail_dir, filename) except Exception: abort(404) @bp.route("//audio/") @require_auth def serve_audio(sound_type, filename): """Serve audio files for sounds.""" try: # Map sound type codes to directory names type_mapping = { "str": "stream", "sdb": "soundboard", "say": "say" } # Security: validate sound type if sound_type not in type_mapping: abort(404) # Basic filename validation (no path traversal) if ".." in filename or "/" in filename or "\\" in filename: abort(404) if not filename or not filename.strip(): abort(404) # Get the actual directory name directory_name = type_mapping[sound_type] # Construct the audio directory path sounds_dir = os.path.join(os.getcwd(), "sounds") audio_dir = os.path.join(sounds_dir, directory_name) # Check if audio directory exists if not os.path.exists(audio_dir): abort(404) # Check if file exists file_path = os.path.join(audio_dir, filename) if not os.path.exists(file_path): abort(404) # Serve the file return send_from_directory(audio_dir, filename) except Exception: abort(404)