From e8e2f789e5f58275f230df92e0fce7cbeb798ed0 Mon Sep 17 00:00:00 2001
From: Ozzieisaacs <ozzie.fernandez.isaacs@googlemail.com>
Date: Mon, 24 Jan 2022 12:37:15 +0100
Subject: [PATCH 1/8] Fix #2287 (books can't be added to shelf from search)

---
 cps/templates/search.html | 1 +
 1 file changed, 1 insertion(+)

diff --git a/cps/templates/search.html b/cps/templates/search.html
index 32339803..74592587 100644
--- a/cps/templates/search.html
+++ b/cps/templates/search.html
@@ -9,6 +9,7 @@
       {% if g.user.is_authenticated %}
         {% if g.user.shelf.all() or g.shelves_access %}
           <div id="shelf-actions" class="btn-toolbar" role="toolbar">
+            <input type="hidden" name="csrf_token" value="{{ csrf_token() }}">
             <div class="btn-group" role="group" aria-label="Add to shelves">
               <button id="add-to-shelf" type="button" class="btn btn-primary btn-sm dropdown-toggle" data-toggle="dropdown" aria-haspopup="true" aria-expanded="false">
                 <span class="glyphicon glyphicon-list"></span> {{_('Add to shelf')}}

From 3b216bfa07ec7992eff03e55d61732af6df9bb92 Mon Sep 17 00:00:00 2001
From: Ozzie Isaacs <ozzie.fernandez.isaacs@googlemail.com>
Date: Sat, 22 Jan 2022 18:23:08 +0100
Subject: [PATCH 2/8] Kobo sync token is now also created if accessed from
 localhost(fixes #1990) Create kobo sync token button is now "unclicked" after
 closing dialog Additional localhost route is catched If book format is
 deleted this also deletes the book synced to kobo status

---
 cps/admin.py                              | 12 ++---
 cps/editbooks.py                          |  1 +
 cps/kobo_auth.py                          | 62 ++++++++++-------------
 cps/static/js/main.js                     |  1 +
 cps/templates/generate_kobo_auth_url.html | 15 +++---
 5 files changed, 45 insertions(+), 46 deletions(-)

diff --git a/cps/admin.py b/cps/admin.py
index 706dce39..c1931ea4 100644
--- a/cps/admin.py
+++ b/cps/admin.py
@@ -1426,14 +1426,14 @@ def _delete_user(content):
             for kobo_entry in kobo_entries:
                 ub.session.delete(kobo_entry)
             ub.session_commit()
-            log.info(u"User {} deleted".format(content.name))
-            return(_(u"User '%(nick)s' deleted", nick=content.name))
+            log.info("User {} deleted".format(content.name))
+            return(_("User '%(nick)s' deleted", nick=content.name))
         else:
-            log.warning(_(u"Can't delete Guest User"))
-            raise Exception(_(u"Can't delete Guest User"))
+            log.warning(_("Can't delete Guest User"))
+            raise Exception(_("Can't delete Guest User"))
     else:
-        log.warning(u"No admin user remaining, can't delete user")
-        raise Exception(_(u"No admin user remaining, can't delete user"))
+        log.warning("No admin user remaining, can't delete user")
+        raise Exception(_("No admin user remaining, can't delete user"))
 
 
 def _handle_edit_user(to_save, content, languages, translations, kobo_support):
diff --git a/cps/editbooks.py b/cps/editbooks.py
index 18248416..8ea00469 100755
--- a/cps/editbooks.py
+++ b/cps/editbooks.py
@@ -341,6 +341,7 @@ def delete_book_from_table(book_id, book_format, jsonResponse):
                 else:
                     calibre_db.session.query(db.Data).filter(db.Data.book == book.id).\
                         filter(db.Data.format == book_format).delete()
+                    kobo_sync_status.remove_synced_book(book.id, True)
                 calibre_db.session.commit()
             except Exception as ex:
                 log.debug_or_exception(ex)
diff --git a/cps/kobo_auth.py b/cps/kobo_auth.py
index 8d46b26a..5668e6da 100644
--- a/cps/kobo_auth.py
+++ b/cps/kobo_auth.py
@@ -118,55 +118,49 @@ kobo_auth = Blueprint("kobo_auth", __name__, url_prefix="/kobo_auth")
 @kobo_auth.route("/generate_auth_token/<int:user_id>")
 @login_required
 def generate_auth_token(user_id):
+    warning = False
     host_list = request.host.rsplit(':')
     if len(host_list) == 1:
         host = ':'.join(host_list)
     else:
         host = ':'.join(host_list[0:-1])
-    if host.startswith('127.') or host.lower() == 'localhost' or host.startswith('[::ffff:7f'):
-        warning = _('PLease access calibre-web from non localhost to get valid api_endpoint for kobo device')
-        return render_title_template(
-            "generate_kobo_auth_url.html",
-            title=_(u"Kobo Setup"),
-            warning = warning
-        )
-    else:
-        # Invalidate any prevously generated Kobo Auth token for this user.
-        auth_token = ub.session.query(ub.RemoteAuthToken).filter(
-            ub.RemoteAuthToken.user_id == user_id
-        ).filter(ub.RemoteAuthToken.token_type==1).first()
+    if host.startswith('127.') or host.lower() == 'localhost' or host.startswith('[::ffff:7f') or host == "[::1]":
+        warning = _('Please access Calibre-Web from non localhost to get valid api_endpoint for kobo device')
 
-        if not auth_token:
-            auth_token = ub.RemoteAuthToken()
-            auth_token.user_id = user_id
-            auth_token.expiration = datetime.max
-            auth_token.auth_token = (hexlify(urandom(16))).decode("utf-8")
-            auth_token.token_type = 1
+    # Generate auth token if none is existing for this user
+    auth_token = ub.session.query(ub.RemoteAuthToken).filter(
+        ub.RemoteAuthToken.user_id == user_id
+    ).filter(ub.RemoteAuthToken.token_type==1).first()
 
-            ub.session.add(auth_token)
-            ub.session_commit()
+    if not auth_token:
+        auth_token = ub.RemoteAuthToken()
+        auth_token.user_id = user_id
+        auth_token.expiration = datetime.max
+        auth_token.auth_token = (hexlify(urandom(16))).decode("utf-8")
+        auth_token.token_type = 1
 
-        books = calibre_db.session.query(db.Books).join(db.Data).all()
+        ub.session.add(auth_token)
+        ub.session_commit()
 
-        for book in books:
-            formats = [data.format for data in book.data]
-            if not 'KEPUB' in formats and config.config_kepubifypath and 'EPUB' in formats:
-                helper.convert_book_format(book.id, config.config_calibre_dir, 'EPUB', 'KEPUB', current_user.name)
+    books = calibre_db.session.query(db.Books).join(db.Data).all()
 
-        return render_title_template(
-            "generate_kobo_auth_url.html",
-            title=_(u"Kobo Setup"),
-            kobo_auth_url=url_for(
-                "kobo.TopLevelEndpoint", auth_token=auth_token.auth_token, _external=True
-            ),
-            warning = False
-        )
+    for book in books:
+        formats = [data.format for data in book.data]
+        if not 'KEPUB' in formats and config.config_kepubifypath and 'EPUB' in formats:
+            helper.convert_book_format(book.id, config.config_calibre_dir, 'EPUB', 'KEPUB', current_user.name)
+
+    return render_title_template(
+        "generate_kobo_auth_url.html",
+        title=_(u"Kobo Setup"),
+        auth_token=auth_token.auth_token,
+        warning = warning
+    )
 
 
 @kobo_auth.route("/deleteauthtoken/<int:user_id>", methods=["POST"])
 @login_required
 def delete_auth_token(user_id):
-    # Invalidate any prevously generated Kobo Auth token for this user.
+    # Invalidate any previously generated Kobo Auth token for this user
     ub.session.query(ub.RemoteAuthToken).filter(ub.RemoteAuthToken.user_id == user_id)\
         .filter(ub.RemoteAuthToken.token_type==1).delete()
 
diff --git a/cps/static/js/main.js b/cps/static/js/main.js
index b10f0f98..75599d9b 100755
--- a/cps/static/js/main.js
+++ b/cps/static/js/main.js
@@ -535,6 +535,7 @@ $(function() {
 
     $("#modal_kobo_token")
         .on("show.bs.modal", function(e) {
+            $(e.relatedTarget).one('focus', function(e){$(this).blur();});
             var $modalBody = $(this).find(".modal-body");
 
             // Prevent static assets from loading multiple times
diff --git a/cps/templates/generate_kobo_auth_url.html b/cps/templates/generate_kobo_auth_url.html
index fb62424c..b8b74bda 100644
--- a/cps/templates/generate_kobo_auth_url.html
+++ b/cps/templates/generate_kobo_auth_url.html
@@ -1,12 +1,15 @@
 {% extends "fragment.html" %}
 {% block body %}
 <div class="well">
-  <p>
-    {{_('Open the .kobo/Kobo eReader.conf file in a text editor and add (or edit):')}}</a>
+<p>
+  {% if not warning %}
+      {{_('Open the .kobo/Kobo eReader.conf file in a text editor and add (or edit):')}}
+    </p><p>
+      api_endpoint={{url_for("kobo.TopLevelEndpoint", auth_token=auth_token, _external=True)}}
+  {% else %}
+      {{warning}}
+    </p><p>{{_('Kobo Token:')}} {{ auth_token }}
+  {% endif %}
   </p>
-  <p>
-    {% if not warning %}api_endpoint={{kobo_auth_url}}{% else %}{{warning}}{% endif %}</a>
-  </p>
-  <p>
 </div>
 {% endblock %}

From 35f6f4c727c887f8f3607fe3233dbc1980d15020 Mon Sep 17 00:00:00 2001
From: Ozzie Isaacs <ozzie.fernandez.isaacs@googlemail.com>
Date: Sun, 23 Jan 2022 13:11:02 +0100
Subject: [PATCH 3/8] Deleted book formats remove book from synced to kobo
 table updated teststatus

---
 cps/editbooks.py                        |   3 +-
 cps/helper.py                           |  14 +-
 cps/kobo_sync_status.py                 |  13 +-
 cps/tasks/convert.py                    |   8 +-
 cps/ub.py                               |  15 +-
 test/Calibre-Web TestSummary_Linux.html | 226 ++++++++++--------------
 6 files changed, 128 insertions(+), 151 deletions(-)

diff --git a/cps/editbooks.py b/cps/editbooks.py
index 8ea00469..f0b8fb41 100755
--- a/cps/editbooks.py
+++ b/cps/editbooks.py
@@ -341,7 +341,8 @@ def delete_book_from_table(book_id, book_format, jsonResponse):
                 else:
                     calibre_db.session.query(db.Data).filter(db.Data.book == book.id).\
                         filter(db.Data.format == book_format).delete()
-                    kobo_sync_status.remove_synced_book(book.id, True)
+                    if book_format.upper() in ['KEPUB', 'EPUB', 'EPUB3']:
+                        kobo_sync_status.remove_synced_book(book.id, True)
                 calibre_db.session.commit()
             except Exception as ex:
                 log.debug_or_exception(ex)
diff --git a/cps/helper.py b/cps/helper.py
index 5cfefe50..622af817 100644
--- a/cps/helper.py
+++ b/cps/helper.py
@@ -17,18 +17,18 @@
 #  You should have received a copy of the GNU General Public License
 #  along with this program. If not, see <http://www.gnu.org/licenses/>.
 
-import sys
 import os
 import io
 import mimetypes
 import re
 import shutil
-import time
+import socket
 import unicodedata
 from datetime import datetime, timedelta
 from tempfile import gettempdir
-
+from urllib.parse import urlparse
 import requests
+
 from babel.dates import format_datetime
 from babel.units import format_unit
 from flask import send_from_directory, make_response, redirect, abort, url_for
@@ -584,10 +584,16 @@ def get_book_cover_internal(book, use_generic_cover_on_failure):
 # saves book cover from url
 def save_cover_from_url(url, book_path):
     try:
+        # 127.0.x.x, localhost, [::1], [::ffff:7f00:1]
+        ip = socket.getaddrinfo(urlparse(url).hostname, 0)[0][4][0]
+        if ip.startswith("127.") or ip.startswith('::ffff:7f') or ip == "::1":
+            log.error("Localhost was accessed for cover upload")
+            return False, _("You are not allowed to access localhost for cover uploads")
         img = requests.get(url, timeout=(10, 200))      # ToDo: Error Handling
         img.raise_for_status()
         return save_cover(img, book_path)
-    except (requests.exceptions.HTTPError,
+    except (socket.gaierror,
+            requests.exceptions.HTTPError,
             requests.exceptions.ConnectionError,
             requests.exceptions.Timeout) as ex:
         log.info(u'Cover Download Error %s', ex)
diff --git a/cps/kobo_sync_status.py b/cps/kobo_sync_status.py
index 6df0a503..2e99394b 100644
--- a/cps/kobo_sync_status.py
+++ b/cps/kobo_sync_status.py
@@ -21,6 +21,7 @@ from flask_login import current_user
 from . import ub
 import datetime
 from sqlalchemy.sql.expression import or_, and_, true
+from sqlalchemy import exc
 
 # Add the current book id to kobo_synced_books table for current user, if entry is already present,
 # do nothing (safety precaution)
@@ -36,14 +37,18 @@ def add_synced_books(book_id):
 
 
 # Select all entries of current book in kobo_synced_books table, which are from current user and delete them
-def remove_synced_book(book_id, all=False):
+def remove_synced_book(book_id, all=False, session=None):
     if not all:
         user = ub.KoboSyncedBooks.user_id == current_user.id
     else:
         user = true()
-    ub.session.query(ub.KoboSyncedBooks).filter(ub.KoboSyncedBooks.book_id == book_id) \
-        .filter(user).delete()
-    ub.session_commit()
+    if not session:
+        ub.session.query(ub.KoboSyncedBooks).filter(ub.KoboSyncedBooks.book_id == book_id).filter(user).delete()
+        ub.session_commit()
+    else:
+        session.query(ub.KoboSyncedBooks).filter(ub.KoboSyncedBooks.book_id == book_id).filter(user).delete()
+        ub.session_commit(sess=session)
+
 
 
 def change_archived_books(book_id, state=None, message=None):
diff --git a/cps/tasks/convert.py b/cps/tasks/convert.py
index 59ad6909..596bf95c 100644
--- a/cps/tasks/convert.py
+++ b/cps/tasks/convert.py
@@ -16,7 +16,6 @@
 #  You should have received a copy of the GNU General Public License
 #  along with this program. If not, see <http://www.gnu.org/licenses/>.
 
-import sys
 import os
 import re
 
@@ -31,7 +30,8 @@ from cps import db
 from cps import logger, config
 from cps.subproc_wrapper import process_open
 from flask_babel import gettext as _
-from flask import url_for
+from cps.kobo_sync_status import remove_synced_book
+from cps.ub import ini
 
 from cps.tasks.mail import TaskEmail
 from cps import gdriveutils
@@ -147,6 +147,10 @@ class TaskConvert(CalibreTask):
                 try:
                     local_db.session.merge(new_format)
                     local_db.session.commit()
+                    if self.settings['new_book_format'].upper() in ['KEPUB', 'EPUB', 'EPUB3']:
+                        ub_session = ini()
+                        remove_synced_book(book_id, True, ub_session)
+                        ub_session.close()
                 except SQLAlchemyError as e:
                     local_db.session.rollback()
                     log.error("Database error: %s", e)
diff --git a/cps/ub.py b/cps/ub.py
index 1d5db58a..27e9ef8f 100644
--- a/cps/ub.py
+++ b/cps/ub.py
@@ -773,6 +773,14 @@ def create_admin_user(session):
     except Exception:
         session.rollback()
 
+def ini():
+    global app_DB_path
+    engine = create_engine(u'sqlite:///{0}'.format(app_DB_path), echo=False)
+
+    Session = scoped_session(sessionmaker())
+    Session.configure(bind=engine)
+    return Session()
+
 
 def init_db(app_db_path):
     # Open session for database connection
@@ -830,12 +838,13 @@ def dispose():
             except Exception:
                 pass
 
-def session_commit(success=None):
+def session_commit(success=None, sess=None):
+    s = sess if sess else session
     try:
-        session.commit()
+        s.commit()
         if success:
             log.info(success)
     except (exc.OperationalError, exc.InvalidRequestError) as e:
-        session.rollback()
+        s.rollback()
         log.debug_or_exception(e)
     return ""
diff --git a/test/Calibre-Web TestSummary_Linux.html b/test/Calibre-Web TestSummary_Linux.html
index 84bdae18..652248a2 100644
--- a/test/Calibre-Web TestSummary_Linux.html	
+++ b/test/Calibre-Web TestSummary_Linux.html	
@@ -37,20 +37,20 @@
       <div class="row">
         <div class="col-xs-6 col-md-6 col-sm-offset-3" style="margin-top:50px;">
             
-            <p class='text-justify attribute'><strong>Start Time: </strong>2022-01-18 21:11:17</p>
+            <p class='text-justify attribute'><strong>Start Time: </strong>2022-01-23 05:50:54</p>
             
         </div>
       </div>
       <div class="row">
         <div class="col-xs-6 col-md-6 col-sm-offset-3">
             
-            <p class='text-justify attribute'><strong>Stop Time: </strong>2022-01-19 01:03:52</p>
+            <p class='text-justify attribute'><strong>Stop Time: </strong>2022-01-23 10:25:22</p>
             
         </div>
       </div>
       <div class="row">
         <div class="col-xs-6 col-md-6 col-sm-offset-3">
-           <p class='text-justify attribute'><strong>Duration: </strong>3h 12 min</p>
+           <p class='text-justify attribute'><strong>Duration: </strong>3h 54 min</p>
         </div>
       </div>
       </div>
@@ -714,15 +714,15 @@
     
 
 
-    <tr id="su" class="skipClass">
+    <tr id="su" class="errorClass">
         <td>TestEditAdditionalBooks</td>
-        <td class="text-center">17</td>
+        <td class="text-center">18</td>
         <td class="text-center">15</td>
         <td class="text-center">0</td>
-        <td class="text-center">0</td>
+        <td class="text-center">1</td>
         <td class="text-center">2</td>
         <td class="text-center">
-            <a onclick="showClassDetail('c10', 17)">Detail</a>
+            <a onclick="showClassDetail('c10', 18)">Detail</a>
         </td>
     </tr>
 
@@ -809,7 +809,36 @@
     
     
     
-        <tr id='pt10.10' class='hiddenRow bg-success'>
+        <tr id="et10.10" class="none bg-info">
+            <td>
+                <div class='testcase'>TestEditAdditionalBooks - test_upload_cbz_coverformats</div>
+            </td>
+            <td colspan='6'>
+                <div class="text-center">
+                    <a class="popup_link text-center" onfocus='blur()' onclick="showTestDetail('div_et10.10')">ERROR</a>
+                </div>
+                <!--css div popup start-->
+                <div id="div_et10.10" class="popup_window test_output" style="display:block;">
+                    <div class='close_button pull-right'>
+                        <button type="button" class="close" aria-label="Close" onfocus="this.blur();"
+                                onclick="document.getElementById('div_et10.10').style.display='none'"><span
+                                aria-hidden="true">&times;</span></button>
+                    </div>
+                    <div class="text-left pull-left">
+                        <pre class="text-left">Traceback (most recent call last):
+  File &#34;/home/ozzie/Development/calibre-web-test/test/test_edit_additional_books.py&#34;, line 59, in test_upload_cbz_coverformats
+    original_cover = self.check_element_on_page((By.ID, &#34;detailcover&#34;)).screenshot_as_png
+AttributeError: &#39;bool&#39; object has no attribute &#39;screenshot_as_png&#39;</pre>
+                    </div>
+                    <div class="clearfix"></div>
+                </div>
+                <!--css div popup end-->
+            </td>
+        </tr>
+    
+    
+    
+        <tr id='pt10.11' class='hiddenRow bg-success'>
             <td>
                 <div class='testcase'>TestEditAdditionalBooks - test_upload_edit_role</div>
             </td>
@@ -818,7 +847,7 @@
     
     
     
-        <tr id='pt10.11' class='hiddenRow bg-success'>
+        <tr id='pt10.12' class='hiddenRow bg-success'>
             <td>
                 <div class='testcase'>TestEditAdditionalBooks - test_upload_metadata_cbr</div>
             </td>
@@ -827,7 +856,7 @@
     
     
     
-        <tr id='pt10.12' class='hiddenRow bg-success'>
+        <tr id='pt10.13' class='hiddenRow bg-success'>
             <td>
                 <div class='testcase'>TestEditAdditionalBooks - test_upload_metadata_cbt</div>
             </td>
@@ -836,19 +865,19 @@
     
     
     
-        <tr id="st10.13" class="none bg-warning">
+        <tr id="st10.14" class="none bg-warning">
             <td>
                 <div class='testcase'>TestEditAdditionalBooks - test_writeonly_calibre_database</div>
             </td>
             <td colspan='6'>
                 <div class="text-center">
-                    <a class="popup_link text-center" onfocus='blur()' onclick="showTestDetail('div_st10.13')">SKIP</a>
+                    <a class="popup_link text-center" onfocus='blur()' onclick="showTestDetail('div_st10.14')">SKIP</a>
                 </div>
                 <!--css div popup start-->
-                <div id="div_st10.13" class="popup_window test_output" style="display:none;">
+                <div id="div_st10.14" class="popup_window test_output" style="display:none;">
                     <div class='close_button pull-right'>
                         <button type="button" class="close" aria-label="Close" onfocus="this.blur();"
-                                onclick="document.getElementById('div_st10.13').style.display='none'"><span
+                                onclick="document.getElementById('div_st10.14').style.display='none'"><span
                                 aria-hidden="true">&times;</span></button>
                     </div>
                     <div class="text-left pull-left">
@@ -862,7 +891,7 @@
     
     
     
-        <tr id='pt10.14' class='hiddenRow bg-success'>
+        <tr id='pt10.15' class='hiddenRow bg-success'>
             <td>
                 <div class='testcase'>TestEditAdditionalBooks - test_writeonly_path</div>
             </td>
@@ -871,7 +900,7 @@
     
     
     
-        <tr id='st10.15' class='none bg-warning'>
+        <tr id='st10.16' class='none bg-warning'>
             <td>
                 <div class='testcase'>TestEditAdditionalBooks - test_xss_author_edit</div>
             </td>
@@ -880,7 +909,7 @@
     
     
     
-        <tr id='pt10.16' class='hiddenRow bg-success'>
+        <tr id='pt10.17' class='hiddenRow bg-success'>
             <td>
                 <div class='testcase'>TestEditAdditionalBooks - test_xss_comment_edit</div>
             </td>
@@ -889,7 +918,7 @@
     
     
     
-        <tr id='pt10.17' class='hiddenRow bg-success'>
+        <tr id='pt10.18' class='hiddenRow bg-success'>
             <td>
                 <div class='testcase'>TestEditAdditionalBooks - test_xss_custom_comment_edit</div>
             </td>
@@ -901,13 +930,13 @@
 
     <tr id="su" class="skipClass">
         <td>TestEditBooks</td>
+        <td class="text-center">36</td>
         <td class="text-center">35</td>
-        <td class="text-center">34</td>
         <td class="text-center">0</td>
         <td class="text-center">0</td>
         <td class="text-center">1</td>
         <td class="text-center">
-            <a onclick="showClassDetail('c11', 35)">Detail</a>
+            <a onclick="showClassDetail('c11', 36)">Detail</a>
         </td>
     </tr>
 
@@ -1237,6 +1266,15 @@
     
     
         <tr id='pt11.35' class='hiddenRow bg-success'>
+            <td>
+                <div class='testcase'>TestEditBooks - test_upload_cbz_coverformats</div>
+            </td>
+            <td colspan='6' align='center'>PASS</td>
+        </tr>
+    
+    
+    
+        <tr id='pt11.36' class='hiddenRow bg-success'>
             <td>
                 <div class='testcase'>TestEditBooks - test_upload_cover_hdd</div>
             </td>
@@ -1423,13 +1461,13 @@
     
 
 
-    <tr id="su" class="failClass">
+    <tr id="su" class="passClass">
         <td>TestLoadMetadata</td>
         <td class="text-center">1</td>
-        <td class="text-center">0</td>
         <td class="text-center">1</td>
         <td class="text-center">0</td>
         <td class="text-center">0</td>
+        <td class="text-center">0</td>
         <td class="text-center">
             <a onclick="showClassDetail('c13', 1)">Detail</a>
         </td>
@@ -1437,42 +1475,22 @@
 
     
     
-        <tr id="ft13.1" class="none bg-danger">
+        <tr id='pt13.1' class='hiddenRow bg-success'>
             <td>
                 <div class='testcase'>TestLoadMetadata - test_load_metadata</div>
             </td>
-            <td colspan='6'>
-                <div class="text-center">
-                    <a class="popup_link text-center" onfocus='blur()' onclick="showTestDetail('div_ft13.1')">FAIL</a>
-                </div>
-                <!--css div popup start-->
-                <div id="div_ft13.1" class="popup_window test_output" style="display:block;">
-                    <div class='close_button pull-right'>
-                        <button type="button" class="close" aria-label="Close" onfocus="this.blur();"
-                                onclick="document.getElementById('div_ft13.1').style.display='none'"><span
-                                aria-hidden="true">&times;</span></button>
-                    </div>
-                    <div class="text-left pull-left">
-                        <pre class="text-left">Traceback (most recent call last):
-  File &#34;/home/ozzie/Development/calibre-web-test/test/test_edit_books_metadata.py&#34;, line 136, in test_load_metadata
-    self.assertGreaterEqual(diff(BytesIO(cover), BytesIO(original_cover), delete_diff_file=True), 0.05)
-AssertionError: 0.0 not greater than or equal to 0.05</pre>
-                    </div>
-                    <div class="clearfix"></div>
-                </div>
-                <!--css div popup end-->
-            </td>
+            <td colspan='6' align='center'>PASS</td>
         </tr>
     
     
 
 
-    <tr id="su" class="errorClass">
+    <tr id="su" class="passClass">
         <td>TestEditBooksOnGdrive</td>
         <td class="text-center">20</td>
-        <td class="text-center">19</td>
+        <td class="text-center">20</td>
+        <td class="text-center">0</td>
         <td class="text-center">0</td>
-        <td class="text-center">1</td>
         <td class="text-center">0</td>
         <td class="text-center">
             <a onclick="showClassDetail('c14', 20)">Detail</a>
@@ -1616,31 +1634,11 @@ AssertionError: 0.0 not greater than or equal to 0.05</pre>
     
     
     
-        <tr id="et14.16" class="none bg-info">
+        <tr id='pt14.16' class='hiddenRow bg-success'>
             <td>
                 <div class='testcase'>TestEditBooksOnGdrive - test_edit_title</div>
             </td>
-            <td colspan='6'>
-                <div class="text-center">
-                    <a class="popup_link text-center" onfocus='blur()' onclick="showTestDetail('div_et14.16')">ERROR</a>
-                </div>
-                <!--css div popup start-->
-                <div id="div_et14.16" class="popup_window test_output" style="display:block;">
-                    <div class='close_button pull-right'>
-                        <button type="button" class="close" aria-label="Close" onfocus="this.blur();"
-                                onclick="document.getElementById('div_et14.16').style.display='none'"><span
-                                aria-hidden="true">&times;</span></button>
-                    </div>
-                    <div class="text-left pull-left">
-                        <pre class="text-left">Traceback (most recent call last):
-  File &#34;/home/ozzie/Development/calibre-web-test/test/test_edit_ebooks_gdrive.py&#34;, line 245, in test_edit_title
-    self.assertEqual(ele.text, u&#39;Very long extra super turbo cool title without any issue of displaying including ö utf-8 characters&#39;)
-AttributeError: &#39;bool&#39; object has no attribute &#39;text&#39;</pre>
-                    </div>
-                    <div class="clearfix"></div>
-                </div>
-                <!--css div popup end-->
-            </td>
+            <td colspan='6' align='center'>PASS</td>
         </tr>
     
     
@@ -2008,11 +2006,11 @@ AttributeError: &#39;bool&#39; object has no attribute &#39;text&#39;</pre>
     
 
 
-    <tr id="su" class="failClass">
+    <tr id="su" class="passClass">
         <td>TestKoboSync</td>
         <td class="text-center">11</td>
-        <td class="text-center">10</td>
-        <td class="text-center">1</td>
+        <td class="text-center">11</td>
+        <td class="text-center">0</td>
         <td class="text-center">0</td>
         <td class="text-center">0</td>
         <td class="text-center">
@@ -2094,31 +2092,11 @@ AttributeError: &#39;bool&#39; object has no attribute &#39;text&#39;</pre>
     
     
     
-        <tr id="ft23.9" class="none bg-danger">
+        <tr id='pt23.9' class='hiddenRow bg-success'>
             <td>
                 <div class='testcase'>TestKoboSync - test_sync_shelf</div>
             </td>
-            <td colspan='6'>
-                <div class="text-center">
-                    <a class="popup_link text-center" onfocus='blur()' onclick="showTestDetail('div_ft23.9')">FAIL</a>
-                </div>
-                <!--css div popup start-->
-                <div id="div_ft23.9" class="popup_window test_output" style="display:block;">
-                    <div class='close_button pull-right'>
-                        <button type="button" class="close" aria-label="Close" onfocus="this.blur();"
-                                onclick="document.getElementById('div_ft23.9').style.display='none'"><span
-                                aria-hidden="true">&times;</span></button>
-                    </div>
-                    <div class="text-left pull-left">
-                        <pre class="text-left">Traceback (most recent call last):
-  File &#34;/home/ozzie/Development/calibre-web-test/test/test_kobo_sync.py&#34;, line 350, in test_sync_shelf
-    self.assertEqual(1, len(data), data)
-AssertionError: 1 != 0 : []</pre>
-                    </div>
-                    <div class="clearfix"></div>
-                </div>
-                <!--css div popup end-->
-            </td>
+            <td colspan='6' align='center'>PASS</td>
         </tr>
     
     
@@ -3013,11 +2991,11 @@ AssertionError: 1 != 0 : []</pre>
     
 
 
-    <tr id="su" class="failClass">
+    <tr id="su" class="passClass">
         <td>TestReader</td>
         <td class="text-center">5</td>
-        <td class="text-center">4</td>
-        <td class="text-center">1</td>
+        <td class="text-center">5</td>
+        <td class="text-center">0</td>
         <td class="text-center">0</td>
         <td class="text-center">0</td>
         <td class="text-center">
@@ -3054,37 +3032,11 @@ AssertionError: 1 != 0 : []</pre>
     
     
     
-        <tr id="ft33.4" class="none bg-danger">
+        <tr id='pt33.4' class='hiddenRow bg-success'>
             <td>
                 <div class='testcase'>TestReader - test_sound_listener</div>
             </td>
-            <td colspan='6'>
-                <div class="text-center">
-                    <a class="popup_link text-center" onfocus='blur()' onclick="showTestDetail('div_ft33.4')">FAIL</a>
-                </div>
-                <!--css div popup start-->
-                <div id="div_ft33.4" class="popup_window test_output" style="display:block;">
-                    <div class='close_button pull-right'>
-                        <button type="button" class="close" aria-label="Close" onfocus="this.blur();"
-                                onclick="document.getElementById('div_ft33.4').style.display='none'"><span
-                                aria-hidden="true">&times;</span></button>
-                    </div>
-                    <div class="text-left pull-left">
-                        <pre class="text-left">Traceback (most recent call last):
-  File &#34;/home/ozzie/Development/calibre-web-test/test/test_reader.py&#34;, line 230, in test_sound_listener
-    self.sound_test(&#39;music.flac&#39;, &#39;Unknown - music&#39;, &#39;0:02&#39;)
-  File &#34;/home/ozzie/Development/calibre-web-test/test/test_reader.py&#34;, line 219, in sound_test
-    self.assertEqual(duration, duration_item.text)
-AssertionError: &#39;0:02&#39; != &#39;0:01&#39;
-- 0:02
-?    ^
-+ 0:01
-?    ^</pre>
-                    </div>
-                    <div class="clearfix"></div>
-                </div>
-                <!--css div popup end-->
-            </td>
+            <td colspan='6' align='center'>PASS</td>
         </tr>
     
     
@@ -4427,9 +4379,9 @@ AssertionError: &#39;0:02&#39; != &#39;0:01&#39;
 
     <tr id='total_row' class="text-center bg-grey">
         <td>Total</td>
-        <td>386</td>
-        <td>374</td>
-        <td>3</td>
+        <td>388</td>
+        <td>379</td>
+        <td>0</td>
         <td>1</td>
         <td>8</td>
         <td>&nbsp;</td>
@@ -4459,7 +4411,7 @@ AssertionError: &#39;0:02&#39; != &#39;0:01&#39;
           
             <tr>
               <th>Platform</th>
-              <td>Linux 5.13.0-25-generic #26~20.04.1-Ubuntu SMP Fri Jan 7 16:27:40 UTC 2022 x86_64 x86_64</td>
+              <td>Linux 5.13.0-27-generic #29~20.04.1-Ubuntu SMP Fri Jan 14 00:32:30 UTC 2022 x86_64 x86_64</td>
               <td>Basic</td>
             </tr>
           
@@ -4561,7 +4513,7 @@ AssertionError: &#39;0:02&#39; != &#39;0:01&#39;
           
             <tr>
               <th>SQLAlchemy</th>
-              <td>1.4.29</td>
+              <td>1.4.31</td>
               <td>Basic</td>
             </tr>
           
@@ -4591,7 +4543,7 @@ AssertionError: &#39;0:02&#39; != &#39;0:01&#39;
           
             <tr>
               <th>google-api-python-client</th>
-              <td>2.35.0</td>
+              <td>2.36.0</td>
               <td>TestCliGdrivedb</td>
             </tr>
           
@@ -4621,7 +4573,7 @@ AssertionError: &#39;0:02&#39; != &#39;0:01&#39;
           
             <tr>
               <th>google-api-python-client</th>
-              <td>2.35.0</td>
+              <td>2.36.0</td>
               <td>TestEbookConvertCalibreGDrive</td>
             </tr>
           
@@ -4651,7 +4603,7 @@ AssertionError: &#39;0:02&#39; != &#39;0:01&#39;
           
             <tr>
               <th>google-api-python-client</th>
-              <td>2.35.0</td>
+              <td>2.36.0</td>
               <td>TestEbookConvertGDriveKepubify</td>
             </tr>
           
@@ -4681,7 +4633,7 @@ AssertionError: &#39;0:02&#39; != &#39;0:01&#39;
           
             <tr>
               <th>comicapi</th>
-              <td>2.2.0</td>
+              <td>2.2.1</td>
               <td>TestEditAdditionalBooks</td>
             </tr>
           
@@ -4693,7 +4645,7 @@ AssertionError: &#39;0:02&#39; != &#39;0:01&#39;
           
             <tr>
               <th>google-api-python-client</th>
-              <td>2.35.0</td>
+              <td>2.36.0</td>
               <td>TestEditBooksOnGdrive</td>
             </tr>
           
@@ -4729,7 +4681,7 @@ AssertionError: &#39;0:02&#39; != &#39;0:01&#39;
           
             <tr>
               <th>google-api-python-client</th>
-              <td>2.35.0</td>
+              <td>2.36.0</td>
               <td>TestSetupGdrive</td>
             </tr>
           
@@ -4819,7 +4771,7 @@ AssertionError: &#39;0:02&#39; != &#39;0:01&#39;
 </div>
 
 <script>
-    drawCircle(374, 3, 1, 8);
+    drawCircle(379, 0, 1, 8);
     showCase(5);
 </script>
 

From d9c10b830a18629c1bb13524db67eaaff669af1b Mon Sep 17 00:00:00 2001
From: Ozzie Isaacs <ozzie.fernandez.isaacs@googlemail.com>
Date: Sun, 23 Jan 2022 13:43:35 +0100
Subject: [PATCH 4/8] Added variable to allow loading cover from localhost

---
 cps/cli.py    |  3 +++
 cps/helper.py | 13 +++++++------
 2 files changed, 10 insertions(+), 6 deletions(-)

diff --git a/cps/cli.py b/cps/cli.py
index 3685e8e2..31ea8417 100644
--- a/cps/cli.py
+++ b/cps/cli.py
@@ -45,6 +45,7 @@ parser.add_argument('-v', '--version', action='version', help='Shows version num
 parser.add_argument('-i', metavar='ip-address', help='Server IP-Address to listen')
 parser.add_argument('-s', metavar='user:pass', help='Sets specific username to new password')
 parser.add_argument('-f', action='store_true', help='Flag is depreciated and will be removed in next version')
+parser.add_argument('-l', action='store_true', help='Allow loading covers from localhost')
 args = parser.parse_args()
 
 settingspath = args.p or os.path.join(_CONFIG_DIR, "app.db")
@@ -77,6 +78,8 @@ if (args.k and not args.c) or (not args.k and args.c):
 if args.k == "":
     keyfilepath = ""
 
+# load covers from localhost
+allow_localhost = args.l or None
 # handle and check ip address argument
 ip_address = args.i or None
 if ip_address:
diff --git a/cps/helper.py b/cps/helper.py
index 622af817..2cfb119b 100644
--- a/cps/helper.py
+++ b/cps/helper.py
@@ -46,7 +46,7 @@ try:
 except ImportError:
     use_unidecode = False
 
-from . import calibre_db
+from . import calibre_db, cli
 from .tasks.convert import TaskConvert
 from . import logger, config, get_locale, db, ub
 from . import gdriveutils as gd
@@ -584,11 +584,12 @@ def get_book_cover_internal(book, use_generic_cover_on_failure):
 # saves book cover from url
 def save_cover_from_url(url, book_path):
     try:
-        # 127.0.x.x, localhost, [::1], [::ffff:7f00:1]
-        ip = socket.getaddrinfo(urlparse(url).hostname, 0)[0][4][0]
-        if ip.startswith("127.") or ip.startswith('::ffff:7f') or ip == "::1":
-            log.error("Localhost was accessed for cover upload")
-            return False, _("You are not allowed to access localhost for cover uploads")
+        if not cli.allow_localhost:
+            # 127.0.x.x, localhost, [::1], [::ffff:7f00:1]
+            ip = socket.getaddrinfo(urlparse(url).hostname, 0)[0][4][0]
+            if ip.startswith("127.") or ip.startswith('::ffff:7f') or ip == "::1":
+                log.error("Localhost was accessed for cover upload")
+                return False, _("You are not allowed to access localhost for cover uploads")
         img = requests.get(url, timeout=(10, 200))      # ToDo: Error Handling
         img.raise_for_status()
         return save_cover(img, book_path)

From 01ab75a158eff7b5bd2400226be8b87b875c5a54 Mon Sep 17 00:00:00 2001
From: Ozzie Isaacs <ozzie.fernandez.isaacs@googlemail.com>
Date: Sun, 23 Jan 2022 19:32:37 +0100
Subject: [PATCH 5/8] Updated requirements for gdrive and gmail Updated
 teststatus

---
 optional-requirements.txt               |   4 +-
 setup.cfg                               |   4 +-
 test/Calibre-Web TestSummary_Linux.html | 168 ++++++++++++------------
 3 files changed, 85 insertions(+), 91 deletions(-)

diff --git a/optional-requirements.txt b/optional-requirements.txt
index 92a01488..2ebcf1a7 100644
--- a/optional-requirements.txt
+++ b/optional-requirements.txt
@@ -1,5 +1,5 @@
 # GDrive Integration
-google-api-python-client>=1.7.11,<2.36.0
+google-api-python-client>=1.7.11,<2.37.0
 gevent>20.6.0,<22.0.0
 greenlet>=0.4.17,<1.2.0
 httplib2>=0.9.2,<0.21.0
@@ -14,7 +14,7 @@ six>=1.10.0,<1.17.0
 
 # Gmail
 google-auth-oauthlib>=0.4.3,<0.5.0
-google-api-python-client>=1.7.11,<2.36.0
+google-api-python-client>=1.7.11,<2.37.0
 
 # goodreads
 goodreads>=0.3.2,<0.4.0
diff --git a/setup.cfg b/setup.cfg
index d372be87..db2fd3e6 100644
--- a/setup.cfg
+++ b/setup.cfg
@@ -59,7 +59,7 @@ install_requires =
 
 [options.extras_require]
 gdrive = 
-	google-api-python-client>=1.7.11,<2.36.0
+	google-api-python-client>=1.7.11,<2.37.0
 	gevent>20.6.0,<22.0.0
 	greenlet>=0.4.17,<1.2.0
 	httplib2>=0.9.2,<0.21.0
@@ -73,7 +73,7 @@ gdrive =
 	six>=1.10.0,<1.17.0
 gmail = 
 	google-auth-oauthlib>=0.4.3,<0.5.0
-	google-api-python-client>=1.7.11,<2.36.0
+	google-api-python-client>=1.7.11,<2.37.0
 goodreads = 
 	goodreads>=0.3.2,<0.4.0
 	python-Levenshtein>=0.12.0,<0.13.0
diff --git a/test/Calibre-Web TestSummary_Linux.html b/test/Calibre-Web TestSummary_Linux.html
index 652248a2..8d8966ad 100644
--- a/test/Calibre-Web TestSummary_Linux.html	
+++ b/test/Calibre-Web TestSummary_Linux.html	
@@ -37,20 +37,20 @@
       <div class="row">
         <div class="col-xs-6 col-md-6 col-sm-offset-3" style="margin-top:50px;">
             
-            <p class='text-justify attribute'><strong>Start Time: </strong>2022-01-23 05:50:54</p>
+            <p class='text-justify attribute'><strong>Start Time: </strong>2022-01-24 05:56:04</p>
             
         </div>
       </div>
       <div class="row">
         <div class="col-xs-6 col-md-6 col-sm-offset-3">
             
-            <p class='text-justify attribute'><strong>Stop Time: </strong>2022-01-23 10:25:22</p>
+            <p class='text-justify attribute'><strong>Stop Time: </strong>2022-01-24 09:54:16</p>
             
         </div>
       </div>
       <div class="row">
         <div class="col-xs-6 col-md-6 col-sm-offset-3">
-           <p class='text-justify attribute'><strong>Duration: </strong>3h 54 min</p>
+           <p class='text-justify attribute'><strong>Duration: </strong>3h 17 min</p>
         </div>
       </div>
       </div>
@@ -561,11 +561,11 @@
     
 
 
-    <tr id="su" class="passClass">
+    <tr id="su" class="failClass">
         <td>TestEbookConvertCalibreGDrive</td>
         <td class="text-center">6</td>
-        <td class="text-center">6</td>
-        <td class="text-center">0</td>
+        <td class="text-center">5</td>
+        <td class="text-center">1</td>
         <td class="text-center">0</td>
         <td class="text-center">0</td>
         <td class="text-center">
@@ -593,11 +593,33 @@
     
     
     
-        <tr id='pt7.3' class='hiddenRow bg-success'>
+        <tr id="ft7.3" class="none bg-danger">
             <td>
                 <div class='testcase'>TestEbookConvertCalibreGDrive - test_convert_only</div>
             </td>
-            <td colspan='6' align='center'>PASS</td>
+            <td colspan='6'>
+                <div class="text-center">
+                    <a class="popup_link text-center" onfocus='blur()' onclick="showTestDetail('div_ft7.3')">FAIL</a>
+                </div>
+                <!--css div popup start-->
+                <div id="div_ft7.3" class="popup_window test_output" style="display:block;">
+                    <div class='close_button pull-right'>
+                        <button type="button" class="close" aria-label="Close" onfocus="this.blur();"
+                                onclick="document.getElementById('div_ft7.3').style.display='none'"><span
+                                aria-hidden="true">&times;</span></button>
+                    </div>
+                    <div class="text-left pull-left">
+                        <pre class="text-left">Traceback (most recent call last):
+  File &#34;/home/ozzie/Development/calibre-web-test/test/test_ebook_convert_gdrive.py&#34;, line 332, in test_convert_only
+    self.assertEqual(ret[-2][&#39;result&#39;], &#39;Finished&#39;)
+AssertionError: &#39;Failed&#39; != &#39;Finished&#39;
+- Failed
++ Finished</pre>
+                    </div>
+                    <div class="clearfix"></div>
+                </div>
+                <!--css div popup end-->
+            </td>
         </tr>
     
     
@@ -714,15 +736,15 @@
     
 
 
-    <tr id="su" class="errorClass">
+    <tr id="su" class="skipClass">
         <td>TestEditAdditionalBooks</td>
-        <td class="text-center">18</td>
-        <td class="text-center">15</td>
+        <td class="text-center">19</td>
+        <td class="text-center">17</td>
+        <td class="text-center">0</td>
         <td class="text-center">0</td>
-        <td class="text-center">1</td>
         <td class="text-center">2</td>
         <td class="text-center">
-            <a onclick="showClassDetail('c10', 18)">Detail</a>
+            <a onclick="showClassDetail('c10', 19)">Detail</a>
         </td>
     </tr>
 
@@ -730,7 +752,7 @@
     
         <tr id='pt10.1' class='hiddenRow bg-success'>
             <td>
-                <div class='testcase'>TestEditAdditionalBooks - test_change_upload_formats</div>
+                <div class='testcase'>TestEditAdditionalBooks - test_cbz_comicinfo</div>
             </td>
             <td colspan='6' align='center'>PASS</td>
         </tr>
@@ -739,7 +761,7 @@
     
         <tr id='pt10.2' class='hiddenRow bg-success'>
             <td>
-                <div class='testcase'>TestEditAdditionalBooks - test_delete_book</div>
+                <div class='testcase'>TestEditAdditionalBooks - test_change_upload_formats</div>
             </td>
             <td colspan='6' align='center'>PASS</td>
         </tr>
@@ -748,7 +770,7 @@
     
         <tr id='pt10.3' class='hiddenRow bg-success'>
             <td>
-                <div class='testcase'>TestEditAdditionalBooks - test_delete_role</div>
+                <div class='testcase'>TestEditAdditionalBooks - test_delete_book</div>
             </td>
             <td colspan='6' align='center'>PASS</td>
         </tr>
@@ -757,7 +779,7 @@
     
         <tr id='pt10.4' class='hiddenRow bg-success'>
             <td>
-                <div class='testcase'>TestEditAdditionalBooks - test_details_popup</div>
+                <div class='testcase'>TestEditAdditionalBooks - test_delete_role</div>
             </td>
             <td colspan='6' align='center'>PASS</td>
         </tr>
@@ -766,7 +788,7 @@
     
         <tr id='pt10.5' class='hiddenRow bg-success'>
             <td>
-                <div class='testcase'>TestEditAdditionalBooks - test_edit_book_identifier</div>
+                <div class='testcase'>TestEditAdditionalBooks - test_details_popup</div>
             </td>
             <td colspan='6' align='center'>PASS</td>
         </tr>
@@ -775,7 +797,7 @@
     
         <tr id='pt10.6' class='hiddenRow bg-success'>
             <td>
-                <div class='testcase'>TestEditAdditionalBooks - test_edit_book_identifier_capital</div>
+                <div class='testcase'>TestEditAdditionalBooks - test_edit_book_identifier</div>
             </td>
             <td colspan='6' align='center'>PASS</td>
         </tr>
@@ -784,7 +806,7 @@
     
         <tr id='pt10.7' class='hiddenRow bg-success'>
             <td>
-                <div class='testcase'>TestEditAdditionalBooks - test_edit_book_identifier_standard</div>
+                <div class='testcase'>TestEditAdditionalBooks - test_edit_book_identifier_capital</div>
             </td>
             <td colspan='6' align='center'>PASS</td>
         </tr>
@@ -793,7 +815,7 @@
     
         <tr id='pt10.8' class='hiddenRow bg-success'>
             <td>
-                <div class='testcase'>TestEditAdditionalBooks - test_edit_special_book_identifier</div>
+                <div class='testcase'>TestEditAdditionalBooks - test_edit_book_identifier_standard</div>
             </td>
             <td colspan='6' align='center'>PASS</td>
         </tr>
@@ -801,6 +823,15 @@
     
     
         <tr id='pt10.9' class='hiddenRow bg-success'>
+            <td>
+                <div class='testcase'>TestEditAdditionalBooks - test_edit_special_book_identifier</div>
+            </td>
+            <td colspan='6' align='center'>PASS</td>
+        </tr>
+    
+    
+    
+        <tr id='pt10.10' class='hiddenRow bg-success'>
             <td>
                 <div class='testcase'>TestEditAdditionalBooks - test_title_sort</div>
             </td>
@@ -809,38 +840,9 @@
     
     
     
-        <tr id="et10.10" class="none bg-info">
-            <td>
-                <div class='testcase'>TestEditAdditionalBooks - test_upload_cbz_coverformats</div>
-            </td>
-            <td colspan='6'>
-                <div class="text-center">
-                    <a class="popup_link text-center" onfocus='blur()' onclick="showTestDetail('div_et10.10')">ERROR</a>
-                </div>
-                <!--css div popup start-->
-                <div id="div_et10.10" class="popup_window test_output" style="display:block;">
-                    <div class='close_button pull-right'>
-                        <button type="button" class="close" aria-label="Close" onfocus="this.blur();"
-                                onclick="document.getElementById('div_et10.10').style.display='none'"><span
-                                aria-hidden="true">&times;</span></button>
-                    </div>
-                    <div class="text-left pull-left">
-                        <pre class="text-left">Traceback (most recent call last):
-  File &#34;/home/ozzie/Development/calibre-web-test/test/test_edit_additional_books.py&#34;, line 59, in test_upload_cbz_coverformats
-    original_cover = self.check_element_on_page((By.ID, &#34;detailcover&#34;)).screenshot_as_png
-AttributeError: &#39;bool&#39; object has no attribute &#39;screenshot_as_png&#39;</pre>
-                    </div>
-                    <div class="clearfix"></div>
-                </div>
-                <!--css div popup end-->
-            </td>
-        </tr>
-    
-    
-    
         <tr id='pt10.11' class='hiddenRow bg-success'>
             <td>
-                <div class='testcase'>TestEditAdditionalBooks - test_upload_edit_role</div>
+                <div class='testcase'>TestEditAdditionalBooks - test_upload_cbz_coverformats</div>
             </td>
             <td colspan='6' align='center'>PASS</td>
         </tr>
@@ -849,7 +851,7 @@ AttributeError: &#39;bool&#39; object has no attribute &#39;screenshot_as_png&#3
     
         <tr id='pt10.12' class='hiddenRow bg-success'>
             <td>
-                <div class='testcase'>TestEditAdditionalBooks - test_upload_metadata_cbr</div>
+                <div class='testcase'>TestEditAdditionalBooks - test_upload_edit_role</div>
             </td>
             <td colspan='6' align='center'>PASS</td>
         </tr>
@@ -857,6 +859,15 @@ AttributeError: &#39;bool&#39; object has no attribute &#39;screenshot_as_png&#3
     
     
         <tr id='pt10.13' class='hiddenRow bg-success'>
+            <td>
+                <div class='testcase'>TestEditAdditionalBooks - test_upload_metadata_cbr</div>
+            </td>
+            <td colspan='6' align='center'>PASS</td>
+        </tr>
+    
+    
+    
+        <tr id='pt10.14' class='hiddenRow bg-success'>
             <td>
                 <div class='testcase'>TestEditAdditionalBooks - test_upload_metadata_cbt</div>
             </td>
@@ -865,19 +876,19 @@ AttributeError: &#39;bool&#39; object has no attribute &#39;screenshot_as_png&#3
     
     
     
-        <tr id="st10.14" class="none bg-warning">
+        <tr id="st10.15" class="none bg-warning">
             <td>
                 <div class='testcase'>TestEditAdditionalBooks - test_writeonly_calibre_database</div>
             </td>
             <td colspan='6'>
                 <div class="text-center">
-                    <a class="popup_link text-center" onfocus='blur()' onclick="showTestDetail('div_st10.14')">SKIP</a>
+                    <a class="popup_link text-center" onfocus='blur()' onclick="showTestDetail('div_st10.15')">SKIP</a>
                 </div>
                 <!--css div popup start-->
-                <div id="div_st10.14" class="popup_window test_output" style="display:none;">
+                <div id="div_st10.15" class="popup_window test_output" style="display:none;">
                     <div class='close_button pull-right'>
                         <button type="button" class="close" aria-label="Close" onfocus="this.blur();"
-                                onclick="document.getElementById('div_st10.14').style.display='none'"><span
+                                onclick="document.getElementById('div_st10.15').style.display='none'"><span
                                 aria-hidden="true">&times;</span></button>
                     </div>
                     <div class="text-left pull-left">
@@ -891,7 +902,7 @@ AttributeError: &#39;bool&#39; object has no attribute &#39;screenshot_as_png&#3
     
     
     
-        <tr id='pt10.15' class='hiddenRow bg-success'>
+        <tr id='pt10.16' class='hiddenRow bg-success'>
             <td>
                 <div class='testcase'>TestEditAdditionalBooks - test_writeonly_path</div>
             </td>
@@ -900,7 +911,7 @@ AttributeError: &#39;bool&#39; object has no attribute &#39;screenshot_as_png&#3
     
     
     
-        <tr id='st10.16' class='none bg-warning'>
+        <tr id='st10.17' class='none bg-warning'>
             <td>
                 <div class='testcase'>TestEditAdditionalBooks - test_xss_author_edit</div>
             </td>
@@ -909,7 +920,7 @@ AttributeError: &#39;bool&#39; object has no attribute &#39;screenshot_as_png&#3
     
     
     
-        <tr id='pt10.17' class='hiddenRow bg-success'>
+        <tr id='pt10.18' class='hiddenRow bg-success'>
             <td>
                 <div class='testcase'>TestEditAdditionalBooks - test_xss_comment_edit</div>
             </td>
@@ -918,7 +929,7 @@ AttributeError: &#39;bool&#39; object has no attribute &#39;screenshot_as_png&#3
     
     
     
-        <tr id='pt10.18' class='hiddenRow bg-success'>
+        <tr id='pt10.19' class='hiddenRow bg-success'>
             <td>
                 <div class='testcase'>TestEditAdditionalBooks - test_xss_custom_comment_edit</div>
             </td>
@@ -2180,13 +2191,13 @@ AttributeError: &#39;bool&#39; object has no attribute &#39;screenshot_as_png&#3
     
 
 
-    <tr id="su" class="skipClass">
+    <tr id="su" class="passClass">
         <td>TestLdapLogin</td>
         <td class="text-center">13</td>
-        <td class="text-center">12</td>
+        <td class="text-center">13</td>
+        <td class="text-center">0</td>
         <td class="text-center">0</td>
         <td class="text-center">0</td>
-        <td class="text-center">1</td>
         <td class="text-center">
             <a onclick="showClassDetail('c25', 13)">Detail</a>
         </td>
@@ -2203,28 +2214,11 @@ AttributeError: &#39;bool&#39; object has no attribute &#39;screenshot_as_png&#3
     
     
     
-        <tr id="st25.2" class="none bg-warning">
+        <tr id='pt25.2' class='hiddenRow bg-success'>
             <td>
                 <div class='testcase'>TestLdapLogin - test_LDAP_SSL_CERTIFICATE</div>
             </td>
-            <td colspan='6'>
-                <div class="text-center">
-                    <a class="popup_link text-center" onfocus='blur()' onclick="showTestDetail('div_st25.2')">SKIP</a>
-                </div>
-                <!--css div popup start-->
-                <div id="div_st25.2" class="popup_window test_output" style="display:none;">
-                    <div class='close_button pull-right'>
-                        <button type="button" class="close" aria-label="Close" onfocus="this.blur();"
-                                onclick="document.getElementById('div_st25.2').style.display='none'"><span
-                                aria-hidden="true">&times;</span></button>
-                    </div>
-                    <div class="text-left pull-left">
-                        <pre class="text-left">Unknown how to test certificate</pre>
-                    </div>
-                    <div class="clearfix"></div>
-                </div>
-                <!--css div popup end-->
-            </td>
+            <td colspan='6' align='center'>PASS</td>
         </tr>
     
     
@@ -4379,11 +4373,11 @@ AttributeError: &#39;bool&#39; object has no attribute &#39;screenshot_as_png&#3
 
     <tr id='total_row' class="text-center bg-grey">
         <td>Total</td>
-        <td>388</td>
-        <td>379</td>
-        <td>0</td>
+        <td>389</td>
+        <td>381</td>
         <td>1</td>
-        <td>8</td>
+        <td>0</td>
+        <td>7</td>
         <td>&nbsp;</td>
     </tr>
 </table>
@@ -4771,7 +4765,7 @@ AttributeError: &#39;bool&#39; object has no attribute &#39;screenshot_as_png&#3
 </div>
 
 <script>
-    drawCircle(379, 0, 1, 8);
+    drawCircle(381, 1, 0, 7);
     showCase(5);
 </script>
 

From e0e04220109920575179a8f924543449c6de0706 Mon Sep 17 00:00:00 2001
From: Ozzie Isaacs <ozzie.fernandez.isaacs@googlemail.com>
Date: Mon, 24 Jan 2022 19:18:40 +0100
Subject: [PATCH 6/8] Upates for new release

---
 SECURITY.md      | 3 +++
 cps/constants.py | 2 +-
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/SECURITY.md b/SECURITY.md
index c6f86607..3e5a965d 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -29,6 +29,9 @@ To receive fixes for security vulnerabilities it is required to always upgrade t
 | V 0.6.15      | Cross-Site Scripting vulnerability on uploaded cover file names. Thanks to @ibarrionuevo                           ||
 | V 0.6.15      | Creating public shelfs is now denied if user is missing the edit public shelf right. Thanks to @ibarrionuevo       ||
 | V 0.6.15      | Changed error message in case of trying to delete a shelf unauthorized. Thanks to @ibarrionuevo                    ||
+| V 0.6.16      | JavaScript could get executed on authors page. Thanks to @alicaz                                                   ||
+| V 0.6.16      | Localhost can no longer be used to upload covers. Thanks to @scara31                                               ||
+| V 0.6.16      | Another case where public shelfs could be created without permission is prevented. Thanks to @ibarrionuevo         ||
 
 
 ## Staement regarding Log4j (CVE-2021-44228 and related)
diff --git a/cps/constants.py b/cps/constants.py
index 7fb973fc..281517cc 100644
--- a/cps/constants.py
+++ b/cps/constants.py
@@ -151,7 +151,7 @@ def selected_roles(dictionary):
 BookMeta = namedtuple('BookMeta', 'file_path, extension, title, author, cover, description, tags, series, '
                                   'series_id, languages, publisher')
 
-STABLE_VERSION = {'version': '0.6.16 Beta'}
+STABLE_VERSION = {'version': '0.6.16'}
 
 NIGHTLY_VERSION = {}
 NIGHTLY_VERSION[0] = '$Format:%H$'

From 6a37c7ca9dd978487f43467258b81da86d08e7e6 Mon Sep 17 00:00:00 2001
From: Ozzie Isaacs <ozzie.fernandez.isaacs@googlemail.com>
Date: Mon, 24 Jan 2022 19:27:09 +0100
Subject: [PATCH 7/8] Version bump

---
 cps/constants.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/cps/constants.py b/cps/constants.py
index 281517cc..0a964fb7 100644
--- a/cps/constants.py
+++ b/cps/constants.py
@@ -151,7 +151,7 @@ def selected_roles(dictionary):
 BookMeta = namedtuple('BookMeta', 'file_path, extension, title, author, cover, description, tags, series, '
                                   'series_id, languages, publisher')
 
-STABLE_VERSION = {'version': '0.6.16'}
+STABLE_VERSION = {'version': '0.6.17 Beta'}
 
 NIGHTLY_VERSION = {}
 NIGHTLY_VERSION[0] = '$Format:%H$'

From 17b4643b7c55fedd9b3b6e81283980befa6360e5 Mon Sep 17 00:00:00 2001
From: Ozzie Isaacs <ozzie.fernandez.isaacs@googlemail.com>
Date: Tue, 25 Jan 2022 19:30:17 +0100
Subject: [PATCH 8/8] fix #2285 (Fix for shelf handling in caliblur theme)

---
 cps/static/js/caliBlur.js | 10 +++++-----
 cps/static/js/details.js  |  8 ++++----
 cps/templates/detail.html |  8 ++++----
 3 files changed, 13 insertions(+), 13 deletions(-)

diff --git a/cps/static/js/caliBlur.js b/cps/static/js/caliBlur.js
index 3203c255..f99779bd 100644
--- a/cps/static/js/caliBlur.js
+++ b/cps/static/js/caliBlur.js
@@ -270,7 +270,7 @@ if ($("body.book").length > 0) {
 
             if (position + $("#add-to-shelves").width() > $(window).width()) {
                 positionOff = position + $("#add-to-shelves").width() - $(window).width();
-                adsPosition = position - positionOff - 5
+                adsPosition = position - positionOff - 5;
                 $("#add-to-shelves").attr("style", "left: " + adsPosition + "px !important; right: auto;  top: " + topPos + "px");
             } else {
                 $("#add-to-shelves").attr("style", "left: " + position + "px !important; right: auto;  top: " + topPos + "px");
@@ -429,7 +429,7 @@ if($("body.advsearch").length > 0) {
 
           if (position + $("#add-to-shelves").width() > $(window).width()) {
               positionOff = position + $("#add-to-shelves").width() - $(window).width();
-              adsPosition = position - positionOff - 5
+              adsPosition = position - positionOff - 5;
               $("#add-to-shelves").attr("style", "left: " + adsPosition + "px !important; right: auto;  top: " + topPos + "px");
           } else {
               $("#add-to-shelves").attr("style", "left: " + position + "px !important; right: auto;  top: " + topPos + "px");
@@ -479,12 +479,12 @@ if ($.trim($("#add-to-shelves").html()).length === 0) {
     $("#add-to-shelf").addClass("empty-ul");
 }
 
-shelfLength = $("#add-to-shelves li").length
-emptyLength = 0
+shelfLength = $("#add-to-shelves li").length;
+emptyLength = 0;
 
 $("#add-to-shelves").on("click", "li a", function () {
     console.log("#remove-from-shelves change registered");
-    emptyLength++
+    emptyLength++;
 
     setTimeout(function () {
         if (emptyLength >= shelfLength) {
diff --git a/cps/static/js/details.js b/cps/static/js/details.js
index f559234e..6f99595d 100644
--- a/cps/static/js/details.js
+++ b/cps/static/js/details.js
@@ -59,10 +59,10 @@ $("#archived_cb").on("change", function() {
         )
     };
 
-    $("#shelf-actions").on("click", "[data-shelf-action]", function (e) {
+    $("#add-to-shelves, #remove-from-shelves").on("click", "[data-shelf-action]", function (e) {
         e.preventDefault();
         $.ajax({
-                url: this.href,
+                url: $(this).data('href'),
                 method:"post",
                 data: {csrf_token:$("input[name='csrf_token']").val()},
             })
@@ -72,7 +72,7 @@ $("#archived_cb").on("change", function() {
                     case "add":
                         $("#remove-from-shelves").append(
                             templates.remove({
-                                add: this.href,
+                                add: $this.data('href'),
                                 remove: $this.data("remove-href"),
                                 content: $("<div>").text(this.textContent).html()
                             })
@@ -82,7 +82,7 @@ $("#archived_cb").on("change", function() {
                         $("#add-to-shelves").append(
                             templates.add({
                                 add: $this.data("add-href"),
-                                remove: this.href,
+                                remove: $this.data('href'),
                                 content: $("<div>").text(this.textContent).html(),
                             })
                         );
diff --git a/cps/templates/detail.html b/cps/templates/detail.html
index c8d7d527..eb32f8fe 100644
--- a/cps/templates/detail.html
+++ b/cps/templates/detail.html
@@ -260,7 +260,7 @@
             {% for shelf in g.shelves_access %}
               {% if not shelf.id in books_shelfs and ( not shelf.is_public or g.user.role_edit_shelfs() ) %}
                 <li>
-                  <a href="{{ url_for('shelf.add_to_shelf', book_id=entry.id, shelf_id=shelf.id) }}"
+                  <a data-href="{{ url_for('shelf.add_to_shelf', book_id=entry.id, shelf_id=shelf.id) }}"
                      data-remove-href="{{ url_for('shelf.remove_from_shelf', book_id=entry.id, shelf_id=shelf.id) }}"
                      data-shelf-action="add"
                   >
@@ -275,7 +275,7 @@
           {% if books_shelfs %}
             {% for shelf in g.shelves_access %}
               {% if shelf.id in books_shelfs %}
-                <a href="{{ url_for('shelf.remove_from_shelf', book_id=entry.id, shelf_id=shelf.id) }}"
+                <a data-href="{{ url_for('shelf.remove_from_shelf', book_id=entry.id, shelf_id=shelf.id) }}"
                    data-add-href="{{ url_for('shelf.add_to_shelf', book_id=entry.id, shelf_id=shelf.id) }}"
                    class="btn btn-sm btn-default" role="button" data-shelf-action="remove"
                 >
@@ -309,13 +309,13 @@
 {% block js %}
 <script type="text/template" id="template-shelf-add">
   <li>
-    <a href="<%= add %>" data-remove-href="<%= remove %>" data-shelf-action="add">
+    <a data-href="<%= add %>" data-remove-href="<%= remove %>" data-shelf-action="add">
       <%= content %>
     </a>
   </li>
 </script>
 <script type="text/template" id="template-shelf-remove">
-  <a href="<%= remove %>" data-add-href="<%= add %>" class="btn btn-sm btn-default" data-shelf-action="remove">
+  <a data-href="<%= remove %>" data-add-href="<%= add %>" class="btn btn-sm btn-default" data-shelf-action="remove">
     <span class="glyphicon glyphicon-remove"></span> <%= content %>
   </a>
 </script>