v1.1.21: 6 fixes — _finish_op args, connection leak, pool init, XSS, secure cookie, let

site/routes/api_test.py

@@ -231,7 +231,7 @@ def api_test():
             # фоном ждать завершения
             user_email = get_token_info().get("email", "")
             app_version = current_app.config.get("VERSION", "")
-            threading.Thread(target=_finish_op, args=(client, op_uid, instance_uid, svc_id, display_name, op_name, svc_op_id, True, get_client_id(), get_stand(), params, user_email, app_version), daemon=True).start()
+            threading.Thread(target=_finish_op, args=(client, op_uid, instance_uid, svc_id, display_name, op_name, svc_op_id, True, get_client_id(), get_stand(), False, params, user_email, app_version), daemon=True).start()
             return jsonify({"status": "RUNNING", "opUid": op_uid, "instanceUid": instance_uid, "displayName": display_name})
 
         else:
@@ -436,6 +436,14 @@ def api_history():
         put_conn(conn)
         return jsonify(result)
     except Exception as e:
+        try:
+            cur.close()
+        except Exception:
+            pass
+        try:
+            put_conn(conn)
+        except Exception:
+            pass
         return jsonify({"error": str(e)}), 500
 
 

site/routes/main.py

@@ -91,7 +91,7 @@ def index():
         user_token = request.form.get("token", "")
         active_token = user_token or env_token
         resp = make_response()
-        resp.set_cookie("token", user_token, max_age=60*60*24*365, httponly=True, samesite="Strict")  # 1 год
+        resp.set_cookie("token", user_token, max_age=60*60*24*365, httponly=True, samesite="Strict", secure=True)  # 1 год
         resp.headers["Location"] = "/"   # редирект на GET (убирает POST из истории)
         resp.status_code = 302
         return resp