v1.1.21: 6 fixes — _finish_op args, connection leak, pool init, XSS, secure cookie, let

site/routes/api_test.py

@@ -231,7 +231,7 @@ def api_test():
             # фоном ждать завершения
             user_email = get_token_info().get("email", "")
             app_version = current_app.config.get("VERSION", "")
-            threading.Thread(target=_finish_op, args=(client, op_uid, instance_uid, svc_id, display_name, op_name, svc_op_id, True, get_client_id(), get_stand(), params, user_email, app_version), daemon=True).start()
+            threading.Thread(target=_finish_op, args=(client, op_uid, instance_uid, svc_id, display_name, op_name, svc_op_id, True, get_client_id(), get_stand(), False, params, user_email, app_version), daemon=True).start()
             return jsonify({"status": "RUNNING", "opUid": op_uid, "instanceUid": instance_uid, "displayName": display_name})
 
         else:
@@ -436,6 +436,14 @@ def api_history():
         put_conn(conn)
         return jsonify(result)
     except Exception as e:
+        try:
+            cur.close()
+        except Exception:
+            pass
+        try:
+            put_conn(conn)
+        except Exception:
+            pass
         return jsonify({"error": str(e)}), 500