Security hardening, multi-site portability, and a documentation and API-surface sweep

plugins/slides/api/routes.py

@@ -9,12 +9,13 @@ have it by default).
 import os
 import re
 
-from flask import Blueprint, request, current_app, jsonify, send_from_directory
+from flask import Blueprint, request, current_app, jsonify
 from flask_jwt_extended import jwt_required
 from werkzeug.utils import secure_filename
 
 from shopdb.api import (db, success_response, error_response, ErrorCodes,
                         require_permission)
+from shopdb.api import send_upload
 
 from ..models import TvSlide
 
@@ -81,7 +82,7 @@ def serve_image(surface, filename):
     directory = _surface_dir(surface)
     if not os.path.isfile(os.path.join(directory, safe)):
         return error_response(ErrorCodes.NOT_FOUND, 'Slide not found', http_code=404)
-    return send_from_directory(directory, safe)
+    return send_upload(directory, safe)
 
 
 # =============================================================================