Security hardening, multi-site portability, and a documentation and API-surface sweep

shopdb/core/api/applications.py

@@ -3,7 +3,7 @@
 import glob
 import os
 
-from flask import Blueprint, request, current_app, send_from_directory
+from flask import Blueprint, request, current_app
 from flask_jwt_extended import jwt_required
 from werkzeug.utils import secure_filename
 
@@ -112,6 +112,7 @@ def _require_computer_models():
 
 
 from shopdb.utils.authz import require_permission
+from shopdb.utils.uploads import send_upload
 
 applications_bp = Blueprint('applications', __name__)
 
@@ -550,7 +551,7 @@ def upload_application_image(app_id: int):
 @applications_bp.route('/image/<path:filename>', methods=['GET'])
 def serve_application_image(filename):
     """Serve an uploaded application image (public - lists and tiles read it)."""
-    return send_from_directory(_appimage_dir(), filename)
+    return send_upload(_appimage_dir(), filename)
 
 
 @applications_bp.route('/<int:app_id>/image', methods=['DELETE'])
@@ -635,7 +636,7 @@ def serve_application_package(filename):
     open URL would publish it to anything that can reach the site. Always sent
     as an attachment so a browser saves it rather than trying to render it.
     """
-    return send_from_directory(_apppackage_dir(), filename, as_attachment=True)
+    return send_upload(_apppackage_dir(), filename, as_attachment=True)
 
 
 @applications_bp.route('/<int:app_id>/package', methods=['DELETE'])