Fix issues #898, #542, #561, #504

Co-authored-by: alexta69 <7450369+alexta69@users.noreply.github.com>

app/main.py

@@ -57,8 +57,8 @@ class Config:
         'PUBLIC_HOST_AUDIO_URL': 'audio_download/',
         'OUTPUT_TEMPLATE': '%(title)s.%(ext)s',
         'OUTPUT_TEMPLATE_CHAPTER': '%(title)s - %(section_number)02d - %(section_title)s.%(ext)s',
-        'OUTPUT_TEMPLATE_PLAYLIST': '%(playlist_title)s/%(title)s.%(ext)s',
-        'OUTPUT_TEMPLATE_CHANNEL': '%(channel)s/%(title)s.%(ext)s',
+        'OUTPUT_TEMPLATE_PLAYLIST': '',
+        'OUTPUT_TEMPLATE_CHANNEL': '',
         'DEFAULT_OPTION_PLAYLIST_ITEM_LIMIT' : '0',
         'CLEAR_COMPLETED_AFTER': '0',
         'YTDL_OPTIONS': '{}',
@@ -115,6 +115,25 @@ class Config:
     def _apply_runtime_overrides(self):
         self.YTDL_OPTIONS.update(self._runtime_overrides)
 
+    # Keys sent to the browser. Sensitive or server-only keys (YTDL_OPTIONS,
+    # paths, TLS config, etc.) are intentionally excluded.
+    _FRONTEND_KEYS = (
+        'CUSTOM_DIRS',
+        'CREATE_CUSTOM_DIRS',
+        'OUTPUT_TEMPLATE_CHAPTER',
+        'PUBLIC_HOST_URL',
+        'PUBLIC_HOST_AUDIO_URL',
+        'DEFAULT_OPTION_PLAYLIST_ITEM_LIMIT',
+    )
+
+    def frontend_safe(self) -> dict:
+        """Return only the config keys that are safe to expose to browser clients.
+
+        Sensitive or server-only keys (YTDL_OPTIONS, file-system paths, TLS
+        settings, etc.) are intentionally excluded.
+        """
+        return {k: getattr(self, k) for k in self._FRONTEND_KEYS}
+
     def load_ytdl_options(self) -> tuple[bool, str]:
         try:
             self.YTDL_OPTIONS = json.loads(os.environ.get('YTDL_OPTIONS', '{}'))
@@ -420,7 +439,7 @@ async def history(request):
 async def connect(sid, environ):
     log.info(f"Client connected: {sid}")
     await sio.emit('all', serializer.encode(dqueue.get()), to=sid)
-    await sio.emit('configuration', serializer.encode(config), to=sid)
+    await sio.emit('configuration', serializer.encode(config.frontend_safe()), to=sid)
     if config.CUSTOM_DIRS:
         await sio.emit('custom_dirs', serializer.encode(get_custom_dirs()), to=sid)
     if config.YTDL_OPTIONS_FILE:
@@ -448,8 +467,12 @@ def get_custom_dirs():
             else:
                 return re.search(config.CUSTOM_DIRS_EXCLUDE_REGEX, d) is None
 
-        # Recursively lists all subdirectories of DOWNLOAD_DIR
+        # Recursively lists all subdirectories of DOWNLOAD_DIR.
+        # Always include '' (the base directory itself) even when the
+        # directory is empty or does not yet exist.
         dirs = list(filter(include_dir, map(convert, path.glob('**/'))))
+        if '' not in dirs:
+            dirs.insert(0, '')
 
         return dirs
 

app/ytdl.py

@@ -29,6 +29,26 @@ def _compile_outtmpl_pattern(field: str) -> re.Pattern:
     return re.compile(STR_FORMAT_RE_TMPL.format(re.escape(field), conversion_types))
 
 
+# Characters that are invalid in Windows/NTFS path components. These are pre-
+# sanitised when substituting playlist/channel titles into output templates so
+# that downloads do not fail on NTFS-mounted volumes or Windows Docker hosts.
+_WINDOWS_INVALID_PATH_CHARS = re.compile(r'[\\:*?"<>|]')
+
+
+def _sanitize_path_component(value: Any) -> Any:
+    """Replace characters that are invalid in Windows path components with '_'.
+
+    Non-string values (int, float, None, …) are passed through unchanged so
+    that ``_outtmpl_substitute_field`` can still coerce them with format specs
+    (e.g. ``%(playlist_index)02d``).  Only string values are sanitised because
+    Windows-invalid characters are only a concern for human-readable strings
+    (titles, channel names, etc.) that may end up as directory names.
+    """
+    if not isinstance(value, str):
+        return value
+    return _WINDOWS_INVALID_PATH_CHARS.sub('_', value)
+
+
 def _outtmpl_substitute_field(template: str, field: str, value: Any) -> str:
     """Substitute a single field in an output template, applying any format specifiers to the value."""
     pattern = _compile_outtmpl_pattern(field)
@@ -631,13 +651,13 @@ class DownloadQueue:
                 output = self.config.OUTPUT_TEMPLATE_PLAYLIST
             for property, value in entry.items():
                 if property.startswith("playlist"):
-                    output = _outtmpl_substitute_field(output, property, value)
+                    output = _outtmpl_substitute_field(output, property, _sanitize_path_component(value))
         if entry is not None and entry.get('channel_index') is not None:
             if len(self.config.OUTPUT_TEMPLATE_CHANNEL):
                 output = self.config.OUTPUT_TEMPLATE_CHANNEL
             for property, value in entry.items():
                 if property.startswith("channel"):
-                    output = _outtmpl_substitute_field(output, property, value)
+                    output = _outtmpl_substitute_field(output, property, _sanitize_path_component(value))
         ytdl_options = dict(self.config.YTDL_OPTIONS)
         playlist_item_limit = getattr(dl, 'playlist_item_limit', 0)
         if playlist_item_limit > 0: