Refactor: minor improvements to the WebUI

FAQ.md

@@ -60,6 +60,7 @@ or the `environment:` section in `compose.yaml` file.
 | YTP_THUMB_CONCURRENCY           | The number of concurrent ffmpeg thumbnail generations allowed.      | `2`                   |
 | YTP_THUMB_GENERATE              | Enable ffmpeg thumbnail generation when no local thumbnail exists.  | `true`                |
 | YTP_THUMB_SIDECAR               | Save generated thumbnails next to media instead of temp cache.      | `false`               |
+| YTP_DISABLE_EXEC                | Strip some dangerous yt-dlp options.                                | `false`               |
 
 > [!NOTE]
 > To raise the maximum workers for specific extractor, you need to add a ENV variable that follows the pattern `YTP_MAX_WORKERS_FOR_<EXTRACTOR_NAME>`.
@@ -143,6 +144,11 @@ a tool that by design can execute commands. Auth is the mechanism that controls
 YTPTube already gates other powerful features behind explicit opt-in: the built-in terminal, file browser actions and internal
 URL requests for example. The `cli` field is no different, its power is by design, and access control is your responsibility.
 
+> [!NOTE]
+> If you choose to run without authentication but still want to reduce at least some impact, you can set
+> `YTP_DISABLE_EXEC=true`. This strips some dangerous options at run time. However, understand that this is not a 
+> substitute for auth an unauthenticated API is still fully open for all other operations.
+
 # I cant download anything
 
 If you are receiving errors like:

README.md

@@ -109,17 +109,14 @@ For simple API documentation, you can refer to the [API documentation](API.md).
 
 This project is not affiliated with yt-dlp or any other service.
 
-It’s a personal project designed to make downloading videos from the internet more convenient. It’s not intended for 
-piracy or any unlawful use.
+This is a personal project designed to make downloading videos from the internet more convenient for me. It is not 
+intended for piracy or any unlawful use. This project was built primarily for my own use and preferences.
 
-AI-based tools may have been used to assist with parts of this project. Regardless of how a change is produced, every 
-change is reviewed and approved by the human maintainer before it is included.
+AI-assisted tools are used in this project. If you are uncomfortable with this, you should not use this project.
 
-This project was built primarily for my own needs and preferences. The UI might not be the most polished or visually 
-refined, but I’m happy with it as it is. You can, however, create and load your own UI for complete customization.
-
-Contributions are welcome, but I may decline changes that don’t align with my vision for the project. Unsolicited pull 
-requests may be ignored. For suggestions or feature requests, please open a discussion or join the Discord server.
+Contributions are welcome, but I may decline changes that do not interest me or do not align with my vision for this 
+project. Unsolicited pull requests will be closed. For suggestions or feature requests, please open a discussion or 
+join the Discord server.
 
 # Social contact
 

app/conftest.py

@@ -16,7 +16,10 @@ def pytest_configure(config) -> None:
     if getattr(config.option, "basetemp", None) is None:
         config.option.basetemp = str(get_test_run_root() / "pytest")
 
+    os.environ["YTP_FILE_LOGGING"] = "false"
+
 
 def pytest_unconfigure(config) -> None:
     del config
+    os.environ.pop("YTP_FILE_LOGGING", None)
     cleanup_test_run_root()

app/features/ytdlp/ytdlp_opts.py

@@ -397,6 +397,30 @@ def get_all(self, keep: bool = False) -> dict:
 
         data: dict = merge_dict(user_cli, merge_dict(self._item_opts, merge_dict(self._preset_opts, default_opts)))
 
+        if self._config.disable_exec:
+            stripped: list[str] = []
+            if data.pop("netrc_cmd", None):
+                stripped.append("netrc_cmd")
+
+            if "postprocessors" in data:
+                exec_pps = [
+                    pp for pp in data["postprocessors"] if isinstance(pp, dict) and pp.get("key", "").startswith("Exec")
+                ]
+                if exec_pps:
+                    stripped.extend(pp.get("key") for pp in exec_pps)
+                    data["postprocessors"] = [
+                        pp
+                        for pp in data["postprocessors"]
+                        if not (isinstance(pp, dict) and pp.get("key", "").startswith("Exec"))
+                    ]
+
+            if stripped:
+                LOG.warning(
+                    "Stripped %d dangerous options from yt-dlp options.",
+                    len(stripped),
+                    extra={"stripped": stripped, "reason": "YTP_DISABLE_EXEC is enabled"},
+                )
+
         if not keep:
             self.reset()
 

app/library/config.py

@@ -110,6 +110,9 @@ class Config(metaclass=Singleton):
     auth_password: str | None = None
     """The password to use for basic authentication."""
 
+    disable_exec: bool = False
+    """Strip some dangerous yt-dlp options."""
+
     remove_files: bool = False
     """Remove downloaded files when removing the record."""
 
@@ -312,6 +315,7 @@ class Config(metaclass=Singleton):
         "check_for_updates",
         "thumb_generate",
         "thumb_sidecar",
+        "disable_exec",
     )
     "The variables that are booleans."
 

ui/app/assets/css/tailwind.css

@@ -151,3 +151,19 @@
   --ui-container: 96rem;
   --ui-header-height: 4.25rem;
 }
+
+html:not(.no-page-anim) .page-enter-active {
+  transition:
+    opacity 0.25s ease,
+    transform 0.25s ease;
+}
+html:not(.no-page-anim) .page-leave-active {
+  transition: opacity 0.1s ease;
+}
+html:not(.no-page-anim) .page-enter-from {
+  opacity: 0;
+  transform: translateY(-4px);
+}
+html:not(.no-page-anim) .page-leave-to {
+  opacity: 0;
+}