claude-sonnet-5 review: Phase 2 by gpt-5.3-codex

src/transcription/ui/components/media_urls.py

@@ -4,6 +4,7 @@ from __future__ import annotations
 
 from pathlib import Path
 from urllib.parse import quote
+from urllib.parse import unquote
 
 _ABSOLUTE_SCHEMES = ("http://", "https://", "data:")
 _UPLOAD_ROUTE_PREFIX = "/uploads/"
@@ -33,7 +34,8 @@ def resolve_media_url(path: str | None, *, upload_dir: Path, base_url: str) -> s
     if lowered.startswith(_ABSOLUTE_SCHEMES):
         return normalized
     if normalized.startswith(_UPLOAD_ROUTE_PREFIX):
-        return absolute_upload_url(normalized, base_url=base_url)
+        upload_relative = normalized.removeprefix(_UPLOAD_ROUTE_PREFIX)
+        return _resolve_upload_relative(upload_relative, upload_dir=upload_dir, base_url=base_url)
 
     resolved_upload_dir = upload_dir.resolve()
     path_obj = Path(candidate)
@@ -51,7 +53,8 @@ def resolve_media_url(path: str | None, *, upload_dir: Path, base_url: str) -> s
             relative = absolute_candidate.relative_to(resolved_upload_dir).as_posix()
         except ValueError:
             continue
-        return absolute_upload_url(f"/uploads/{quote(relative)}", base_url=base_url)
+        if absolute_candidate.is_file():
+            return absolute_upload_url(f"/uploads/{quote(relative)}", base_url=base_url)
 
     upload_name = resolved_upload_dir.name.casefold()
     normalized_parts = Path(normalized).parts
@@ -60,18 +63,33 @@ def resolve_media_url(path: str | None, *, upload_dir: Path, base_url: str) -> s
         index = lowered_parts.index(upload_name)
         relative = Path(*normalized_parts[index + 1 :]).as_posix()
         if relative:
-            return absolute_upload_url(f"/uploads/{quote(relative)}", base_url=base_url)
+            return _resolve_upload_relative(relative, upload_dir=upload_dir, base_url=base_url)
 
     if lowered.startswith("uploads/"):
-        return absolute_upload_url(f"/{normalized}", base_url=base_url)
+        upload_relative = normalized.split("/", 1)[1] if "/" in normalized else ""
+        return _resolve_upload_relative(upload_relative, upload_dir=upload_dir, base_url=base_url)
     if lowered.startswith("data/"):
         relative = normalized.split("/", 1)[1] if "/" in normalized else ""
-        if relative:
-            return absolute_upload_url(f"/uploads/{quote(relative)}", base_url=base_url)
+        return _resolve_upload_relative(relative, upload_dir=upload_dir, base_url=base_url)
     if lowered.startswith(("documents/", "persons/")):
-        return absolute_upload_url(f"/uploads/{quote(normalized)}", base_url=base_url)
+        return _resolve_upload_relative(normalized, upload_dir=upload_dir, base_url=base_url)
 
-    return absolute_upload_url(f"/uploads/{quote(path_obj.name)}", base_url=base_url)
+    return None
+
+
+def _resolve_upload_relative(relative: str, *, upload_dir: Path, base_url: str) -> str | None:
+    candidate = unquote(relative).strip().replace("\\", "/")
+    if not candidate:
+        return None
+    resolved_upload_dir = upload_dir.resolve()
+    try:
+        absolute_candidate = (resolved_upload_dir / Path(candidate)).resolve()
+        safe_relative = absolute_candidate.relative_to(resolved_upload_dir).as_posix()
+    except ValueError:
+        return None
+    if not absolute_candidate.is_file():
+        return None
+    return absolute_upload_url(f"/uploads/{quote(safe_relative)}", base_url=base_url)
 
 
 def public_media_path_label(path: str | None, *, upload_dir: Path) -> str:

src/transcription/ui/pages/sources_page.py

@@ -259,10 +259,12 @@ def register_page() -> None:  # noqa: PLR0915
 
 
 def _render_source_viewer_zone(source: Source, *, settings: Settings, request: Request) -> None:
-    dark_room_viewer(
-        resolve_media_url(source.file_path, upload_dir=settings.upload_dir, base_url=str(request.base_url)),
-        count_label=f"Page {source.page_number}",
+    media_url = resolve_media_url(
+        source.file_path,
+        upload_dir=settings.upload_dir,
+        base_url=str(request.base_url),
     )
+    dark_room_viewer(media_url, count_label=f"Page {source.page_number}")
 
 
 def _render_source_navigation(previous_id: UUID | None, next_id: UUID | None) -> None: