fix: resolve critical issues and improve task management

- Fix path traversal vulnerability in downloadVideo handler by adding
  download directory whitelist validation
- Add graceful shutdown with signal handling for task persistence
- Fix division by zero panic in progressBar.percent() when total <= 0
- Add GetDB() function that returns error instead of using log.Fatal
- Change deleteTask to only remove database records, preserve downloaded files
- Add paused status for interrupted tasks on shutdown

Co-Authored-By: Claude
This commit is contained in:
2026-04-09 16:51:22 +08:00
parent 449b5fe3a2
commit a0ef988bd5
5 changed files with 125 additions and 47 deletions
+2 -26
View File
@@ -1,11 +1,9 @@
package router
import (
"database/sql"
"encoding/json"
"fmt"
"net/http"
"os"
"os/exec"
"runtime"
"strconv"
@@ -177,30 +175,8 @@ func deleteTask(w http.ResponseWriter, r *http.Request) {
}{}
for _, taskID := range taskIDs {
_task, err := task.GetTask(db, taskID)
if err == sql.ErrNoRows {
// 数据库中没有该条记录,忽略
successCount++
continue
}
if err != nil {
failedTasks = append(failedTasks, struct {
ID int
Error string
}{ID: taskID, Error: fmt.Sprintf("获取任务失败: %v", err)})
continue
}
filePath := _task.FilePath()
err = os.Remove(filePath)
if err != nil && !os.IsNotExist(err) {
failedTasks = append(failedTasks, struct {
ID int
Error string
}{ID: taskID, Error: fmt.Sprintf("文件删除失败: %v", err)})
continue
}
err = task.DeleteTask(db, taskID)
// 只删除数据库记录,不删除已下载的视频文件
err := task.DeleteTask(db, taskID)
if err != nil {
failedTasks = append(failedTasks, struct {
ID int