Function dm_file_stream

Scripts/ButSystem.py:12932–12979

Inline media stream for DM attachments. We only allow inline rendering for safe media types; active content (HTML/SVG/XML) is forced to download to prevent stored XSS.

(fid: int)

                with open(path, "r", encoding="utf-8", errors="replace") as f:
                    selected_content = f.read()[-200000:]
            except Exception as e:
                selected_content = f"Could not read log: {e}"
    return render_template("admin_logs.html", title="Admin logs", files=files, selected_name=selected_name, selected_content=selected_content)




@app.route("/admin/device_approve", methods=["POST"])
@login_required
def admin_device_approve():
    require_admin()
    try:
        log_security_event("admin_action", detail="approve_device_request", username=current_user(), level="info")
    except Exception:
        pass
    rid = (request.form.get("req_id") or "").strip()
    if not rid.isdigit():
        return redirect(url_for("admin_panel"))
    conn = db_connect()
    row = conn.execute("SELECT id, username, device_fp, status FROM device_access_requests WHERE id=?", (int(rid),)).fetchone()
    if not row:
        conn.close()
        flash("Request not found.")
        return redirect(url_for("admin_panel"))
    if row["status"] != "pending":
        conn.close()
        flash("Request already handled.")
        return redirect(url_for("admin_panel"))
    conn.execute(
        "UPDATE device_access_requests SET status='approved', approved_by=?, approved_at=? WHERE id=?",
        (current_user(), now_z(), int(rid))
    )
    conn.commit()
    conn.close()
    flash(f"Approved device request for @{row['username']}.")
    return redirect(url_for("admin_panel"))

@app.route("/admin/device_deny", methods=["POST"])
@login_required
def admin_device_deny():
    require_admin()
    try:
        log_security_event("admin_action", detail="deny_device_request", username=current_user(), level="info")
    except Exception:
        pass
    rid = (request.form.get("req_id") or "").strip()
    if not rid.isdigit():
        return redirect(url_for("admin_panel"))
    conn = db_connect()
    row = conn.execute("SELECT id, username, status FROM device_access_requests WHERE id=?", (int(rid),)).fetchone()
    if not row: