Function view_file

Scripts/ButSystem.py:11962–12001

View a vault file. For safety, we allow inline rendering only for non-active content types (images/video/audio/pdf/text). HTML/SVG/XML are forced to download to prevent stored XSS on the app origin.

()

        _mark_fail(ip, u)
        flash("Invalid credentials.")
        return redirect(url_for("two_factor"))

        # Session capacity (per link/session scope): max 66 users + 1 admin.
    try:
        sc = current_scope()
        is_admin = user_is_admin(u)
        if not scope_capacity_ok(u, is_admin, sc):
            flash("This session is full (max 66 users + 1 admin). Try again later.")
            session.pop("pre_2fa", None)
            session.pop("two_factor_idxs", None)
            return redirect(url_for("login"))
    except Exception:
        pass

# Success: finalize login
    session.pop("pre_2fa", None)
    session.pop("two_factor_idxs", None)
    _clear_fail(ip, u)
    flash("Logged in.")
    return _complete_login_session(u, user_is_admin(u))



@app.route("/settings/appearance", methods=["GET"])
@login_required
def settings_appearance_page():
    u = current_user()
    prefs = dict(DEFAULT_PREFS)
    try:
        if u:
            prefs = get_user_prefs(u) or prefs
    except Exception:
        pass
    return render_template(
        "settings_appearance.html",
        title="Settings",
        prefs=prefs,
        accent_choices=ACCENT_CHOICES,
        font_choices=FONT_CHOICES,
        ui_theme_choices=UI_THEME_CHOICES,
    )

@app.route("/settings/appearance", methods=["POST"])