BUG: Share page returns HTTP 500 when the unlock cookie contains a non-ASCII character
Maintainers usually reply within 6 days
@swastiksharma45 is already working on this.
Since Nov 6, 2026.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 72/100
Research direction
Start with backend/app/share/registry.py and inspect share_registry_is_unlocked, then find the tests covering share unlock cookies. Reproduce with a cookie containing é and verify the behavior on the share, photo, and thumbnail routes. Done means a non-ASCII wrong cookie shows the password page on /s/<token> and returns 404 on photo and thumbnail pages, with a regression test.
Written by the indexing model from the issue text.
Description
Is there an existing issue for this?
- I have searched the existing issues
What happened?
If someone opens a password-protected album share with a cookie that has a non-English character (like "é"), the server returns an error (HTTP 500). It should just show the password page.
Why it happens: in backend/app/share/registry.py, the function share_registry_is_unlocked checks the cookie using hmac.compare_digest. This function throws a TypeError when the text has a non-ASCII character. The visitor sends the cookie, so anyone with the share link can cause this.
How to reproduce: open the link of a password-protected share with a cookie that has a non-English character, like pictopy_share_unlock=café. The server returns 500 instead of the password page.
What should happen: a wrong cookie should be treated like any other wrong cookie. Show the password page on /s/<token>, and return 404 on the photo and thumbnail pages.
Fix idea: compare bytes instead of text, and add a test for it.
I would like to work on this!
Record
- I agree to follow this project's Code of Conduct
- Dominant language
- Python
- Stars
- 313
- Forks
- 755
- Avg merge
- 6d 36m
- Merged PRs (30d)
- 8
Getting set up
- No Dockerfile or Docker Compose file
- No pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from AOSSIE-Org/PictoPy
-
enhancement possible-duplicate
Difficulty 1/5 1-3 hours Newbie friendliness 78/100
AOSSIE-Org/PictoPy#1715 · 2 comments ·
Maintainers usually reply within 6 days
-
BUG: /folders/all-folders takes over a second when folders contain both images and videosPossibly taken @Saurabhyadav0 claimed this 1 day ago. Openbug enhancement possible-duplicate
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
AOSSIE-Org/PictoPy#1708 · 3 comments ·
Maintainers usually reply within 6 days
-
Add unit tests for personUtils.tsPossibly taken @mystic-fae claimed this today. Openenhancement
Difficulty 1/5 1-3 hours Newbie friendliness 62/100
AOSSIE-Org/PictoPy#1707 · 3 comments ·
Maintainers usually reply within 6 days
-
bug possible-duplicate
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
AOSSIE-Org/PictoPy#1702 · 2 comments ·
Maintainers usually reply within 6 days
-
bug possible-duplicate
Difficulty 1/5 Under an hour Newbie friendliness 86/100
AOSSIE-Org/PictoPy#1700 · 3 comments ·
Maintainers usually reply within 6 days
All issues in AOSSIE-Org/PictoPy
Similar issues
-
add entry to blockOpen
Difficulty 1/5 Under an hour Newbie friendliness 65/100
StevenBlack/hosts#3299 ·
-
`garak --report` overwrites the input report when its name has no ".report"Possibly taken @0z5a claimed this today. Openneeds-triage
Difficulty 2/5 Half a day Newbie friendliness 72/100
Maintainers usually reply within 2 days
-
plot_graph crashes when a mesh node has no m2m edgePossibly taken @tygvi claimed this today. Open
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
mllam/neural-lam#883 · 1 comment ·
Maintainers usually reply within 2 days
-
Difficulty 2/5 1-3 hours Newbie friendliness 62/100
future-agi/future-agi#4092 · 1 comment ·
Maintainers usually reply within 1 day
-
transcript analytics: a text whose only protected spans the prose pass redacts is withheld wholeOpen
Difficulty 1/5 Under an hour Newbie friendliness 82/100
WingedGuardian/GENesis-AGI#4641 ·
Maintainers usually reply within 1 day