Output message only in production mode

Fixes from testrun
Merge remote-tracking branch 'fix/commentxss' into Develop
2026-05-24 10:19:49 +02:00 · 2026-05-17 10:21:19 +02:00 · 2026-05-09 10:30:59 +02:00 · 2026-05-09 10:28:12 +02:00 · 2026-05-09 10:24:58 +02:00 · 2026-05-09 10:20:45 +02:00
1077 changed files with 274466 additions and 176768 deletions
@@ -1,4 +1,5 @@
 constants.py ident export-subst
 /test export-ignore
+/library export-ignore
 cps/static/css/libs/* linguist-vendored
 cps/static/js/libs/* linguist-vendored
@@ -0,0 +1 @@
+custom: ["https://PayPal.Me/calibreweb",]
@@ -6,12 +6,23 @@ labels: ''
 assignees: ''

 ---
-<!-- Please have a look at our [Contributing Guidelines](https://github.com/janeczku/calibre-web/blob/master/CONTRIBUTING.md) -->

-**Describe the bug/problem**
+## Short Notice from the maintainer 
+
+After 6 years of more or less intensive programming on Calibre-Web, I need a break. 
+The last few months, maintaining Calibre-Web has felt more like work than a hobby. I felt pressured and teased by people to solve "their" problems and merge PRs for "their" Calibre-Web. 
+I have turned off all notifications from GitHub/Discord and will now concentrate undisturbed on the development of “my” Calibre-Web over the next few weeks/months.  
+I will look into the issues and maybe also the PRs from time to time, but don't expect a quick response from me.
+
+
+Please also have a look at our [Contributing Guidelines](https://github.com/janeczku/calibre-web/blob/master/CONTRIBUTING.md)
+
+**Describe the bug/problem** 
+
 A clear and concise description of what the bug is. If you are asking for support, please check our [Wiki](https://github.com/janeczku/calibre-web/wiki) if your question is already answered there.

 **To Reproduce**
+
 Steps to reproduce the behavior:
 1. Go to '...'
 2. Click on '....'
@@ -19,21 +30,26 @@ Steps to reproduce the behavior:
 4. See error

 **Logfile**
+
 Add content of calibre-web.log file or the relevant error, try to reproduce your problem with "debug" log-level to get more output.

 **Expected behavior**
+
 A clear and concise description of what you expected to happen.

 **Screenshots**
+
 If applicable, add screenshots to help explain your problem.

 **Environment (please complete the following information):**
+
 - OS: [e.g. Windows 10/Raspberry Pi OS]
 - Python version: [e.g. python2.7]
 - Calibre-Web version: [e.g. 0.6.8 or 087c4c59 (git rev-parse --short HEAD)]:
- - Docker container: [None/Technosoft2000/LinuxServer]:
+ - Docker container: [None/LinuxServer]:
 - Special Hardware: [e.g. Rasperry Pi Zero]
 - Browser: [e.g. Chrome 83.0.4103.97, Safari 13.3.7, Firefox 68.0.1 ESR]

 **Additional context**
 Add any other context about the problem here. [e.g. access via reverse proxy, database background sync, special database location]
+
@@ -0,0 +1 @@
+blank_issues_enabled: false
@@ -7,7 +7,14 @@ assignees: ''

 ---

-<!-- Please have a look at our [Contributing Guidelines](https://github.com/janeczku/calibre-web/blob/master/CONTRIBUTING.md) -->
+# Short Notice from the maintainer 
+
+After 6 years of more or less intensive programming on Calibre-Web, I need a break. 
+The last few months, maintaining Calibre-Web has felt more like work than a hobby. I felt pressured and teased by people to solve "their" problems and merge PRs for "their" Calibre-Web. 
+I have turned off all notifications from GitHub/Discord and will now concentrate undisturbed on the development of “my” Calibre-Web over the next few weeks/months.  
+I will look into the issues and maybe also the PRs from time to time, but don't expect a quick response from me.
+
+Please have a look at our [Contributing Guidelines](https://github.com/janeczku/calibre-web/blob/master/CONTRIBUTING.md)

 **Is your feature request related to a problem? Please describe.**
 A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
@@ -6,10 +6,12 @@ __pycache__/

 # Distribution / packaging
 .Python
+.python-version
 env/
 venv/
 eggs/
 dist/
+executable/
 build/
 vendor/
 .eggs/
@@ -21,12 +23,15 @@ vendor/
 # calibre-web
 *.db
 *.log
+cps/cache

 .idea/
 *.bak
 *.log.*
+.key

 settings.yaml
 gdrive_credentials
 client_secrets.json
-
+gmail.json
+/.key
@@ -20,20 +20,20 @@ Some of the user languages in Calibre-Web having missing translations. We are ha

 ### **Documentation**

-The Calibre-Web documentation is hosted in the Github [Wiki](https://github.com/janeczku/calibre-web/wiki). The Wiki is open to everybody, if you find a problem, feel free to correct it. If information is missing, you are welcome to add it. The content will be reviewed time by time. Please try to be consistent with the form with the other Wiki pages (e.g. the project name is Calibre-Web with 2 capital letters and a dash in between).
+The Calibre-Web documentation is hosted in the GitHub [Wiki](https://github.com/janeczku/calibre-web/wiki). The Wiki is open to everybody, if you find a problem, feel free to correct it. If information is missing, you are welcome to add it. The content will be reviewed time by time. Please try to be consistent with the form with the other Wiki pages (e.g. the project name is Calibre-Web with 2 capital letters and a dash in between).

 ### **Reporting a bug**

 Do not open up a GitHub issue if the bug is a **security vulnerability** in Calibre-Web. Instead, please write an email to "ozzie.fernandez.isaacs@googlemail.com".

-Ensure the ***bug was not already reported** by searching on GitHub under [Issues](https://github.com/janeczku/calibre-web/issues). Please also check if a solution for your problem can be found in the [wiki](https://github.com/janeczku/calibre-web/wiki).
+Ensure the **bug was not already reported** by searching on GitHub under [Issues](https://github.com/janeczku/calibre-web/issues). Please also check if a solution for your problem can be found in the [wiki](https://github.com/janeczku/calibre-web/wiki).

-If you're unable to find an **open issue** addressing the problem, open a [new one](https://github.com/janeczku/calibre-web/issues/new?assignees=&labels=&template=bug_report.md&title=). Be sure to include a **title** and **clear description**, as much relevant information as possible, the **issue form** helps you providing the right information. Deleting the form and just pasting the stack trace doesn't speed up fixing the problem. If your issue could be resolved, consider closing the issue.
+If you're unable to find an **open issue** addressing the problem, open a [new one](https://github.com/janeczku/calibre-web/issues/new/choose). Be sure to include a **title** and **clear description**, as much relevant information as possible, the **issue form** helps you provide the right information. Deleting the form and just pasting the stack trace doesn't speed up fixing the problem. If your issue could be resolved, consider closing the issue.

 ### **Feature Request**

 If there is a feature missing in Calibre-Web and you can't find a feature request in the [Issues](https://github.com/janeczku/calibre-web/issues) section, you could create a [feature request](https://github.com/janeczku/calibre-web/issues/new?assignees=&labels=&template=feature_request.md&title=).
-We will not extend Calibre-Web with any more login abilities or add further files storages, or file syncing ability. Furthermore Calibre-Web is made for home usage for company in-house usage, so requests regarding any sorts of social interaction capability, payment routines, search engine or web site analytics integration will not be implemented.
+We will not extend Calibre-Web with any more login abilities or add further files storages, or file syncing ability. Calibre-Web is made for home usage for company in-house usage, so requests regarding any sorts of social interaction capability, payment routines, search engine or website analytics integration will not be implemented.

 ### **Contributing code to Calibre-Web**

@@ -41,6 +41,6 @@ Open a new GitHub pull request with the patch. Ensure the PR description clearly

 In case your code enhances features of Calibre-Web: Create your pull request for the development branch if your enhancement consists of more than some lines of code in a local section of Calibre-Webs code. This makes it easier to test it and check all implication before it's made public.

-Please check if your code runs on Python 2.7 (still necessary in 2020) and mainly on python 3. If possible and the feature is related to operating system functions, try to check it on Windows and Linux.
-Calibre-Web is automatically tested on Linux in combination with python 3.7. The code for testing is in a [separate repo](https://github.com/OzzieIsaacs/calibre-web-test) on Github. It uses unit tests and performs real system tests with selenium; it would be great if you could consider also writing some tests.
+Please check if your code runs with python 3, python 2 is no longer supported. If possible and the feature is related to operating system functions, try to check it on Windows and Linux.
+Calibre-Web is automatically tested on Linux in combination with python 3.8. The code for testing is in a [separate repo](https://github.com/OzzieIsaacs/calibre-web-test) on GitHub. It uses unit tests and performs real system tests with selenium; it would be great if you could consider also writing some tests.
 A static code analysis is done by Codacy, but it's partly broken and doesn't run automatically. You could check your code with ESLint before contributing, a configuration file can be found in the projects root folder.
@@ -1 +1,3 @@
 graft src/calibreweb
+global-exclude __pycache__
+global-exclude *.pyc
@@ -1,6 +1,30 @@
-# About
+# Calibre-Web

-Calibre-Web is a web app providing a clean interface for browsing, reading and downloading eBooks using an existing [Calibre](https://calibre-ebook.com) database.
+Calibre-Web is a web app that offers a clean and intuitive interface for browsing, reading, and downloading eBooks using a valid [Calibre](https://calibre-ebook.com) database.
+
+[![License](https://img.shields.io/github/license/janeczku/calibre-web?style=flat-square)](https://github.com/janeczku/calibre-web/blob/master/LICENSE)
+![Commit Activity](https://img.shields.io/github/commit-activity/w/janeczku/calibre-web?logo=github&style=flat-square&label=commits)
+[![All Releases](https://img.shields.io/github/downloads/janeczku/calibre-web/total?logo=github&style=flat-square)](https://github.com/janeczku/calibre-web/releases)
+[![PyPI](https://img.shields.io/pypi/v/calibreweb?logo=pypi&logoColor=fff&style=flat-square)](https://pypi.org/project/calibreweb/)
+[![PyPI - Downloads](https://img.shields.io/pypi/dm/calibreweb?logo=pypi&logoColor=fff&style=flat-square)](https://pypi.org/project/calibreweb/)
+[![Discord](https://img.shields.io/discord/838810113564344381?label=Discord&logo=discord&style=flat-square)](https://discord.gg/h2VsJ2NEfB)
+
+<details>
+<summary><strong>Table of Contents</strong> (click to expand)</summary>
+
+1. [About](#calibre-web)
+2. [Features](#features)
+3. [Installation](#installation)
+   - [Installation via pip (recommended)](#installation-via-pip-recommended)
+   - [Quick start](#quick-start)
+   - [Requirements](#requirements)
+4. [Docker Images](#docker-images)
+5. [Troubleshooting](#troubleshooting)
+6. [Contributor Recognition](#contributor-recognition)
+7. [Contact](#contact)
+8. [Contributing to Calibre-Web](#contributing-to-calibre-web)
+
+</details>

 *This software is a fork of [library](https://github.com/mutschler/calibreserver) and licensed under the GPL v3 License.*

@@ -8,82 +32,156 @@ Calibre-Web is a web app providing a clean interface for browsing, reading and d

 ## Features

- Bootstrap 3 HTML5 interface
- full graphical setup
- User management with fine-grained per-user permissions
+- Modern and responsive Bootstrap 3 HTML5 interface
+- Full graphical setup
+- Comprehensive user management with fine-grained per-user permissions
 - Admin interface
- User Interface in czech, dutch, english, finnish, french, german, greek, hungarian, italian, japanese, khmer, polish, russian, simplified chinese, spanish, swedish, turkish, ukrainian
- OPDS feed for eBook reader apps 
- Filter and search by titles, authors, tags, series and language
- Create a custom book collection (shelves)
- Support for editing eBook metadata and deleting eBooks from Calibre library
- Support for converting eBooks through Calibre binaries
- Restrict eBook download to logged-in users
- Support for public user registration
- Send eBooks to Kindle devices with the click of a button
- Sync your Kobo devices through Calibre-Web with your Calibre library
- Support for reading eBooks directly in the browser (.txt, .epub, .pdf, .cbr, .cbt, .cbz)
- Upload new books in many formats, including audio formats (.mp3, .m4a, .m4b)
- Support for Calibre Custom Columns
- Ability to hide content based on categories and Custom Column content per user
+- Multilingual user interface supporting 20+ languages ([supported languages](https://github.com/janeczku/calibre-web/wiki/Translation-Status))
+- OPDS feed for eBook reader apps
+- Advanced search and filtering options
+- Custom book collection (shelves) creation
+- eBook metadata editing and deletion support
+- Metadata download from various sources (extensible via plugins)
+- eBook conversion through Calibre binaries
+- eBook download restriction to logged-in users
+- Public user registration support
+- Send eBooks to E-Readers with a single click
+- Sync Kobo devices with your Calibre library
+- In-browser eBook reading support for multiple formats
+- Upload new books in various formats, including audio formats
+- Calibre Custom Columns support
+- Content hiding based on categories and Custom Column content per user
 - Self-update capability
- "Magic Link" login to make it easy to log on eReaders
- Login via LDAP, google/github oauth and via proxy authentication
+- "Magic Link" login for easy access on eReaders
+- LDAP, Google/GitHub OAuth, and proxy authentication support

-## Quick start
+## Installation

-1. Install dependencies by running `pip3 install --target vendor -r requirements.txt` (python3.x). Alternativly set up a python virtual environment.
-2. Execute the command: `python3 cps.py` (or `nohup python3 cps.py` - recommended if you want to exit the terminal window)
-3. Point your browser to `http://localhost:8083` or `http://localhost:8083/opds` for the OPDS catalog
-4. Set `Location of Calibre database` to the path of the folder where your Calibre library (metadata.db) lives, push "submit" button\
-   Optionally a Google Drive can be used to host the calibre library [-> Using Google Drive integration](https://github.com/janeczku/calibre-web/wiki/Configuration#using-google-drive-integration)
-5. Go to Login page
+### Installation via pip (recommended)

-**Default admin login:**\
-*Username:* admin\
-*Password:* admin123
+1. **Create a virtual environment**: It’s essential to isolate your Calibre-Web installation to avoid dependency conflicts. You can create a virtual environment by running:
+   ```
+   python3 -m venv calibre-web-env
+   ```
+2. **Activate the virtual environment**:
+   ```
+   source calibre-web-env/bin/activate
+   ```
+3. **Install Calibre-Web**: Use pip to install the application:
+   ```
+   pip install calibreweb
+   ```
+4. **Install optional features**: For additional functionality, you may need to install optional features. Refer to [this page](https://github.com/janeczku/calibre-web/wiki/Dependencies-in-Calibre-Web-Linux-and-Windows) for details on what can be installed.
+5. **Start Calibre-Web**: After installation, you can start the application with:
+   ```
+   cps
+   ```

-**Issues with Ubuntu:**
-Please note that running the above install command can fail on some versions of Ubuntu, saying `"can't combine user with prefix"`. This is a [known bug](https://github.com/pypa/pip/issues/3826) and can be remedied by using the command `pip install --system --target vendor -r requirements.txt` instead.
+*Note: Users of Raspberry Pi OS may encounter installation issues. If you do, try upgrading pip and/or installing cargo as follows:*
+   ```
+   ./venv/bin/python3 -m pip install --upgrade pip
+   sudo apt install cargo
+   ```
+
+### Important Links
+- For additional installation examples, check the following:
+   - [Manual installation](https://github.com/janeczku/calibre-web/wiki/Manual-installation)
+   - [Linux Mint installation](https://github.com/janeczku/calibre-web/wiki/How-To:-Install-Calibre-Web-in-Linux-Mint-19-or-20)
+   - [Cloud Provider setup](https://github.com/janeczku/calibre-web/wiki/How-To:-Install-Calibre-Web-on-a-Cloud-Provider)
+
+## Quick Start
+
+1. **Access Calibre-Web**: Open your browser and navigate to:
+   ```
+   http://localhost:8083
+   ```
+   or for the OPDS catalog:
+   ```
+   http://localhost:8083/opds
+   ```
+2. **Log in**: Use the default admin credentials:
+   - **Username:** admin
+   - **Password:** admin123
+3. **Database Setup**: If you do not have a Calibre database, download a sample from:
+   ```
+   https://github.com/janeczku/calibre-web/raw/master/library/metadata.db
+   ```
+   Move it out of the Calibre-Web folder to avoid overwriting during updates.
+4. **Configure Calibre Database**: In the admin interface, set the `Location of Calibre database` to the path of the folder containing your Calibre library (where `metadata.db` is located) and click "Save".
+5. **Google Drive Integration**: For hosting your Calibre library on Google Drive, refer to the [Google Drive integration guide](https://github.com/janeczku/calibre-web/wiki/G-Drive-Setup#using-google-drive-integration).
+6. **Admin Configuration**: Configure your instance via the admin page, referring to the [Basic Configuration](https://github.com/janeczku/calibre-web/wiki/Configuration#basic-configuration) and [UI Configuration](https://github.com/janeczku/calibre-web/wiki/Configuration#ui-configuration) guides.

 ## Requirements

-python 3.x+
-
-Optionally, to enable on-the-fly conversion from one ebook format to another when using the send-to-kindle feature, or during editing of ebooks metadata:
-
-[Download and install](https://calibre-ebook.com/download) the Calibre desktop program for your platform and enter the folder including program name (normally /opt/calibre/ebook-convert, or C:\Program Files\calibre\ebook-convert.exe) in the field "calibre's converter tool" on the setup page.
-
-[Download](https://github.com/pgaskin/kepubify/releases/latest) Kepubify tool for your platform and place the binary starting with `kepubify` in Linux: `\opt\kepubify` Windows: `C:\Program Files\kepubify`.
+- **Python Version**: Ensure you have Python 3.7 or newer.
+- **Imagemagick**: Required for cover extraction from EPUBs. Windows users may also need to install [Ghostscript](https://ghostscript.com/releases/gsdnld.html) for PDF cover extraction.
+- **Optional Tools**:
+   - **Calibre desktop program**: Recommended for on-the-fly conversion and metadata editing. Set the path to Calibre’s converter tool on the setup page.
+   - **Kepubify tool**: Needed for Kobo device support. Download the tool and place the binary in `/opt/kepubify` on Linux or `C:\Program Files\kepubify` on Windows.

 ## Docker Images

-Pre-built Docker images are available in these Docker Hub repositories:
+Pre-built Docker images are available:

-#### **Technosoft2000 - x64**
-+ Docker Hub - [https://hub.docker.com/r/technosoft2000/calibre-web](https://hub.docker.com/r/technosoft2000/calibre-web)
-+ Github - [https://github.com/Technosoft2000/docker-calibre-web](https://github.com/Technosoft2000/docker-calibre-web) 
+### **LinuxServer - x64, aarch64**
+- **Docker Hub**: [linuxserver/calibre-web](https://hub.docker.com/r/linuxserver/calibre-web)
+- **GitHub**: [linuxserver/docker-calibre-web](https://github.com/linuxserver/docker-calibre-web)
+- **Optional Calibre layer**: [linuxserver/docker-mods](https://github.com/linuxserver/docker-mods/tree/universal-calibre)

-    Includes the Calibre `ebook-convert` binary.
-    + The "path to convertertool" should be set to `/opt/calibre/ebook-convert`
+To include the Calibre `ebook-convert` binary (x64 only), add the environment variable:
+``` 
+DOCKER_MODS=linuxserver/mods:universal-calibre
+```
+in your Docker run/compose file. Omit this variable for a lightweight image.

-#### **LinuxServer - x64, armhf, aarch64**
-+ Docker Hub - [https://hub.docker.com/r/linuxserver/calibre-web](https://hub.docker.com/r/linuxserver/calibre-web)
-+ Github - [https://github.com/linuxserver/docker-calibre-web](https://github.com/linuxserver/docker-calibre-web)
-+ Github - (Optional Calibre layer) - [https://github.com/linuxserver/docker-calibre-web/tree/calibre](https://github.com/linuxserver/docker-calibre-web/tree/calibre) 
+- **Paths Configuration**:
+   - Set **Path to Calibre Binaries** to `/usr/bin`.
+   - Set **Path to Unrar** to `/usr/bin/unrar`.

-   This image has the option to pull in an extra docker manifest layer to include the Calibre `ebook-convert` binary.  Just include the environmental variable `DOCKER_MODS=linuxserver/calibre-web:calibre` in your docker run/docker compose file. **(x64 only)**
-  
-   If you do not need this functionality then this can be omitted, keeping the image as lightweight as possible.
-    
-   Both the Calibre-Web and Calibre-Mod images are rebuilt automatically on new releases of Calibre-Web and Calibre respectively, and on updates to any included base image packages on a weekly basis if required.
-   + The "path to convertertool" should be set to `/usr/bin/ebook-convert`
-   + The "path to unrar" should be set to `/usr/bin/unrar`
+## Troubleshooting

-# Wiki
+- **Common Issues**: 
+   - If you experience issues starting the application, check the log files located in the `logs` directory for error messages.
+   - If eBooks fail to load, verify that the `Location of Calibre database` is correctly set and that the database file is accessible.
+   - You need to enable uploads under `Basic settings` for this option to appear

-For further information, How To's and FAQ please check the [Wiki](https://github.com/janeczku/calibre-web/wiki)
+- **Configuration Errors**: Ensure that your Calibre database is compatible and properly formatted. Refer to the Calibre documentation for guidance on maintaining the database.

-# Contributing to Calibre-Web
+- **Performance Problems**: 
+   - If the application is slow, consider increasing the allocated resources (CPU/RAM) to your server or optimizing the Calibre database by removing duplicates and unnecessary entries.
+   - Regularly clear the cache in your web browser to improve loading times.

-Please have a look at our [Contributing Guidelines](https://github.com/janeczku/calibre-web/blob/master/CONTRIBUTING.md) 
+- **User Management Issues**: If users are unable to log in or register, check the user permission settings in the admin interface. Ensure that registration is enabled and that users are being assigned appropriate roles.
+
+- **Support Resources**: For additional help, consider visiting the [FAQ section](https://github.com/janeczku/calibre-web/wiki/FAQ) of the wiki or posting your questions in the [Discord community](https://discord.gg/h2VsJ2NEfB).
+
+## Contributor Recognition
+
+We would like to thank all the [contributors](https://github.com/janeczku/calibre-web/graphs/contributors) and maintainers of Calibre-Web for their valuable input and dedication to the project. Your contributions are greatly appreciated.
+
+## Contact
+
+Join us on [Discord](https://discord.gg/h2VsJ2NEfB)
+
+For more information, How To's, and FAQs, please visit the [Wiki](https://github.com/janeczku/calibre-web/wiki)
+
+## Contributing to Calibre-Web
+
+To contribute, please check our [Contributing Guidelines](https://github.com/janeczku/calibre-web/blob/master/CONTRIBUTING.md). We welcome issues, feature requests, and pull requests from the community.
+
+### Reporting Bugs
+
+If you encounter bugs or issues, please report them in the [issues section](https://github.com/janeczku/calibre-web/issues) of the repository. Be sure to include detailed information about your setup and the problem encountered.
+
+### Feature Requests
+
+We welcome suggestions for new features. Please create a new issue in the repository to discuss your ideas.
+
+## Additional Resources
+
+- **Documentation**: Comprehensive documentation is available on the [Calibre-Web wiki](https://github.com/janeczku/calibre-web/wiki).
+- **Community Contributions**: Explore the [community contributions](https://github.com/janeczku/calibre-web/pulls) to see ongoing work and how you can get involved.
+
+---
+
+Thank you for using Calibre-Web! We hope you enjoy managing your eBook library with our tool.
@@ -0,0 +1,57 @@
+# Security Policy
+
+## Reporting a Vulnerability
+
+Please report security issues to ozzie.fernandez.isaacs@googlemail.com
+
+## Supported Versions
+
+To receive fixes for security vulnerabilities it is required to always upgrade to the latest version of Calibre-Web. See https://github.com/janeczku/calibre-web/releases/latest for the latest release.
+
+## History
+
+| Fixed in      | Description                                                                                                                      | CVE number     |
+|---------------|----------------------------------------------------------------------------------------------------------------------------------|----------------|
+| 3rd July 2018 | Guest access acts as a backdoor                                                                                                  |                |
+| V 0.6.7       | Hardcoded secret key for sessions                                                                                                | CVE-2020-12627 |
+| V 0.6.13      | Calibre-Web Metadata cross site scripting                                                                                        | CVE-2021-25964 |
+| V 0.6.13      | Name of Shelves are only visible to users who can access the corresponding shelf Thanks to @ibarrionuevo                         |                |
+| V 0.6.13      | JavaScript could get executed in the description field. Thanks to @ranjit-git  and Hagai Wechsler (WhiteSource)                  |                |
+| V 0.6.13      | JavaScript could get executed in a custom column of type "comment" field                                                         |                |
+| V 0.6.13      | JavaScript could get executed after converting a book to another format with a title containing javascript code                  |                |
+| V 0.6.13      | JavaScript could get executed after converting a book to another format with a username containing javascript code               |                |
+| V 0.6.13      | JavaScript could get executed in the description series, categories or publishers title                                          |                |
+| V 0.6.13      | JavaScript could get executed  in the shelf title                                                                                |                |
+| V 0.6.13      | Login with the old session cookie after logout. Thanks to @ibarrionuevo                                                          |                |
+| V 0.6.14      | CSRF was possible. Thanks to @mik317 and Hagai Wechsler (WhiteSource)                                                            | CVE-2021-25965 |
+| V 0.6.14      | Migrated some routes to POST-requests (CSRF protection). Thanks to @scara31                                                      | CVE-2021-4164  |
+| V 0.6.15      | Fix for "javascript:" script links in identifier. Thanks to @scara31                                                             | CVE-2021-4170  |
+| V 0.6.15      | Cross-Site Scripting vulnerability on uploaded cover file names. Thanks to @ibarrionuevo                                         |                |
+| V 0.6.15      | Creating public shelfs is now denied if user is missing the edit public shelf right. Thanks to @ibarrionuevo                     |                |
+| V 0.6.15      | Changed error message in case of trying to delete a shelf unauthorized. Thanks to @ibarrionuevo                                  |                |
+| V 0.6.16      | JavaScript could get executed on authors page. Thanks to @alicaz                                                                 | CVE-2022-0352  |
+| V 0.6.16      | Localhost can no longer be used to upload covers. Thanks to @scara31                                                             | CVE-2022-0339  |
+| V 0.6.16      | Another case where public shelfs could be created without permission is prevented. Thanks to @nhiephon                           | CVE-2022-0273  |
+| V 0.6.16      | It's prevented to get the name of a private shelfs. Thanks to @nhiephon                                                          | CVE-2022-0405  |
+| V 0.6.17      | The SSRF Protection can no longer be bypassed via an HTTP redirect. Thanks to @416e6e61                                          | CVE-2022-0767  |
+| V 0.6.17      | The SSRF Protection can no longer be bypassed via 0.0.0.0 and it's ipv6 equivalent. Thanks to @r0hanSH                           | CVE-2022-0766  |
+| V 0.6.18      | Possible SQL Injection is prevented in user table  Thanks to Iman Sharafaldin (Forward Security)                                 | CVE-2022-30765 |
+| V 0.6.18      | The SSRF protection no longer can be bypassed by IPV6/IPV4 embedding. Thanks to  @416e6e61                                       | CVE-2022-0939  |
+| V 0.6.18      | The SSRF protection no longer can be bypassed to connect to other servers in the local network. Thanks to @michaellrowley        | CVE-2022-0990  |
+| V 0.6.20      | Credentials for emails are now stored encrypted                                                                                  |                |
+| V 0.6.20      | Login is rate limited                                                                                                            |                |
+| V 0.6.20      | Passwordstrength can be forced                                                                                                   |                |
+| V 0.6.21      | SMTP server credentials are no longer returned to client                                                                         |                |
+| V 0.6.21      | Cross-site scripting (XSS) stored in href bypasses filter using data wrapper no longer possible                                  |                |
+| V 0.6.21      | Cross-site scripting (XSS) is no longer possible via pathchooser                                                                 |                |
+| V 0.6.21      | Error Handling at non existent rating, language, and user downloaded books was fixed                                             |                |
+| V 0.6.22      | Upload mimetype is checked to prevent malicious file content in the books library                                                |                |
+| V 0.6.22      | Cross-site scripting (XSS) stored in comments section is prevented better (switching from lxml to bleach for sanitizing strings) |                |
+| V 0.6.23      | Cookies are no longer stored for opds basic authentication and proxy authentication                                              |                |
+
+
+
+
+## Statement regarding Log4j (CVE-2021-44228 and related)
+
+Calibre-web is not affected by bugs related to Log4j. Calibre-Web is a python program, therefore not using Java, and not using the Java logging feature log4j. 
@@ -1,3 +1,4 @@
 [python: **.py]
+
+# has to be executed with jinja2 >=2.9 to have autoescape enabled automatically
 [jinja2: **/templates/**.*ml]
-extensions=jinja2.ext.autoescape,jinja2.ext.with_
@@ -2,7 +2,7 @@
 # -*- coding: utf-8 -*-

 #  This file is part of the Calibre-Web (https://github.com/janeczku/calibre-web)
-#    Copyright (C) 2012-2019  OzzieIsaacs
+#    Copyright (C) 2022 OzzieIsaacs
 #
 #  This program is free software: you can redistribute it and/or modify
 #  it under the terms of the GNU General Public License as published by
@@ -17,70 +17,51 @@
 #  You should have received a copy of the GNU General Public License
 #  along with this program. If not, see <http://www.gnu.org/licenses/>.

-from __future__ import absolute_import, division, print_function, unicode_literals
-import sys
 import os
+import sys


-# Insert local directories into path
-if sys.version_info < (3, 0):
-    sys.path.append(os.path.dirname(os.path.abspath(__file__.decode('utf-8'))))
-    sys.path.append(os.path.join(os.path.dirname(os.path.abspath(__file__.decode('utf-8'))), 'vendor'))
-else:
-    sys.path.append(os.path.dirname(os.path.abspath(__file__)))
-    sys.path.append(os.path.join(os.path.dirname(os.path.abspath(__file__)), 'vendor'))
+# Add local path to sys.path, so we can import cps
+path = os.path.dirname(os.path.abspath(__file__))
+sys.path.insert(0, path)
+
+from cps.main import main


-from cps import create_app
-from cps import web_server
-from cps.opds import opds
-from cps.web import web
-from cps.jinjia import jinjia
-from cps.about import about
-from cps.shelf import shelf
-from cps.admin import admi
-from cps.gdrive import gdrive
-from cps.editbooks import editbook
-from cps.remotelogin import remotelogin
-from cps.error_handler import init_errorhandler
+def hide_console_windows():
+    import ctypes

-try:
-    from cps.kobo import kobo, get_kobo_activated
-    from cps.kobo_auth import kobo_auth
-    kobo_available = get_kobo_activated()
-except ImportError:
-    kobo_available = False
+    kernel32 = ctypes.WinDLL('kernel32')
+    user32 = ctypes.WinDLL('user32')

-try:
-    from cps.oauth_bb import oauth
-    oauth_available = True
-except ImportError:
-    oauth_available = False
+    SW_HIDE = 0

-
-def main():
-    app = create_app()
-
-    init_errorhandler()
-
-    app.register_blueprint(web)
-    app.register_blueprint(opds)
-    app.register_blueprint(jinjia)
-    app.register_blueprint(about)
-    app.register_blueprint(shelf)
-    app.register_blueprint(admi)
-    app.register_blueprint(remotelogin)
-    # if config.config_use_google_drive:
-    app.register_blueprint(gdrive)
-    app.register_blueprint(editbook)
-    if kobo_available:
-        app.register_blueprint(kobo)
-        app.register_blueprint(kobo_auth)
-    if oauth_available:
-        app.register_blueprint(oauth)
-    success = web_server.start()
-    sys.exit(0 if success else 1)
+    hWnd = kernel32.GetConsoleWindow()
+    if hWnd:
+        user32.ShowWindow(hWnd, SW_HIDE)


 if __name__ == '__main__':
-    main()
+    # Only hide the console window on Windows when there is no interactive
+    # console attached. This preserves the ability to use Ctrl+C from a
+    # terminal (stdin is a tty) to stop the server.
+    if os.name == "nt" and not sys.stdin.isatty():
+        hide_console_windows()
+
+    try:
+        main()
+    except KeyboardInterrupt:
+        # Allow stopping the server with Ctrl+C from an interactive console, after reboot of calibre-web
+        # (initally the SIGINT signal CTRL+C is catched in server.py via the signal callback).
+        try:
+            # Try to perform a graceful stop if web_server is available.
+            # Import here to avoid import-time side-effects when not needed.
+            from cps import web_server
+            web_server.stop()
+        except Exception:
+            pass
+        print('\nCalibre-Web: received interrupt, shutting down')
+        sys.exit(0)
+
+
+
@@ -0,0 +1,37 @@
+# -*- coding: utf-8 -*-
+
+#  This file is part of the Calibre-Web (https://github.com/janeczku/calibre-web)
+#    Copyright (C) 2018-2019 OzzieIsaacs, cervinko, jkrehm, bodybybuddha, ok11,
+#                            andy29485, idalin, Kyosfonica, wuqi, Kennyl, lemmsh,
+#                            falgh1, grunjol, csitko, ytils, xybydy, trasba, vrabe,
+#                            ruben-herold, marblepebble, JackED42, SiphonSquirrel,
+#                            apetresc, nanu-c, mutschler, GammaC0de, vuolter
+#
+#  This program is free software: you can redistribute it and/or modify
+#  it under the terms of the GNU General Public License as published by
+#  the Free Software Foundation, either version 3 of the License, or
+#  (at your option) any later version.
+#
+#  This program is distributed in the hope that it will be useful,
+#  but WITHOUT ANY WARRANTY; without even the implied warranty of
+#  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+#  GNU General Public License for more details.
+#
+#  You should have received a copy of the GNU General Public License
+#  along with this program. If not, see <http://www.gnu.org/licenses/>.
+
+from .cw_login import LoginManager
+from flask import session
+
+
+class MyLoginManager(LoginManager):
+    def _session_protection_failed(self):
+        sess = session._get_current_object()
+        ident = self._session_identifier_generator()
+        if(sess and not (len(sess) == 1
+                         and sess.get('csrf_token', None))) and ident != sess.get('_id', None):
+            return super(). _session_protection_failed()
+        return False
+
+
+
@@ -19,133 +19,209 @@
 #
 #  You should have received a copy of the GNU General Public License
 #  along with this program. If not, see <http://www.gnu.org/licenses/>.
+__package__ = "cps"

-from __future__ import division, print_function, unicode_literals
 import sys
 import os
 import mimetypes

-from babel import Locale as LC
-from babel import negotiate_locale
-from babel.core import UnknownLocaleError
-from flask import Flask, request, g
-from flask_login import LoginManager
-from flask_babel import Babel
+from flask import Flask
+from flask.sessions import SecureCookieSessionInterface
+from .MyLoginManager import MyLoginManager
 from flask_principal import Principal

-from . import config_sql, logger, cache_buster, cli, ub, db
+from . import logger
+from .cli import CliParameter
 from .reverseproxy import ReverseProxied
 from .server import WebServer
+from .dep_check import dependency_check
+from .updater import Updater
+from . import config_sql
+from . import cache_buster
+from . import ub, db
+
+try:
+    from flask_limiter import Limiter
+    limiter_present = True
+except ImportError:
+    limiter_present = False
+try:
+    from flask_wtf.csrf import CSRFProtect
+    wtf_present = True
+except ImportError:
+    wtf_present = False


 mimetypes.init()
 mimetypes.add_type('application/xhtml+xml', '.xhtml')
 mimetypes.add_type('application/epub+zip', '.epub')
+mimetypes.add_type('application/epub+zip', '.kepub')
 mimetypes.add_type('application/fb2+zip', '.fb2')
 mimetypes.add_type('application/x-mobipocket-ebook', '.mobi')
-mimetypes.add_type('application/x-mobipocket-ebook', '.prc')
-mimetypes.add_type('application/vnd.amazon.ebook', '.azw')
-mimetypes.add_type('application/x-mobi8-ebook', '.azw3')
+mimetypes.add_type('application/octet-stream', '.prc')
+mimetypes.add_type('application/x-mobipocket-ebook', '.azw')
+mimetypes.add_type('application/x-mobipocket-ebook', '.azw3')
 mimetypes.add_type('application/x-cbr', '.cbr')
 mimetypes.add_type('application/x-cbz', '.cbz')
-mimetypes.add_type('application/x-cbt', '.cbt')
+mimetypes.add_type('application/x-tar', '.cbt')
+mimetypes.add_type('application/x-7z-compressed', '.cb7')
+mimetypes.add_type('image/vnd.djvu', '.djv')
 mimetypes.add_type('image/vnd.djvu', '.djvu')
 mimetypes.add_type('application/mpeg', '.mpeg')
-mimetypes.add_type('application/mpeg', '.mp3')
-mimetypes.add_type('application/mp4', '.m4a')
-mimetypes.add_type('application/mp4', '.m4b')
-mimetypes.add_type('application/ogg', '.ogg')
+mimetypes.add_type('audio/mpeg', '.mp3')
+mimetypes.add_type('audio/x-m4a', '.m4a')
+mimetypes.add_type('audio/x-m4a', '.m4b')
+mimetypes.add_type('audio/x-hx-aac-adts', '.aac')
+mimetypes.add_type('audio/vnd.dolby.dd-raw', '.ac3')
+mimetypes.add_type('video/x-ms-asf', '.asf')
+mimetypes.add_type('audio/ogg', '.ogg')
 mimetypes.add_type('application/ogg', '.oga')
+mimetypes.add_type('text/css', '.css')
+mimetypes.add_type('application/x-ms-reader', '.lit')
+mimetypes.add_type('text/javascript', '.js')
+mimetypes.add_type('text/rtf', '.rtf')
+
+log = logger.create()

 app = Flask(__name__)
 app.config.update(
    SESSION_COOKIE_HTTPONLY=True,
    SESSION_COOKIE_SAMESITE='Lax',
-    REMEMBER_COOKIE_SAMESITE='Lax',  # will be available in flask-login 0.5.1 earliest
+    REMEMBER_COOKIE_SAMESITE='Strict',
+    WTF_CSRF_SSL_STRICT=False,
+    SESSION_COOKIE_NAME=os.environ.get('COOKIE_PREFIX', "") + "session",
+    REMEMBER_COOKIE_NAME=os.environ.get('COOKIE_PREFIX', "") + "remember_token"
 )

+lm = MyLoginManager()

-lm = LoginManager()
-lm.login_view = 'web.login'
-lm.anonymous_user = ub.Anonymous
-lm.session_protection = 'strong'
+cli_param = CliParameter()

-ub.init_db(cli.settingspath)
-# pylint: disable=no-member
-config = config_sql.load_configuration(ub.session)
+config = config_sql.ConfigSQL()
+
+if wtf_present:
+    csrf = CSRFProtect()
+else:
+    csrf = None
+
+calibre_db = db.CalibreDB(app)

 web_server = WebServer()

-babel = Babel()
-_BABEL_TRANSLATIONS = set()
+updater_thread = Updater()

-log = logger.create()
+if limiter_present:
+    limiter = Limiter(key_func=True, headers_enabled=True, in_memory_fallback_enabled=True, default_limits=[],
+                      swallow_errors=True)
+else:
+    limiter = None

-from . import services
+class ScriptNameSessionInterface(SecureCookieSessionInterface):
+    def get_cookie_path(self, app):
+        # Called once per response, after request context exists
+        return app.wsgi_app.script_name.rstrip("/") or "/"

-db.CalibreDB.setup_db(config, cli.settingspath)
-
-calibre_db = db.CalibreDB()

 def create_app():
-    app.wsgi_app = ReverseProxied(app.wsgi_app)
-    # For python2 convert path to unicode
+    app.session_interface = ScriptNameSessionInterface()
+    if csrf:
+        csrf.init_app(app)
+
+    cli_param.init()
+
+    ub.init_db(cli_param.settings_path)
+    # pylint: disable=no-member
+    encrypt_key, error = config_sql.get_encryption_key(os.path.dirname(cli_param.settings_path))
+
+    config_sql.load_configuration(ub.session, encrypt_key)
+    config.init_config(ub.session, encrypt_key, cli_param)
+
+    if error:
+        log.error(error)
+
+    ub.password_change(cli_param.user_credentials)
+
    if sys.version_info < (3, 0):
-        app.static_folder = app.static_folder.decode('utf-8')
-        app.root_path = app.root_path.decode('utf-8')
-        app.instance_path = app.instance_path.decode('utf-8')
+        log.info(
+            '*** Python2 is EOL since end of 2019, this version of Calibre-Web is no longer supporting Python2, '
+            'please update your installation to Python3 ***')
+        print(
+            '*** Python2 is EOL since end of 2019, this version of Calibre-Web is no longer supporting Python2, '
+            'please update your installation to Python3 ***')
+        web_server.stop(True)
+        sys.exit(5)
+
+    lm.login_view = 'web.login'
+    lm.anonymous_user = ub.Anonymous
+    lm.session_protection = 'strong' if config.config_session == 1 else "basic"
+
+    db.CalibreDB.update_config(config, config.config_calibre_dir, cli_param.settings_path)
+
+    updater_thread.init_updater(config, web_server)
+    # Perform dry run of updater and exit afterward
+    if cli_param.dry_run:
+        updater_thread.dry_run()
+        sys.exit(0)
+    updater_thread.start()
+    requirements = dependency_check()
+    for res in requirements:
+        if res['found'] == "not installed":
+            message = ('Cannot import {name} module, it is needed to run calibre-web, '
+                       'please install it using "pip install {name}"').format(name=res["name"])
+            log.info(message)
+            print("*** " + message + " ***")
+            web_server.stop(True)
+            sys.exit(8)
+    for res in requirements + dependency_check(True):
+        log.info('*** "{}" version does not meet the requirements. '
+                 'Should: {}, Found: {}, please consider installing required version ***'
+                 .format(res['name'],
+                         res['target'],
+                         res['found']))
+    app.wsgi_app = ReverseProxied(app.wsgi_app)

    if os.environ.get('FLASK_DEBUG'):
-    	cache_buster.init_cache_busting(app)
-
+        cache_buster.init_cache_busting(app)
    log.info('Starting Calibre Web...')
-    if sys.version_info < (3, 0):
-        log.info('Python2 is EOL since end of 2019, this version of Calibre-Web supporting Python2 please consider upgrading to Python3')
-        print('Python2 is EOL since end of 2019, this version of Calibre-Web supporting Python2 please consider upgrading to Python3')
    Principal(app)
    lm.init_app(app)
    app.secret_key = os.getenv('SECRET_KEY', config_sql.get_flask_session_key(ub.session))

    web_server.init_app(app, config)
+    from .cw_babel import babel, get_locale
+    if hasattr(babel, "localeselector"):
+        babel.init_app(app)
+        babel.localeselector(get_locale)
+    else:
+        babel.init_app(app, locale_selector=get_locale)

-    babel.init_app(app)
-    _BABEL_TRANSLATIONS.update(str(item) for item in babel.list_translations())
-    _BABEL_TRANSLATIONS.add('en')
+    from . import services

    if services.ldap:
        services.ldap.init_app(app, config)
    if services.goodreads_support:
        services.goodreads_support.connect(config.config_goodreads_api_key,
-                                           config.config_goodreads_api_secret,
                                           config.config_use_goodreads)
+    config.store_calibre_uuid(calibre_db, db.Library_Id)
+    # Configure rate limiter
+    # https://limits.readthedocs.io/en/stable/storage.html
+    app.config.update(RATELIMIT_ENABLED=config.config_ratelimiter)
+    if config.config_limiter_uri != "" and not cli_param.memory_backend:
+        app.config.update(RATELIMIT_STORAGE_URI=config.config_limiter_uri)
+        if config.config_limiter_options != "":
+            app.config.update(RATELIMIT_STORAGE_OPTIONS=config.config_limiter_options)
+    try:
+        limiter.init_app(app)
+    except Exception as e:
+        log.error('Wrong Flask Limiter configuration, falling back to default: {}'.format(e))
+        app.config.update(RATELIMIT_STORAGE_URI=None)
+        limiter.init_app(app)
+
+    # Register scheduled tasks
+    from .schedule import register_scheduled_tasks, register_startup_tasks
+    register_scheduled_tasks(config.schedule_reconnect)
+    register_startup_tasks()

    return app

-@babel.localeselector
-def get_locale():
-    # if a user is logged in, use the locale from the user settings
-    user = getattr(g, 'user', None)
-    # user = None
-    if user is not None and hasattr(user, "locale"):
-        if user.nickname != 'Guest':   # if the account is the guest account bypass the config lang settings
-            return user.locale

-    preferred = list()
-    if request.accept_languages:
-        for x in request.accept_languages.values():
-            try:
-                preferred.append(str(LC.parse(x.replace('-', '_'))))
-            except (UnknownLocaleError, ValueError) as e:
-                log.debug('Could not parse locale "%s": %s', x, e)
-
-    return negotiate_locale(preferred or ['en'], _BABEL_TRANSLATIONS)
-
-
-@babel.timezoneselector
-def get_timezone():
-    user = getattr(g, 'user', None)
-    return user.timezone if user else None
-
-from .updater import Updater
-updater_thread = Updater()
-updater_thread.start()
@@ -20,82 +20,66 @@
 #  You should have received a copy of the GNU General Public License
 #  along with this program. If not, see <http://www.gnu.org/licenses/>.

-from __future__ import division, print_function, unicode_literals
 import sys
 import platform
 import sqlite3
+from importlib.metadata import metadata
 from collections import OrderedDict

-import babel, pytz, requests, sqlalchemy
-import werkzeug, flask, flask_login, flask_principal, jinja2
+import flask
 from flask_babel import gettext as _

-from . import db, calibre_db, converter, uploader, server, isoLanguages, constants
+from . import db, calibre_db, converter, uploader, constants, dep_check
 from .render_template import render_title_template
-try:
-    from flask_login import __version__ as flask_loginVersion
-except ImportError:
-    from flask_login.__about__ import __version__ as flask_loginVersion
-try:
-    import unidecode
-    # _() necessary to make babel aware of string for translation
-    unidecode_version = _(u'installed')
-except ImportError:
-    unidecode_version = _(u'not installed')
+from .usermanagement import user_login_required

-try:
-    from flask_dance import __version__ as flask_danceVersion
-except ImportError:
-    flask_danceVersion = None
-
-from . import services

 about = flask.Blueprint('about', __name__)

-
-_VERSIONS = OrderedDict(
-    Platform = '{0[0]} {0[2]} {0[3]} {0[4]} {0[5]}'.format(platform.uname()),
-    Python=sys.version,
-    Calibre_Web=constants.STABLE_VERSION['version'] + ' - '
-                + constants.NIGHTLY_VERSION[0].replace('%','%%') + ' - '
-                + constants.NIGHTLY_VERSION[1].replace('%','%%'),
-    WebServer=server.VERSION,
-    Flask=flask.__version__,
-    Flask_Login=flask_loginVersion,
-    Flask_Principal=flask_principal.__version__,
-    Werkzeug=werkzeug.__version__,
-    Babel=babel.__version__,
-    Jinja2=jinja2.__version__,
-    Requests=requests.__version__,
-    SqlAlchemy=sqlalchemy.__version__,
-    pySqlite=sqlite3.version,
-    SQLite=sqlite3.sqlite_version,
-    iso639=isoLanguages.__version__,
-    pytz=pytz.__version__,
-    Unidecode = unidecode_version,
-    Flask_SimpleLDAP =  u'installed' if bool(services.ldap) else None,
-    python_LDAP = services.ldapVersion if bool(services.ldapVersion) else None,
-    Goodreads = u'installed' if bool(services.goodreads_support) else None,
-    jsonschema = services.SyncToken.__version__  if bool(services.SyncToken) else None,
-    flask_dance = flask_danceVersion
-)
-_VERSIONS.update(uploader.get_versions())
+modules = dict()
+req = dep_check.load_dependencies(False)
+opt = dep_check.load_dependencies(True)
+for i in (req + opt):
+    modules[i[1]] = i[0]
+modules['Jinja2'] = metadata("jinja2")["Version"]
+if sys.version_info < (3, 12):
+    modules['pySqlite'] = sqlite3.version
+modules['SQLite'] = sqlite3.sqlite_version
+sorted_modules = OrderedDict((sorted(modules.items(), key=lambda x: x[0].casefold())))


 def collect_stats():
-    _VERSIONS['ebook converter'] = _(converter.get_calibre_version())
-    _VERSIONS['unrar'] = _(converter.get_unrar_version())
-    _VERSIONS['kepubify'] = _(converter.get_kepubify_version())
+    if constants.NIGHTLY_VERSION[0] == "$Format:%H$":
+        calibre_web_version = constants.STABLE_VERSION.replace("b", " Beta")
+    else:
+        calibre_web_version = (constants.STABLE_VERSION.replace("b", " Beta") + ' - '
+                               + constants.NIGHTLY_VERSION[0].replace('%', '%%') + ' - '
+                               + constants.NIGHTLY_VERSION[1].replace('%', '%%'))
+
+    if getattr(sys, 'frozen', False):
+        calibre_web_version += " - Exe-Version"
+    elif constants.HOME_CONFIG:
+        calibre_web_version += " - pyPi"
+
+    _VERSIONS = {'Calibre Web': calibre_web_version}
+    _VERSIONS.update(OrderedDict(
+        Python=sys.version,
+        Platform='{0[0]} {0[2]} {0[3]} {0[4]} {0[5]}'.format(platform.uname()),
+    ))
+    _VERSIONS.update(uploader.get_magick_version())
+    _VERSIONS['Unrar'] = converter.get_unrar_version()
+    _VERSIONS['Ebook converter'] = converter.get_calibre_version()
+    _VERSIONS['Kepubify'] = converter.get_kepubify_version()
+    _VERSIONS.update(sorted_modules)
    return _VERSIONS

+
@about.route("/stats")
-@flask_login.login_required
+@user_login_required
 def stats():
    counter = calibre_db.session.query(db.Books).count()
    authors = calibre_db.session.query(db.Authors).count()
-    categorys = calibre_db.session.query(db.Tags).count()
+    categories = calibre_db.session.query(db.Tags).count()
    series = calibre_db.session.query(db.Series).count()
    return render_title_template('stats.html', bookcounter=counter, authorcounter=authors, versions=collect_stats(),
-                                 categorycounter=categorys, seriecounter=series, title=_(u"Statistics"), page="stat")
-
-
+                                 categorycounter=categories, seriecounter=series, title=_("Statistics"), page="stat")
@@ -0,0 +1,147 @@
+# -*- coding: utf-8 -*-
+
+#  This file is part of the Calibre-Web (https://github.com/janeczku/calibre-web)
+#    Copyright (C) 2024 Ozzieisaacs
+#
+#  This program is free software: you can redistribute it and/or modify
+#  it under the terms of the GNU General Public License as published by
+#  the Free Software Foundation, either version 3 of the License, or
+#  (at your option) any later version.
+#
+#  This program is distributed in the hope that it will be useful,
+#  but WITHOUT ANY WARRANTY; without even the implied warranty of
+#  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+#  GNU General Public License for more details.
+#
+#  You should have received a copy of the GNU General Public License
+#  along with this program. If not, see <http://www.gnu.org/licenses/>.
+
+import mutagen
+import base64
+from . import cover, logger
+
+from cps.constants import BookMeta
+
+log = logger.create()
+
+def get_audio_file_info(tmp_file_path, original_file_extension, original_file_name, no_cover_processing):
+    tmp_cover_name = None
+    audio_file = mutagen.File(tmp_file_path)
+    comments = None
+    if original_file_extension in [".mp3", ".wav", ".aiff"]:
+        cover_data = list()
+        for key, val in audio_file.tags.items():
+            if key.startswith("APIC:"):
+                cover_data.append(val)
+            if key.startswith("COMM:"):
+                comments = val.text[0]
+        title = audio_file.tags.get('TIT2').text[0] if "TIT2" in audio_file.tags else None
+        author = audio_file.tags.get('TPE1').text[0] if "TPE1" in audio_file.tags else None
+        if author is None:
+            author = audio_file.tags.get('TPE2').text[0] if "TPE2" in audio_file.tags else None
+        tags = audio_file.tags.get('TCON').text[0] if "TCON" in audio_file.tags else None # Genre
+        series = audio_file.tags.get('TALB').text[0] if "TALB" in audio_file.tags else None# Album
+        series_id = audio_file.tags.get('TRCK').text[0] if "TRCK" in audio_file.tags else None # track no.
+        publisher = audio_file.tags.get('TPUB').text[0] if "TPUB" in audio_file.tags else None
+        pubdate = str(audio_file.tags.get('TDRL').text[0]) if "TDRL" in audio_file.tags else None
+        if not pubdate:
+            pubdate = str(audio_file.tags.get('TDRC').text[0]) if "TDRC" in audio_file.tags else None
+            if not pubdate:
+                pubdate = str(audio_file.tags.get('TDOR').text[0]) if "TDOR" in audio_file.tags else None
+        if cover_data and not no_cover_processing:
+            cover_info = cover_data[0]
+            for dat in cover_data:
+                if dat.type == mutagen.id3.PictureType.COVER_FRONT:
+                    cover_info = dat
+                    break
+            tmp_cover_name = cover.cover_processing(tmp_file_path, cover_info.data, "." + cover_info.mime[-3:])
+    elif original_file_extension in [".ogg", ".flac", ".opus", ".ogv"]:
+        title = audio_file.tags.get('TITLE')[0] if "TITLE" in audio_file else None
+        author = audio_file.tags.get('ARTIST')[0] if "ARTIST" in audio_file else None
+        comments = audio_file.tags.get('COMMENTS')[0] if "COMMENTS" in audio_file else None
+        tags = audio_file.tags.get('GENRE')[0] if "GENRE" in audio_file else None # Genre
+        series = audio_file.tags.get('ALBUM')[0] if "ALBUM" in audio_file else None
+        series_id = audio_file.tags.get('TRACKNUMBER')[0] if "TRACKNUMBER" in audio_file else None
+        publisher = audio_file.tags.get('LABEL')[0] if "LABEL" in audio_file else None
+        pubdate = audio_file.tags.get('DATE')[0] if "DATE" in audio_file else None
+        cover_data = audio_file.tags.get('METADATA_BLOCK_PICTURE')
+        if not no_cover_processing:
+            if cover_data:
+                cover_info = mutagen.flac.Picture(base64.b64decode(cover_data[0]))
+                tmp_cover_name = cover.cover_processing(tmp_file_path, cover_info.data, "." + cover_info.mime[-3:])
+            if hasattr(audio_file, "pictures"):
+                cover_info = audio_file.pictures[0]
+                for dat in audio_file.pictures:
+                    if dat.type == mutagen.id3.PictureType.COVER_FRONT:
+                        cover_info = dat
+                        break
+                tmp_cover_name = cover.cover_processing(tmp_file_path, cover_info.data, "." + cover_info.mime[-3:])
+    elif original_file_extension in [".aac"]:
+        title = audio_file.tags.get('Title').value if "Title" in audio_file else None
+        author = audio_file.tags.get('Artist').value if "Artist" in audio_file else None
+        comments = audio_file.tags.get('Comment').value if "Comment" in audio_file else None
+        tags = audio_file.tags.get('Genre').value if "Genre" in audio_file else None
+        series = audio_file.tags.get('Album').value if "Album" in audio_file else None
+        series_id = audio_file.tags.get('Track').value if "Track" in audio_file else None
+        publisher = audio_file.tags.get('Label').value if "Label" in audio_file else None
+        pubdate = audio_file.tags.get('Year').value if "Year" in audio_file else None
+        cover_data = audio_file.tags['Cover Art (Front)']
+        if cover_data and not no_cover_processing:
+            tmp_cover_name = tmp_file_path + '.jpg'
+            with open(tmp_cover_name, "wb") as cover_file:
+                cover_file.write(cover_data.value.split(b"\x00",1)[1])
+    elif original_file_extension in [".asf"]:
+        title = audio_file.tags.get('Title')[0].value if "Title" in audio_file else None
+        author = audio_file.tags.get('Artist')[0].value if "Artist" in audio_file else None
+        comments = audio_file.tags.get('Comments')[0].value if "Comments" in audio_file else None
+        tags = audio_file.tags.get('Genre')[0].value if "Genre" in audio_file else None
+        series = audio_file.tags.get('Album')[0].value if "Album" in audio_file else None
+        series_id = audio_file.tags.get('Track')[0].value if "Track" in audio_file else None
+        publisher = audio_file.tags.get('Label')[0].value if "Label" in audio_file else None
+        pubdate = audio_file.tags.get('Year')[0].value if "Year" in audio_file else None
+        cover_data = audio_file.tags.get('WM/Picture', None)
+        if cover_data and not no_cover_processing:
+            tmp_cover_name = tmp_file_path + '.jpg'
+            with open(tmp_cover_name, "wb") as cover_file:
+                cover_file.write(cover_data[0].value)
+    elif original_file_extension in [".mp4", ".m4a", ".m4b"]:
+        title = audio_file.tags.get('©nam')[0] if "©nam" in audio_file.tags else None
+        author = audio_file.tags.get('©ART')[0] if "©ART" in audio_file.tags else None
+        comments = audio_file.tags.get('©cmt')[0] if "©cmt" in audio_file.tags else None
+        tags = audio_file.tags.get('©gen')[0] if "©gen" in audio_file.tags else None
+        series = audio_file.tags.get('©alb')[0] if "©alb" in audio_file.tags else None
+        series_id = str(audio_file.tags.get('trkn')[0][0]) if "trkn" in audio_file.tags else None
+        publisher = ""
+        pubdate = audio_file.tags.get('©day')[0] if "©day" in audio_file.tags else None
+        cover_data = audio_file.tags.get('covr', None)
+        if cover_data and not no_cover_processing:
+            cover_type = None
+            for c in cover_data:
+                if c.imageformat == mutagen.mp4.AtomDataType.JPEG:
+                    cover_type =".jpg"
+                    cover_bin = c
+                    break
+                elif c.imageformat == mutagen.mp4.AtomDataType.PNG:
+                    cover_type = ".png"
+                    cover_bin = c
+                    break
+            if cover_type:
+                tmp_cover_name = cover.cover_processing(tmp_file_path, cover_bin, cover_type)
+            else:
+                logger.error("Unknown covertype in file {} ".format(original_file_name))
+
+    return BookMeta(
+        file_path=tmp_file_path,
+        extension=original_file_extension,
+        title=title or original_file_name ,
+        author="Unknown" if author is None else author,
+        cover=tmp_cover_name,
+        description="" if comments is None else comments,
+        tags="" if tags is None else tags,
+        series="" if series is None else series,
+        series_id="1" if series_id is None else series_id.split("/")[0],
+        languages="",
+        publisher= "" if publisher is None else publisher,
+        pubdate="" if pubdate is None else pubdate,
+        identifiers=[],
+    )
@@ -0,0 +1,89 @@
+#  This file is part of the Calibre-Web (https://github.com/janeczku/calibre-web)
+#    Copyright (C) 2018-2019 OzzieIsaacs, cervinko, jkrehm, bodybybuddha, ok11,
+#                            andy29485, idalin, Kyosfonica, wuqi, Kennyl, lemmsh,
+#                            falgh1, grunjol, csitko, ytils, xybydy, trasba, vrabe,
+#                            ruben-herold, marblepebble, JackED42, SiphonSquirrel,
+#                            apetresc, nanu-c, mutschler, carderne
+#
+#  This program is free software: you can redistribute it and/or modify
+#  it under the terms of the GNU General Public License as published by
+#  the Free Software Foundation, either version 3 of the License, or
+#  (at your option) any later version.
+#
+#  This program is distributed in the hope that it will be useful,
+#  but WITHOUT ANY WARRANTY; without even the implied warranty of
+#  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+#  GNU General Public License for more details.
+#
+#  You should have received a copy of the GNU General Public License
+#  along with this program. If not, see <http://www.gnu.org/licenses/>.
+
+
+from flask import Blueprint
+from flask_babel import gettext as _
+from flask_babel import get_locale
+from flask import request, redirect, url_for
+
+from . import logger, isoLanguages
+from . import db, config
+from . import calibre_db
+from .usermanagement import login_required_if_no_ano
+from .render_template import render_title_template
+from .web import get_sort_function
+
+try:
+    from natsort import natsorted as sort
+except ImportError:
+    sort = sorted  # Just use regular sort then, may cause issues with badly named pages in cbz/cbr files
+
+basic = Blueprint('basic', __name__)
+
+log = logger.create()
+
+
+@basic.route("/basic", methods=["GET"])
+@login_required_if_no_ano
+def index():
+    term = request.args.get("query", "")  # default to showing all books
+    limit = 15
+    page = int(request.args.get("page") or 1)
+    off = (page - 1) * limit
+    order = get_sort_function("stored", "search")
+    join = db.books_series_link, db.Books.id == db.books_series_link.c.book, db.Series
+    entries, result_count, pagination = calibre_db.get_search_results(term,
+                                                                      config,
+                                                                      off,
+                                                                      order,
+                                                                      limit,
+                                                                      *join)
+    return render_title_template('basic_index.html',
+                                 searchterm=term,
+                                 pagination=pagination,
+                                 query=term,
+                                 adv_searchterm=term,
+                                 entries=entries,
+                                 result_count=result_count,
+                                 title=_("Search"),
+                                 page="search",
+                                 order=order[1])
+
+
+@basic.route("/basic_book/<int:book_id>")
+@login_required_if_no_ano
+def show_book(book_id):
+    entries = calibre_db.get_book_read_archived(book_id, config.config_read_column, allow_show_archived=True)
+    if entries:
+        entry = entries[0]
+        for lang_index in range(0, len(entry.languages)):
+            entry.languages[lang_index].language_name = isoLanguages.get_language_name(get_locale(), entry.languages[
+                lang_index].lang_code)
+        entry.ordered_authors = calibre_db.order_authors([entry])
+
+        return render_title_template('basic_detail.html',
+                                     entry=entry,
+                                     is_xhr=request.headers.get('X-Requested-With') == 'XMLHttpRequest',
+                                     title=entry.title,
+                                     page="book")
+    else:
+        log.debug("Selected book is unavailable. File does not exist or is not accessible")
+        return redirect(url_for("basic.index"))
@@ -19,7 +19,6 @@
 # Inspired by https://github.com/ChrisTM/Flask-CacheBust
 # Uses query strings so CSS font files are found without having to resort to absolute URLs

-from __future__ import division, print_function, unicode_literals
 import os
 import hashlib

@@ -48,22 +47,26 @@ def init_cache_busting(app):
        for filename in filenames:
            # compute version component
            rooted_filename = os.path.join(dirpath, filename)
-            with open(rooted_filename, 'rb') as f:
-                file_hash = hashlib.md5(f.read()).hexdigest()[:7]
+            try:
+                with open(rooted_filename, 'rb') as f:
+                    file_hash = hashlib.md5(f.read()).hexdigest()[:7]  # nosec
+                # save version to tables
+                file_path = rooted_filename.replace(static_folder, "")
+                file_path = file_path.replace("\\", "/")  # Convert Windows path to web path
+                hash_table[file_path] = file_hash
+            except PermissionError:
+                log.error("No permission to access {} file.".format(rooted_filename))

-            # save version to tables
-            file_path = rooted_filename.replace(static_folder, "")
-            file_path = file_path.replace("\\", "/")  # Convert Windows path to web path
-            hash_table[file_path] = file_hash
    log.debug('Finished computing cache-busting values')

-    def bust_filename(filename):
-        return hash_table.get(filename, "")
+    def bust_filename(file_name):
+        return hash_table.get(file_name, "")

-    def unbust_filename(filename):
-        return filename.split("?", 1)[0]
+    def unbust_filename(file_name):
+        return file_name.split("?", 1)[0]

    @app.url_defaults
+    # pylint: disable=unused-variable
    def reverse_to_cache_busted_url(endpoint, values):
        """
        Make `url_for` produce busted filenames when using the 'static' endpoint.
@@ -0,0 +1,53 @@
+# -*- coding: utf-8 -*-
+
+#  This file is part of the Calibre-Web (https://github.com/janeczku/calibre-web)
+#    Copyright (C) 2018-2019 OzzieIsaacs
+#
+#  This program is free software: you can redistribute it and/or modify
+#  it under the terms of the GNU General Public License as published by
+#  the Free Software Foundation, either version 3 of the License, or
+#  (at your option) any later version.
+#
+#  This program is distributed in the hope that it will be useful,
+#  but WITHOUT ANY WARRANTY; without even the implied warranty of
+#  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+#  GNU General Public License for more details.
+#
+#  You should have received a copy of the GNU General Public License
+#  along with this program. If not, see <http://www.gnu.org/licenses/>.
+
+from . import logger
+from lxml.etree import ParserError
+
+log = logger.create()
+
+try:
+    # at least bleach 6.0 is needed -> incomplatible change from list arguments to set arguments
+    from bleach import clean as clean_html
+    from bleach.sanitizer import ALLOWED_TAGS
+    bleach = True
+except ImportError:
+    from nh3 import clean as clean_html
+    bleach = False
+
+
+def clean_string(unsafe_text, book_id=0):
+    try:
+        if bleach:
+            allowed_tags = list(ALLOWED_TAGS)
+            allowed_tags.extend(["p", "span", "div", "pre", "br", "h1", "h2", "h3", "h4", "h5", "h6", "img"])
+            allowed_attributes = {
+                "*": ["class", "style"],
+                "a": ["href", "title", "rel"],
+                "img": ["src", "alt", "title", "width", "height"],
+            }
+            safe_text = clean_html(unsafe_text, tags=set(allowed_tags), attributes=allowed_attributes)
+        else:
+            safe_text = clean_html(unsafe_text)
+    except ParserError as e:
+        log.error("Comments of book {} are corrupted: {}".format(book_id, e))
+        safe_text = ""
+    except TypeError as e:
+        log.error("Comments can't be parsed, maybe 'lxml' is too new, try installing 'bleach': {}".format(e))
+        safe_text = ""
+    return safe_text
@@ -16,7 +16,6 @@
 #   You should have received a copy of the GNU General Public License
 #   along with this program. If not, see <http://www.gnu.org/licenses/>.

-from __future__ import division, print_function, unicode_literals
 import sys
 import os
 import argparse
@@ -25,95 +24,125 @@ import socket
 from .constants import CONFIG_DIR as _CONFIG_DIR
 from .constants import STABLE_VERSION as _STABLE_VERSION
 from .constants import NIGHTLY_VERSION as _NIGHTLY_VERSION
+from .constants import DEFAULT_SETTINGS_FILE, DEFAULT_GDRIVE_FILE


 def version_info():
    if _NIGHTLY_VERSION[1].startswith('$Format'):
-        return "Calibre-Web version: %s - unkown git-clone" % _STABLE_VERSION['version']
-    return "Calibre-Web version: %s -%s" % (_STABLE_VERSION['version'], _NIGHTLY_VERSION[1])
+        return "Calibre-Web version: %s - unknown git-clone" % _STABLE_VERSION.replace("b", " Beta")
+    return "Calibre-Web version: %s -%s" % (_STABLE_VERSION.replace("b", " Beta"), _NIGHTLY_VERSION[1])


-parser = argparse.ArgumentParser(description='Calibre Web is a web app'
-                                 ' providing a interface for browsing, reading and downloading eBooks\n', prog='cps.py')
-parser.add_argument('-p', metavar='path', help='path and name to settings db, e.g. /opt/cw.db')
-parser.add_argument('-g', metavar='path', help='path and name to gdrive db, e.g. /opt/gd.db')
-parser.add_argument('-c', metavar='path',
-                    help='path and name to SSL certfile, e.g. /opt/test.cert, works only in combination with keyfile')
-parser.add_argument('-k', metavar='path',
-                    help='path and name to SSL keyfile, e.g. /opt/test.key, works only in combination with certfile')
-parser.add_argument('-v', '--version', action='version', help='Shows version number and exits Calibre-web',
-                    version=version_info())
-parser.add_argument('-i', metavar='ip-address', help='Server IP-Address to listen')
-parser.add_argument('-s', metavar='user:pass', help='Sets specific username to new password')
-parser.add_argument('-f', action='store_true', help='Enables filepicker in unconfigured mode')
-args = parser.parse_args()
+class CliParameter(object):

-if sys.version_info < (3, 0):
-    if args.p:
-        args.p = args.p.decode('utf-8')
-    if args.g:
-        args.g = args.g.decode('utf-8')
-    if args.k:
-        args.k = args.k.decode('utf-8')
-    if args.c:
-        args.c = args.c.decode('utf-8')
-    if args.s:
-        args.s = args.s.decode('utf-8')
+    def __init__(self):
+        self.user_credentials = None
+        self.ip_address = None
+        self.allow_localhost = None
+        self.reconnect_enable = None
+        self.memory_backend = None
+        self.dry_run = None
+        self.certfilepath = None
+        self.keyfilepath = None
+        self.gd_path = None
+        self.settings_path = None
+        self.logpath = None

+    def init(self):
+        self.arg_parser()

-settingspath = args.p or os.path.join(_CONFIG_DIR, "app.db")
-gdpath       = args.g or os.path.join(_CONFIG_DIR, "gdrive.db")
+    def arg_parser(self):
+        parser = argparse.ArgumentParser(description='Calibre Web is a web app providing '
+                                                     'a interface for browsing, reading and downloading eBooks\n',
+                                         prog='cps.py')
+        parser.add_argument('-p', metavar='path', help='path and name to settings db, e.g. /opt/cw.db')
+        parser.add_argument('-g', metavar='path', help='path and name to gdrive db, e.g. /opt/gd.db')
+        parser.add_argument('-c', metavar='path', help='path and name to SSL certfile, '
+                                                       'e.g. /opt/test.cert, works only in combination with keyfile')
+        parser.add_argument('-k', metavar='path', help='path and name to SSL keyfile, e.g. /opt/test.key, '
+                                                       'works only in combination with certfile')
+        parser.add_argument('-o', metavar='path', help='path and name Calibre-Web logfile')
+        parser.add_argument('-v', '--version', action='version', help='Shows version number '
+                                                                      'and exits Calibre-Web',
+                            version=version_info())
+        parser.add_argument('-i', metavar='ip-address', help='Server IP-Address to listen')
+        parser.add_argument('-m', action='store_true',
+                            help='Use Memory-backend as limiter backend, use this parameter '
+                                 'in case of miss configured backend')
+        parser.add_argument('-s', metavar='user:pass',
+                            help='Sets specific username to new password and exits Calibre-Web')
+        parser.add_argument('-l', action='store_true', help='Allow loading covers from localhost')
+        parser.add_argument('-d', action='store_true', help='Dry run of updater to check file permissions '
+                                                            'in advance and exits Calibre-Web')
+        parser.add_argument('-r', action='store_true', help='Enable public database reconnect '
+                                                            'route under /reconnect')
+        args = parser.parse_args()

-# handle and check parameter for ssl encryption
-certfilepath = None
-keyfilepath = None
-if args.c:
-    if os.path.isfile(args.c):
-        certfilepath = args.c
-    else:
-        print("Certfilepath is invalid. Exiting...")
-        sys.exit(1)
+        self.logpath = args.o or ""
+        self.settings_path = args.p or os.path.join(_CONFIG_DIR, DEFAULT_SETTINGS_FILE)
+        self.gd_path = args.g or os.path.join(_CONFIG_DIR, DEFAULT_GDRIVE_FILE)

-if args.c == "":
-    certfilepath = ""
+        if os.path.isdir(self.settings_path):
+            self.settings_path = os.path.join(self.settings_path, DEFAULT_SETTINGS_FILE)

-if args.k:
-    if os.path.isfile(args.k):
-        keyfilepath = args.k
-    else:
-        print("Keyfilepath is invalid. Exiting...")
-        sys.exit(1)
+        if os.path.isdir(self.gd_path):
+            self.gd_path = os.path.join(self.gd_path, DEFAULT_GDRIVE_FILE)

-if (args.k and not args.c) or (not args.k and args.c):
-    print("Certfile and Keyfile have to be used together. Exiting...")
-    sys.exit(1)
-
-if args.k == "":
-    keyfilepath = ""
-
-# handle and check ipadress argument
-ipadress = args.i or None
-if ipadress:
-    try:
-        # try to parse the given ip address with socket
-        if hasattr(socket, 'inet_pton'):
-            if ':' in ipadress:
-                socket.inet_pton(socket.AF_INET6, ipadress)
+        # handle and check parameter for ssl encryption
+        self.certfilepath = None
+        self.keyfilepath = None
+        if args.c:
+            if os.path.isfile(args.c):
+                self.certfilepath = args.c
            else:
-                socket.inet_pton(socket.AF_INET, ipadress)
-        else:
-            # on windows python < 3.4, inet_pton is not available
-            # inet_atom only handles IPv4 addresses
-            socket.inet_aton(ipadress)
-    except socket.error as err:
-        print(ipadress, ':', err)
-        sys.exit(1)
+                print("Certfile path is invalid. Exiting...")
+                sys.exit(1)

-# handle and check user password argument
-user_credentials = args.s or None
-if user_credentials and ":" not in user_credentials:
-    print("No valid username:password format")
-    sys.exit(3)
+        if args.c == "":
+            self.certfilepath = ""

-# Handles enableing of filepicker
-filepicker = args.f or None
+        if args.k:
+            if os.path.isfile(args.k):
+                self.keyfilepath = args.k
+            else:
+                print("Keyfile path is invalid. Exiting...")
+                sys.exit(1)
+
+        if (args.k and not args.c) or (not args.k and args.c):
+            print("Certfile and Keyfile have to be used together. Exiting...")
+            sys.exit(1)
+
+        if args.k == "":
+            self.keyfilepath = ""
+
+        # overwrite limiter backend
+        self.memory_backend = args.m or None
+        # dry run updater
+        self.dry_run = args.d or None
+        # enable reconnect endpoint for docker database reconnect
+        self.reconnect_enable = args.r or os.environ.get("CALIBRE_RECONNECT", None)
+        # load covers from localhost
+        self.allow_localhost = args.l or os.environ.get("CALIBRE_LOCALHOST", None)
+        # handle and check ip address argument
+        self.ip_address = args.i or None
+        if self.ip_address:
+            try:
+                # try to parse the given ip address with socket
+                if hasattr(socket, 'inet_pton'):
+                    if ':' in self.ip_address:
+                        socket.inet_pton(socket.AF_INET6, self.ip_address)
+                    else:
+                        socket.inet_pton(socket.AF_INET, self.ip_address)
+                else:
+                    # on Windows python < 3.4, inet_pton is not available
+                    # inet_atom only handles IPv4 addresses
+                    socket.inet_aton(self.ip_address)
+            except socket.error as err:
+                print(self.ip_address, ':', err)
+                sys.exit(1)
+
+        # handle and check user password argument
+        self.user_credentials = args.s or None
+        if self.user_credentials and ":" not in self.user_credentials:
+            print("No valid 'username:password' format")
+            sys.exit(3)
@@ -1,7 +1,7 @@
 # -*- coding: utf-8 -*-

 #   This file is part of the Calibre-Web (https://github.com/janeczku/calibre-web)
-#     Copyright (C) 2018 OzzieIsaacs
+#     Copyright (C) 2018-2022 OzzieIsaacs
 #
 #   This program is free software: you can redistribute it and/or modify
 #   it under the terms of the GNU General Public License as published by
@@ -16,22 +16,18 @@
 #   You should have received a copy of the GNU General Public License
 #   along with this program. If not, see <http://www.gnu.org/licenses/>.

-from __future__ import division, print_function, unicode_literals
 import os

-from . import logger, isoLanguages
+from . import logger, isoLanguages, cover
 from .constants import BookMeta

-
-log = logger.create()
-
-
 try:
    from wand.image import Image
    use_IM = True
 except (ImportError, RuntimeError) as e:
    use_IM = False

+log = logger.create()

 try:
    from comicapi.comicarchive import ComicArchive, MetaDataStyle
@@ -40,6 +36,12 @@ try:
        from comicapi import __version__ as comic_version
    except ImportError:
        comic_version = ''
+    try:
+        from comicapi.comicarchive import load_archive_plugins
+        import comicapi.utils
+        comicapi.utils.add_rar_paths()
+    except ImportError:
+        load_archive_plugins = None
 except (ImportError, LookupError) as e:
    log.debug('Cannot import comicapi, extracting comic metadata will not work: %s', e)
    import zipfile
@@ -50,114 +52,144 @@ except (ImportError, LookupError) as e:
    except (ImportError, SyntaxError) as e:
        log.debug('Cannot import rarfile, extracting cover files from rar files will not work: %s', e)
        use_rarfile = False
+    try:
+        import py7zr
+        use_7zip = True
+    except (ImportError, SyntaxError) as e:
+        log.debug('Cannot import py7zr, extracting cover files from CB7 files will not work: %s', e)
+        use_7zip = False
    use_comic_meta = False

-NO_JPEG_EXTENSIONS = ['.png', '.webp', '.bmp']
-COVER_EXTENSIONS = ['.png', '.webp', '.bmp', '.jpg', '.jpeg']

-def _cover_processing(tmp_file_name, img, extension):
-    tmp_cover_name = os.path.join(os.path.dirname(tmp_file_name), 'cover.jpg')
-    if use_IM:
-        # convert to jpg because calibre only supports jpg
-        if extension in NO_JPEG_EXTENSIONS:
-            with Image(filename=tmp_file_name) as imgc:
-                imgc.format = 'jpeg'
-                imgc.transform_colorspace('rgb')
-                imgc.save(tmp_cover_name)
-                return tmp_cover_name
-
-    if not img:
-        return None
-
-    with open(tmp_cover_name, 'wb') as f:
-        f.write(img)
-    return tmp_cover_name
-
-
-
-def _extractCover(tmp_file_name, original_file_extension, rarExecutable):
+def _extract_cover_from_archive(original_file_extension, tmp_file_name, rar_executable):
    cover_data = extension = None
-    if use_comic_meta:
-        archive = ComicArchive(tmp_file_name, rar_exe_path=rarExecutable)
-        for index, name in enumerate(archive.getPageNameList()):
+    if original_file_extension.upper() == '.CBZ':
+        cf = zipfile.ZipFile(tmp_file_name)
+        for name in sorted(cf.namelist()):
            ext = os.path.splitext(name)
            if len(ext) > 1:
                extension = ext[1].lower()
-                if extension in COVER_EXTENSIONS:
-                    cover_data = archive.getPage(index)
+                if extension in cover.COVER_EXTENSIONS:
+                    cover_data = cf.read(name)
                    break
-    else:
-        if original_file_extension.upper() == '.CBZ':
-            cf = zipfile.ZipFile(tmp_file_name)
-            for name in cf.namelist():
+    elif original_file_extension.upper() == '.CBT':
+        cf = tarfile.TarFile(tmp_file_name)
+        for name in sorted(cf.getnames()):
+            ext = os.path.splitext(name)
+            if len(ext) > 1:
+                extension = ext[1].lower()
+                if extension in cover.COVER_EXTENSIONS:
+                    cover_data = cf.extractfile(name).read()
+                    break
+    elif original_file_extension.upper() == '.CBR' and use_rarfile:
+        try:
+            rarfile.UNRAR_TOOL = rar_executable
+            cf = rarfile.RarFile(tmp_file_name)
+            for name in sorted(cf.namelist()):
                ext = os.path.splitext(name)
                if len(ext) > 1:
                    extension = ext[1].lower()
-                    if extension in COVER_EXTENSIONS:
+                    if extension in cover.COVER_EXTENSIONS:
                        cover_data = cf.read(name)
                        break
-        elif original_file_extension.upper() == '.CBT':
-            cf = tarfile.TarFile(tmp_file_name)
-            for name in cf.getnames():
-                ext = os.path.splitext(name)
-                if len(ext) > 1:
-                    extension = ext[1].lower()
-                    if extension in COVER_EXTENSIONS:
-                        cover_data = cf.extractfile(name).read()
-                        break
-        elif original_file_extension.upper() == '.CBR' and use_rarfile:
-            try:
-                rarfile.UNRAR_TOOL = rarExecutable
-                cf = rarfile.RarFile(tmp_file_name)
-                for name in cf.getnames():
-                    ext = os.path.splitext(name)
-                    if len(ext) > 1:
-                        extension = ext[1].lower()
-                        if extension in COVER_EXTENSIONS:
-                            cover_data = cf.read(name)
-                            break
-            except Exception as e:
-                log.debug('Rarfile failed with error: %s', e)
-    return _cover_processing(tmp_file_name, cover_data, extension)
+        except Exception as ex:
+            log.error('Rarfile failed with error: {}'.format(ex))
+    elif original_file_extension.upper() == '.CB7' and use_7zip:
+        cf = py7zr.SevenZipFile(tmp_file_name)
+        for name in sorted(cf.getnames()):
+            ext = os.path.splitext(name)
+            if len(ext) > 1:
+                extension = ext[1].lower()
+                if extension in cover.COVER_EXTENSIONS:
+                    try:
+                        cover_data = cf.read([name])[name].read()
+                    except (py7zr.Bad7zFile, OSError) as ex:
+                        log.error('7Zip file failed with error: {}'.format(ex))
+                    break
+    return cover_data, extension


-def get_comic_info(tmp_file_path, original_file_name, original_file_extension, rarExecutable):
+def _extract_cover(tmp_file_path, original_file_extension, rar_executable):
+    cover_data = extension = None
    if use_comic_meta:
-        archive = ComicArchive(tmp_file_path, rar_exe_path=rarExecutable)
-        if archive.seemsToBeAComicArchive():
-            if archive.hasMetadata(MetaDataStyle.CIX):
+        try:
+            archive = ComicArchive(tmp_file_path, rar_exe_path=rar_executable)
+        except TypeError:
+            archive = ComicArchive(tmp_file_path)
+        name_list = archive.getPageNameList if hasattr(archive, "getPageNameList") else archive.get_page_name_list
+        for index, name in enumerate(name_list()):
+            ext = os.path.splitext(name)
+            if len(ext) > 1:
+                extension = ext[1].lower()
+                if extension in cover.COVER_EXTENSIONS:
+                    get_page = archive.getPage if hasattr(archive, "getPageNameList") else archive.get_page
+                    cover_data = get_page(index)
+                    break
+    else:
+        cover_data, extension = _extract_cover_from_archive(original_file_extension, tmp_file_path, rar_executable)
+    return cover.cover_processing(tmp_file_path, cover_data, extension)
+
+
+def get_comic_info(tmp_file_path, original_file_name, original_file_extension, rar_executable, no_cover_processing):
+    if use_comic_meta:
+        try:
+            archive = ComicArchive(tmp_file_path, rar_exe_path=rar_executable)
+        except TypeError:
+            load_archive_plugins(force=True, rar=rar_executable)
+            archive = ComicArchive(tmp_file_path)
+        if hasattr(archive, "seemsToBeAComicArchive"):
+            seems_archive = archive.seemsToBeAComicArchive
+        else:
+            seems_archive = archive.seems_to_be_a_comic_archive
+        if seems_archive():
+            has_metadata = archive.hasMetadata if hasattr(archive, "hasMetadata") else archive.has_metadata
+            if has_metadata(MetaDataStyle.CIX):
                style = MetaDataStyle.CIX
-            elif archive.hasMetadata(MetaDataStyle.CBI):
+            elif has_metadata(MetaDataStyle.CBI):
                style = MetaDataStyle.CBI
            else:
                style = None

-            # if style is not None:
-            loadedMetadata = archive.readMetadata(style)
-
-            lang = loadedMetadata.language or ""
-            loadedMetadata.language = isoLanguages.get_lang3(lang)
+            read_metadata = archive.readMetadata if hasattr(archive, "readMetadata") else archive.read_metadata
+            loaded_metadata = read_metadata(style)

+            lang = loaded_metadata.language or ""
+            loaded_metadata.language = isoLanguages.get_lang3(lang)
+            if not no_cover_processing:
+                cover_file = _extract_cover(tmp_file_path, original_file_extension, rar_executable)
+            else:
+                cover_file = None
            return BookMeta(
                file_path=tmp_file_path,
                extension=original_file_extension,
-                title=loadedMetadata.title or original_file_name,
-                author=" & ".join([credit["person"] for credit in loadedMetadata.credits if credit["role"] == "Writer"]) or u'Unknown',
-                cover=_extractCover(tmp_file_path, original_file_extension, rarExecutable),
-                description=loadedMetadata.comments or "",
+                title=loaded_metadata.title or original_file_name,
+                author=" & ".join([credit["person"]
+                                   for credit in loaded_metadata.credits if credit["role"] == "Writer"]) or 'Unknown',
+                cover=cover_file,
+                description=loaded_metadata.comments or "",
                tags="",
-                series=loadedMetadata.series or "",
-                series_id=loadedMetadata.issue or "",
-                languages=loadedMetadata.language)
+                series=loaded_metadata.series or "",
+                series_id=loaded_metadata.issue or "",
+                languages=loaded_metadata.language,
+                publisher="",
+                pubdate="",
+                identifiers=[])
+    if not no_cover_processing:
+        cover_file = _extract_cover(tmp_file_path, original_file_extension, rar_executable)
+    else:
+        cover_file = None

    return BookMeta(
        file_path=tmp_file_path,
        extension=original_file_extension,
        title=original_file_name,
-        author=u'Unknown',
-        cover=_extractCover(tmp_file_path, original_file_extension, rarExecutable),
+        author='Unknown',
+        cover=cover_file,
        description="",
        tags="",
        series="",
        series_id="",
-        languages="")
+        languages="",
+        publisher="",
+        pubdate="",
+        identifiers=[])
@@ -16,28 +16,39 @@
 #   You should have received a copy of the GNU General Public License
 #   along with this program. If not, see <http://www.gnu.org/licenses/>.

-
-from __future__ import division, print_function, unicode_literals
 import os
 import sys
+import json

-from sqlalchemy import exc, Column, String, Integer, SmallInteger, Boolean, BLOB, JSON
+from sqlalchemy import Column, String, Integer, SmallInteger, Boolean, BLOB, JSON
 from sqlalchemy.exc import OperationalError
-from sqlalchemy.ext.declarative import declarative_base
-
-from . import constants, cli, logger, ub
+from sqlalchemy.sql.expression import text
+from sqlalchemy import exists
+from cryptography.fernet import Fernet
+import cryptography.exceptions
+from base64 import urlsafe_b64decode
+try:
+    # Compatibility with sqlalchemy 2.0
+    from sqlalchemy.orm import declarative_base
+except ImportError:
+    from sqlalchemy.ext.declarative import declarative_base

+from . import constants, logger
+from .subproc_wrapper import process_wait
+from .string_helper import strip_whitespaces

 log = logger.create()
 _Base = declarative_base()

+
 class _Flask_Settings(_Base):
    __tablename__ = 'flask_settings'

    id = Column(Integer, primary_key=True)
-    flask_session_key = Column(BLOB, default="")
+    flask_session_key = Column(BLOB, default=b"")

    def __init__(self, key):
+        super().__init__()
        self.flask_session_key = key


@@ -51,29 +62,36 @@ class _Settings(_Base):
    mail_port = Column(Integer, default=25)
    mail_use_ssl = Column(SmallInteger, default=0)
    mail_login = Column(String, default='mail@example.com')
-    mail_password = Column(String, default='mypassword')
+    mail_password_e = Column(String)
+    mail_password = Column(String)
    mail_from = Column(String, default='automailer <mail@example.com>')
    mail_size = Column(Integer, default=25*1024*1024)
+    mail_server_type = Column(SmallInteger, default=0)
+    mail_gmail_token = Column(JSON, default={})

    config_calibre_dir = Column(String)
+    config_calibre_uuid = Column(String)
+    config_calibre_split = Column(Boolean, default=False)
+    config_calibre_split_dir = Column(String)
    config_port = Column(Integer, default=constants.DEFAULT_PORT)
    config_external_port = Column(Integer, default=constants.DEFAULT_PORT)
    config_certfile = Column(String)
    config_keyfile = Column(String)
-
-    config_calibre_web_title = Column(String, default=u'Calibre-Web')
+    config_trustedhosts = Column(String, default='')
+    config_calibre_web_title = Column(String, default='Calibre-Web')
    config_books_per_page = Column(Integer, default=60)
    config_random_books = Column(Integer, default=4)
    config_authors_max = Column(Integer, default=0)
    config_read_column = Column(Integer, default=0)
-    config_title_regex = Column(String, default=u'^(A|The|An|Der|Die|Das|Den|Ein|Eine|Einen|Dem|Des|Einem|Eines)\s+')
-    config_mature_content_tags = Column(String, default='')
+    config_title_regex = Column(String,
+                                default=r"^(A|The|An|Der|Die|Das|Den|Ein|Eine"
+                                        r"|Einen|Dem|Des|Einem|Eines|Le|La|Les|L'|Un|Une)(\s+|(?<='))")
    config_theme = Column(Integer, default=0)

    config_log_level = Column(SmallInteger, default=logger.DEFAULT_LOG_LEVEL)
-    config_logfile = Column(String)
+    config_logfile = Column(String, default=logger.DEFAULT_LOG_FILE)
    config_access_log = Column(SmallInteger, default=0)
-    config_access_logfile = Column(String)
+    config_access_logfile = Column(String, default=logger.DEFAULT_ACCESS_LOG)

    config_uploading = Column(SmallInteger, default=0)
    config_anonbrowse = Column(SmallInteger, default=0)
@@ -83,6 +101,8 @@ class _Settings(_Base):

    config_default_role = Column(SmallInteger, default=0)
    config_default_show = Column(SmallInteger, default=constants.ADMIN_USER_SIDEBAR)
+    config_default_language = Column(String(3), default="all")
+    config_default_locale = Column(String(2), default="en")
    config_columns_to_ignore = Column(String)

    config_denied_tags = Column(String, default="")
@@ -97,7 +117,7 @@ class _Settings(_Base):

    config_use_goodreads = Column(Boolean, default=False)
    config_goodreads_api_key = Column(String)
-    config_goodreads_api_secret = Column(String)
+    config_googlebooks_api_key = Column(String, default='')
    config_register_email = Column(Boolean, default=False)
    config_login_type = Column(Integer, default=0)

@@ -107,14 +127,15 @@ class _Settings(_Base):
    config_ldap_port = Column(SmallInteger, default=389)
    config_ldap_authentication = Column(SmallInteger, default=constants.LDAP_AUTH_SIMPLE)
    config_ldap_serv_username = Column(String, default='cn=admin,dc=example,dc=org')
-    config_ldap_serv_password = Column(String, default="")
+    config_ldap_serv_password_e = Column(String)
+    config_ldap_serv_password = Column(String)
    config_ldap_encryption = Column(SmallInteger, default=0)
    config_ldap_cacert_path = Column(String, default="")
    config_ldap_cert_path = Column(String, default="")
    config_ldap_key_path = Column(String, default="")
    config_ldap_dn = Column(String, default='dc=example,dc=org')
    config_ldap_user_object = Column(String, default='uid=%s')
-    config_ldap_member_user_object = Column(String, default='') #
+    config_ldap_member_user_object = Column(String, default='')
    config_ldap_openldap = Column(Boolean, default=True)
    config_ldap_group_object_filter = Column(String, default='(&(objectclass=posixGroup)(cn=%s))')
    config_ldap_group_members_field = Column(String, default='memberUid')
@@ -122,45 +143,74 @@ class _Settings(_Base):

    config_kepubifypath = Column(String, default=None)
    config_converterpath = Column(String, default=None)
+    config_binariesdir = Column(String, default=None)
    config_calibre = Column(String)
    config_rarfile_location = Column(String, default=None)
    config_upload_formats = Column(String, default=','.join(constants.EXTENSIONS_UPLOAD))
+    config_unicode_filename = Column(Boolean, default=False)
+    config_embed_metadata = Column(Boolean, default=True)

    config_updatechannel = Column(Integer, default=constants.UPDATE_STABLE)

    config_reverse_proxy_login_header_name = Column(String)
    config_allow_reverse_proxy_header_login = Column(Boolean, default=False)

+    schedule_start_time = Column(Integer, default=4)
+    schedule_duration = Column(Integer, default=10)
+    schedule_generate_book_covers = Column(Boolean, default=False)
+    schedule_generate_series_covers = Column(Boolean, default=False)
+    schedule_reconnect = Column(Boolean, default=False)
+    schedule_metadata_backup = Column(Boolean, default=False)
+
+    config_password_policy = Column(Boolean, default=True)
+    config_password_min_length = Column(Integer, default=8)
+    config_password_number = Column(Boolean, default=True)
+    config_password_lower = Column(Boolean, default=True)
+    config_password_upper = Column(Boolean, default=True)
+    config_password_character = Column(Boolean, default=True)
+    config_password_special = Column(Boolean, default=True)
+    config_session = Column(Integer, default=1)
+    config_ratelimiter = Column(Boolean, default=True)
+    config_limiter_uri = Column(String, default="")
+    config_limiter_options = Column(String, default="")
+    config_check_extensions = Column(Boolean, default=True)
+
    def __repr__(self):
        return self.__class__.__name__


 # Class holds all application specific settings in calibre-web
-class _ConfigSQL(object):
+class ConfigSQL(object):
    # pylint: disable=no-member
-    def __init__(self, session):
+    def __init__(self):
+        self.__dict__["dirty"] = list()
+
+    def init_config(self, session, secret_key, cli):
        self._session = session
        self._settings = None
        self.db_configured = None
        self.config_calibre_dir = None
+        self._fernet = Fernet(secret_key)
+        self.cli = cli
        self.load()

        change = False
-        if self.config_converterpath == None:
-            change = True
-            self.config_converterpath = autodetect_calibre_binary()

-        if self.config_kepubifypath == None:
+        if self.config_binariesdir is None:
+            change = True
+            self.config_binariesdir = autodetect_calibre_binaries()
+            self.config_converterpath = autodetect_converter_binary(self.config_binariesdir)
+
+        if self.config_kepubifypath is None:
            change = True
            self.config_kepubifypath = autodetect_kepubify_binary()

-        if self.config_rarfile_location == None:
+        if self.config_rarfile_location is None:
            change = True
            self.config_rarfile_location = autodetect_unrar_binary()
        if change:
            self.save()

-
    def _read_from_storage(self):
        if self._settings is None:
            log.debug("_ConfigSQL._read_from_storage")
@@ -168,21 +218,21 @@ class _ConfigSQL(object):
        return self._settings

    def get_config_certfile(self):
-        if cli.certfilepath:
-            return cli.certfilepath
-        if cli.certfilepath == "":
+        if self.cli.certfilepath:
+            return self.cli.certfilepath
+        if self.cli.certfilepath == "":
            return None
        return self.config_certfile

    def get_config_keyfile(self):
-        if cli.keyfilepath:
-            return cli.keyfilepath
-        if cli.certfilepath == "":
+        if self.cli.keyfilepath:
+            return self.cli.keyfilepath
+        if self.cli.certfilepath == "":
            return None
        return self.config_keyfile

    def get_config_ipaddress(self):
-        return cli.ipadress or ""
+        return self.cli.ip_address or ""

    def _has_role(self, role_flag):
        return constants.has_flag(self.config_default_role, role_flag)
@@ -219,39 +269,41 @@ class _ConfigSQL(object):

    def list_denied_tags(self):
        mct = self.config_denied_tags or ""
-        return [t.strip() for t in mct.split(",")]
+        return [strip_whitespaces(t) for t in mct.split(",")]

    def list_allowed_tags(self):
        mct = self.config_allowed_tags or ""
-        return [t.strip() for t in mct.split(",")]
+        return [strip_whitespaces(t) for t in mct.split(",")]

    def list_denied_column_values(self):
        mct = self.config_denied_column_value or ""
-        return [t.strip() for t in mct.split(",")]
+        return [strip_whitespaces(t) for t in mct.split(",")]

    def list_allowed_column_values(self):
        mct = self.config_allowed_column_value or ""
-        return [t.strip() for t in mct.split(",")]
+        return [strip_whitespaces(t) for t in mct.split(",")]

    def get_log_level(self):
        return logger.get_level_name(self.config_log_level)

    def get_mail_settings(self):
-        return {k:v for k, v in self.__dict__.items() if k.startswith('mail_')}
+        return {k: v for k, v in self.__dict__.items() if k.startswith('mail_')}

    def get_mail_server_configured(self):
-        return not bool(self.mail_server == constants.DEFAULT_MAIL_SERVER)
+        return bool((self.mail_server != constants.DEFAULT_MAIL_SERVER and self.mail_server_type == 0)
+                    or (self.mail_gmail_token != {} and self.mail_server_type == 1))

+    def get_scheduled_task_settings(self):
+        return {k: v for k, v in self.__dict__.items() if k.startswith('schedule_')}

    def set_from_dictionary(self, dictionary, field, convertor=None, default=None, encode=None):
-        '''Possibly updates a field of this object.
+        """Possibly updates a field of this object.
        The new value, if present, is grabbed from the given dictionary, and optionally passed through a convertor.

        :returns: `True` if the field has changed value
-        '''
+        """
        new_value = dictionary.get(field, default)
        if new_value is None:
-            # log.debug("_ConfigSQL set_from_dictionary field '%s' not found", field)
            return False

        if field not in self.__dict__:
@@ -268,20 +320,20 @@ class _ConfigSQL(object):
        if current_value == new_value:
            return False

-        # log.debug("_ConfigSQL set_from_dictionary '%s' = %r (was %r)", field, new_value, current_value)
        setattr(self, field, new_value)
        return True

-    def toDict(self):
+    def to_dict(self):
        storage = {}
        for k, v in self.__dict__.items():
-            if k[0] != '_' and not k.endswith("password") and not k.endswith("secret"):
+            if k[0] != '_' and not k.endswith("_e") and not k == "cli" \
+                    and 'api' not in k.lower() and 'token' not in k.lower() \
+                    and 'secret' not in k.lower():
                storage[k] = v
        return storage

-
    def load(self):
-        '''Load all configuration values from the underlying storage.'''
+        """Load all configuration values from the underlying storage."""
        s = self._read_from_storage()  # type: _Settings
        for k, v in s.__dict__.items():
            if k[0] != '_':
@@ -290,35 +342,51 @@ class _ConfigSQL(object):
                    column = s.__class__.__dict__.get(k)
                    if column.default is not None:
                        v = column.default.arg
-                setattr(self, k, v)
+                if k.endswith("_e") and v is not None:
+                    try:
+                        setattr(self, k, self._fernet.decrypt(v).decode())
+                    except cryptography.fernet.InvalidToken:
+                        setattr(self, k, "")
+                else:
+                    setattr(self, k, v)

        have_metadata_db = bool(self.config_calibre_dir)
        if have_metadata_db:
-            if not self.config_use_google_drive:
-                db_file = os.path.join(self.config_calibre_dir, 'metadata.db')
-                have_metadata_db = os.path.isfile(db_file)
+            db_file = os.path.join(self.config_calibre_dir, 'metadata.db')
+            have_metadata_db = os.path.isfile(db_file)
        self.db_configured = have_metadata_db
-        constants.EXTENSIONS_UPLOAD = [x.lstrip().rstrip().lower() for x in self.config_upload_formats.split(',')]
-        logfile = logger.setup(self.config_logfile, self.config_log_level)
-        if logfile != self.config_logfile:
-            log.warning("Log path %s not valid, falling back to default", self.config_logfile)
+        
+        from . import cli_param
+        if os.environ.get('FLASK_DEBUG'):
+            logfile = logger.setup(logger.LOG_TO_STDOUT, logger.logging.DEBUG)
+        else:
+            # pylint: disable=access-member-before-definition
+            logfile = logger.setup(cli_param.logpath or self.config_logfile, self.config_log_level)
+        if logfile != os.path.abspath(self.config_logfile):
+            if logfile != os.path.abspath(cli_param.logpath):
+                log.warning("Log path %s not valid, falling back to default", self.config_logfile)
            self.config_logfile = logfile
+            s.config_logfile = logfile
            self._session.merge(s)
            try:
                self._session.commit()
            except OperationalError as e:
                log.error('Database error: %s', e)
                self._session.rollback()
+        self.__dict__["dirty"] = list()

    def save(self):
-        '''Apply all configuration values to the underlying storage.'''
+        """Apply all configuration values to the underlying storage."""
        s = self._read_from_storage()  # type: _Settings

-        for k, v in self.__dict__.items():
+        for k in self.dirty:
            if k[0] == '_':
                continue
            if hasattr(s, k):
-                setattr(s, k, v)
+                if k.endswith("_e"):
+                    setattr(s, k, self._fernet.encrypt(self.__dict__[k].encode()))
+                else:
+                    setattr(s, k, self.__dict__[k])

        log.debug("_ConfigSQL updating storage")
        self._session.merge(s)
@@ -334,37 +402,78 @@ class _ConfigSQL(object):
            log.error(error)
        log.warning("invalidating configuration")
        self.db_configured = False
-        self.config_calibre_dir = None
        self.save()

+    def get_book_path(self):
+        return self.config_calibre_split_dir if self.config_calibre_split else self.config_calibre_dir

-def _migrate_table(session, orm_class):
+    def store_calibre_uuid(self, calibre_db, Library_table):
+        from . import app
+        try:
+            with app.app_context():
+                calibre_uuid = calibre_db.session.query(Library_table).one_or_none()
+                if self.config_calibre_uuid != calibre_uuid.uuid:
+                    self.config_calibre_uuid = calibre_uuid.uuid
+                    self.save()
+        except AttributeError:
+            pass
+
+    def __setattr__(self, attr_name, attr_value):
+        super().__setattr__(attr_name, attr_value)
+        self.__dict__["dirty"].append(attr_name)
+
+
+def _encrypt_fields(session, secret_key):
+    try:
+        session.query(exists().where(_Settings.mail_password_e)).scalar()
+    except OperationalError:
+        with session.bind.connect() as conn:
+            conn.execute(text("ALTER TABLE settings ADD column 'mail_password_e' String"))
+            conn.execute(text("ALTER TABLE settings ADD column 'config_ldap_serv_password_e' String"))
+        session.commit()
+        crypter = Fernet(secret_key)
+        settings = session.query(_Settings.mail_password, _Settings.config_ldap_serv_password).first()
+        if settings.mail_password:
+            session.query(_Settings).update(
+                {_Settings.mail_password_e: crypter.encrypt(settings.mail_password.encode())})
+        if settings.config_ldap_serv_password:
+            session.query(_Settings).update(
+                {_Settings.config_ldap_serv_password_e: crypter.encrypt(settings.config_ldap_serv_password.encode())})
+        session.commit()
+
+
+def _migrate_table(session, orm_class, secret_key=None):
+    if secret_key:
+        _encrypt_fields(session, secret_key)
    changed = False

    for column_name, column in orm_class.__dict__.items():
        if column_name[0] != '_':
            try:
                session.query(column).first()
-            except exc.OperationalError as err:
+            except OperationalError as err:
                log.debug("%s: %s", column_name, err.args[0])
-                if column.default is not None:
-                    if sys.version_info < (3, 0):
-                        if isinstance(column.default.arg, unicode):
-                            column.default.arg = column.default.arg.encode('utf-8')
                if column.default is None:
                    column_default = ""
                else:
                    if isinstance(column.default.arg, bool):
-                        column_default = ("DEFAULT %r" % int(column.default.arg))
+                        column_default = "DEFAULT {}".format(int(column.default.arg))
                    else:
-                        column_default = ("DEFAULT %r" % column.default.arg)
-                alter_table = "ALTER TABLE %s ADD COLUMN `%s` %s %s" % (orm_class.__tablename__,
-                                                                        column_name,
-                                                                        column.type,
-                                                                        column_default)
+                        column_default = "DEFAULT `{}`".format(column.default.arg)
+                if isinstance(column.type, JSON):
+                    column_type = "JSON"
+                else:
+                    column_type = column.type
+                alter_table = text("ALTER TABLE %s ADD COLUMN `%s` %s %s" % (orm_class.__tablename__,
+                                                                             column_name,
+                                                                             column_type,
+                                                                             column_default))
                log.debug(alter_table)
                session.execute(alter_table)
                changed = True
+            except json.decoder.JSONDecodeError as e:
+                log.error("Database corrupt column: {}".format(column_name))
+                log.debug(e)

    if changed:
        try:
@@ -373,23 +482,46 @@ def _migrate_table(session, orm_class):
            session.rollback()


-def autodetect_calibre_binary():
+def autodetect_calibre_binaries():
    if sys.platform == "win32":
-        calibre_path = ["C:\\program files\\calibre\\ebook-convert.exe",
-                        "C:\\program files(x86)\\calibre\\ebook-convert.exe",
-                        "C:\\program files(x86)\\calibre2\\ebook-convert.exe",
-                        "C:\\program files\\calibre2\\ebook-convert.exe"]
+        calibre_path = ["C:\\program files\\calibre\\",
+                        "C:\\program files(x86)\\calibre\\",
+                        "C:\\program files(x86)\\calibre2\\",
+                        "C:\\program files\\calibre2\\"]
+    elif sys.platform.startswith("freebsd"):
+        calibre_path = ["/usr/local/bin/"]
    else:
-        calibre_path = ["/opt/calibre/ebook-convert"]
+        calibre_path = ["/opt/calibre/"]
    for element in calibre_path:
-        if os.path.isfile(element) and os.access(element, os.X_OK):
-            return element
+        supported_binary_paths = [os.path.join(element, binary)
+                                  for binary in constants.SUPPORTED_CALIBRE_BINARIES.values()]
+        if all(os.path.isfile(binary_path) and os.access(binary_path, os.X_OK)
+               for binary_path in supported_binary_paths):
+            values = [process_wait([binary_path, "--version"],
+                                   pattern=r'\(calibre (.*)\)') for binary_path in supported_binary_paths]
+            if all(values):
+                version = values[0].group(1)
+                log.debug("calibre version %s", version)
+                return element 
    return ""

+
+def autodetect_converter_binary(calibre_path):
+    if sys.platform == "win32":
+        converter_path = os.path.join(calibre_path, "ebook-convert.exe")
+    else:
+        converter_path = os.path.join(calibre_path, "ebook-convert")
+    if calibre_path and os.path.isfile(converter_path) and os.access(converter_path, os.X_OK):
+        return converter_path
+    return ""
+
+
 def autodetect_unrar_binary():
    if sys.platform == "win32":
        calibre_path = ["C:\\program files\\WinRar\\unRAR.exe",
                        "C:\\program files(x86)\\WinRar\\unRAR.exe"]
+    elif sys.platform.startswith("freebsd"):
+        calibre_path = ["/usr/local/bin/unrar"]
    else:
        calibre_path = ["/usr/bin/unrar"]
    for element in calibre_path:
@@ -397,10 +529,13 @@ def autodetect_unrar_binary():
            return element
    return ""

+
 def autodetect_kepubify_binary():
    if sys.platform == "win32":
        calibre_path = ["C:\\program files\\kepubify\\kepubify-windows-64Bit.exe",
                        "C:\\program files(x86)\\kepubify\\kepubify-windows-64Bit.exe"]
+    elif sys.platform.startswith("freebsd"):
+        calibre_path = ["/usr/local/bin/kepubify"]
    else:
        calibre_path = ["/opt/kepubify/kepubify-linux-64bit", "/opt/kepubify/kepubify-linux-32bit"]
    for element in calibre_path:
@@ -408,33 +543,49 @@ def autodetect_kepubify_binary():
            return element
    return ""

-def _migrate_database(session):
+
+def _migrate_database(session, secret_key):
    # make sure the table is created, if it does not exist
    _Base.metadata.create_all(session.bind)
-    _migrate_table(session, _Settings)
+    _migrate_table(session, _Settings, secret_key)
    _migrate_table(session, _Flask_Settings)


-def load_configuration(session):
-    _migrate_database(session)
-
+def load_configuration(session, secret_key):
+    _migrate_database(session, secret_key)
    if not session.query(_Settings).count():
        session.add(_Settings())
        session.commit()
-    conf = _ConfigSQL(session)
-    # Migrate from global restrictions to user based restrictions
-    if bool(conf.config_default_show & constants.MATURE_CONTENT) and conf.config_denied_tags == "":
-        conf.config_denied_tags = conf.config_mature_content_tags
-        conf.save()
-        session.query(ub.User).filter(ub.User.mature_content != True). \
-            update({"denied_tags": conf.config_mature_content_tags}, synchronize_session=False)
-        session.commit()
-    return conf

-def get_flask_session_key(session):
-    flask_settings = session.query(_Flask_Settings).one_or_none()
-    if flask_settings == None:
+
+def get_flask_session_key(_session):
+    flask_settings = _session.query(_Flask_Settings).one_or_none()
+    if flask_settings is None:
        flask_settings = _Flask_Settings(os.urandom(32))
-        session.add(flask_settings)
-        session.commit()
+        _session.add(flask_settings)
+        _session.commit()
    return flask_settings.flask_session_key
+
+
+def get_encryption_key(key_path):
+    key_file = os.path.join(key_path, ".key")
+    generate = True
+    error = ""
+    key = None
+    if os.path.exists(key_file) and os.path.getsize(key_file) > 32:
+        with open(key_file, "rb") as f:
+            key = f.read()
+        try:
+            urlsafe_b64decode(key)
+            generate = False
+        except ValueError:
+            pass
+    if generate:
+        key = Fernet.generate_key()
+        try:
+            with open(key_file, "wb") as f:
+                f.write(key)
+            os.chmod(key_file, 0o600)
+        except PermissionError as e:
+            error = e
+    return key, error
@@ -16,33 +16,48 @@
 #   You should have received a copy of the GNU General Public License
 #   along with this program. If not, see <http://www.gnu.org/licenses/>.

-from __future__ import division, print_function, unicode_literals
 import sys
 import os
 from collections import namedtuple

-HOME_CONFIG = False
+# APP_MODE - production, development, or test
+APP_MODE             = os.environ.get('APP_MODE', 'production')
+
+# if installed via pip this variable is set to true (empty file with name .HOMEDIR present)
+HOME_CONFIG = os.path.isfile(os.path.join(os.path.dirname(os.path.abspath(__file__)), '.HOMEDIR'))
+
+# In executables updater is not available, so variable is set to False there
+UPDATER_AVAILABLE = True

 # Base dir is parent of current file, necessary if called from different folder
-if sys.version_info < (3, 0):
-    BASE_DIR            = os.path.abspath(os.path.join(
-        os.path.dirname(os.path.abspath(__file__)),os.pardir)).decode('utf-8')
-else:
-    BASE_DIR            = os.path.abspath(os.path.join(
-        os.path.dirname(os.path.abspath(__file__)),os.pardir))
+BASE_DIR            = os.path.abspath(os.path.join(os.path.dirname(os.path.abspath(__file__)), os.pardir))
+# if executable file the files should be placed in the parent dir (parallel to the exe file)
+
 STATIC_DIR          = os.path.join(BASE_DIR, 'cps', 'static')
 TEMPLATES_DIR       = os.path.join(BASE_DIR, 'cps', 'templates')
 TRANSLATIONS_DIR    = os.path.join(BASE_DIR, 'cps', 'translations')

+# Cache dir - use CACHE_DIRECTORY environment variable, otherwise CACHE_DIR (for backwards compatibility),
+# otherwise use the default directory: cps/cache
+DEFAULT_CACHE_DIR   = os.path.join(BASE_DIR, 'cps', 'cache')
+CACHE_DIRECTORY = os.environ.get(
+    'CACHE_DIRECTORY', os.environ.get('CACHE_DIR', DEFAULT_CACHE_DIR)
+)
+
 if HOME_CONFIG:
-    home_dir = os.path.join(os.path.expanduser("~"),".calibre-web")
+    home_dir = os.path.join(os.path.expanduser("~"), ".calibre-web")
    if not os.path.exists(home_dir):
        os.makedirs(home_dir)
    CONFIG_DIR = os.environ.get('CALIBRE_DBPATH', home_dir)
 else:
-    CONFIG_DIR      = os.environ.get('CALIBRE_DBPATH', BASE_DIR)
+    CONFIG_DIR = os.environ.get('CALIBRE_DBPATH', BASE_DIR)
+    if getattr(sys, 'frozen', False):
+        CONFIG_DIR = os.path.abspath(os.path.join(CONFIG_DIR, os.pardir))


+DEFAULT_SETTINGS_FILE = "app.db"
+DEFAULT_GDRIVE_FILE = "gdrive.db"
+
 ROLE_USER               = 0 << 0
 ROLE_ADMIN              = 1 << 0
 ROLE_DOWNLOAD           = 1 << 1
@@ -84,6 +99,26 @@ SIDEBAR_ARCHIVED        = 1 << 15
 SIDEBAR_DOWNLOAD        = 1 << 16
 SIDEBAR_LIST            = 1 << 17

+sidebar_settings = {
+                "detail_random": DETAIL_RANDOM,
+                "sidebar_language": SIDEBAR_LANGUAGE,
+                "sidebar_series": SIDEBAR_SERIES,
+                "sidebar_category": SIDEBAR_CATEGORY,
+                "sidebar_random": SIDEBAR_RANDOM,
+                "sidebar_author": SIDEBAR_AUTHOR,
+                "sidebar_best_rated": SIDEBAR_BEST_RATED,
+                "sidebar_read_and_unread": SIDEBAR_READ_AND_UNREAD,
+                "sidebar_recent": SIDEBAR_RECENT,
+                "sidebar_sorted": SIDEBAR_SORTED,
+                "sidebar_publisher": SIDEBAR_PUBLISHER,
+                "sidebar_rating": SIDEBAR_RATING,
+                "sidebar_format": SIDEBAR_FORMAT,
+                "sidebar_archived": SIDEBAR_ARCHIVED,
+                "sidebar_download": SIDEBAR_DOWNLOAD,
+                "sidebar_list": SIDEBAR_LIST,
+            }
+
+
 ADMIN_USER_ROLES        = sum(r for r in ALL_ROLES.values()) & ~ROLE_ANONYMOUS
 ADMIN_USER_SIDEBAR      = (SIDEBAR_LIST << 1) - 1

@@ -102,7 +137,7 @@ LDAP_AUTH_SIMPLE         = 0

 DEFAULT_MAIL_SERVER = "mail.example.org"

-DEFAULT_PASSWORD    = "admin123"
+DEFAULT_PASSWORD    = "admin123"  # nosec
 DEFAULT_PORT        = 8083
 env_CALIBRE_PORT = os.environ.get("CALIBRE_PORT", DEFAULT_PORT)
 try:
@@ -112,32 +147,53 @@ except ValueError:
 del env_CALIBRE_PORT


-EXTENSIONS_AUDIO    = {'mp3', 'mp4', 'ogg', 'opus', 'wav', 'flac', 'm4a', 'm4b'}
-EXTENSIONS_CONVERT_FROM  = ['pdf', 'epub', 'mobi', 'azw3', 'docx', 'rtf', 'fb2', 'lit', 'lrf', 'txt', 'htmlz', 'rtf', 'odt','cbz','cbr']
-EXTENSIONS_CONVERT_TO  = ['pdf', 'epub', 'mobi', 'azw3', 'docx', 'rtf', 'fb2', 'lit', 'lrf', 'txt', 'htmlz', 'rtf', 'odt']
-EXTENSIONS_UPLOAD   = {'txt', 'pdf', 'epub', 'kepub', 'mobi', 'azw', 'azw3', 'cbr', 'cbz', 'cbt', 'djvu', 'prc', 'doc', 'docx',
-                       'fb2', 'html', 'rtf', 'lit', 'odt', 'mp3', 'mp4', 'ogg', 'opus', 'wav', 'flac', 'm4a', 'm4b'}
+EXTENSIONS_AUDIO = {'mp3', 'mp4', 'ogg', 'opus', 'wav', 'flac', 'm4a', 'm4b'}
+EXTENSIONS_CONVERT_FROM = ['pdf', 'epub', 'mobi', 'azw3', 'docx', 'rtf', 'fb2', 'lit', 'lrf',
+                           'txt', 'htmlz', 'rtf', 'odt', 'cbz', 'cbr', 'prc']
+EXTENSIONS_CONVERT_TO = ['pdf', 'epub', 'mobi', 'azw3', 'docx', 'rtf', 'fb2',
+                         'lit', 'lrf', 'txt', 'htmlz', 'rtf', 'odt']
+EXTENSIONS_UPLOAD = {'txt', 'pdf', 'epub', 'kepub', 'mobi', 'azw', 'azw3', 'cbr', 'cbz', 'cbt', 'cb7', 'djvu', 'djv',
+                     'prc', 'doc', 'docx', 'fb2', 'html', 'rtf', 'lit', 'odt', 'mp3', 'mp4', 'ogg',
+                     'opus', 'wav', 'flac', 'm4a', 'm4b'}
+
+_extension = ""
+if sys.platform == "win32":
+    _extension = ".exe"
+SUPPORTED_CALIBRE_BINARIES = {binary: binary + _extension for binary in ["ebook-convert", "calibredb"]}


 def has_flag(value, bit_flag):
    return bit_flag == (bit_flag & (value or 0))

+
 def selected_roles(dictionary):
    return sum(v for k, v in ALL_ROLES.items() if k in dictionary)


 # :rtype: BookMeta
 BookMeta = namedtuple('BookMeta', 'file_path, extension, title, author, cover, description, tags, series, '
-                                  'series_id, languages')
+                                  'series_id, languages, publisher, pubdate, identifiers')

-STABLE_VERSION = {'version': '0.6.10'}
+# python build process likes to have x.y.zbw -> b for beta and w a counting number
+STABLE_VERSION =  '0.6.27b'

-NIGHTLY_VERSION = {}
+NIGHTLY_VERSION = dict()
 NIGHTLY_VERSION[0] = '$Format:%H$'
 NIGHTLY_VERSION[1] = '$Format:%cI$'
-# NIGHTLY_VERSION[0] = 'bb7d2c6273ae4560e83950d36d64533343623a57'
-# NIGHTLY_VERSION[1] = '2018-09-09T10:13:08+02:00'

+# CACHE
+CACHE_TYPE_THUMBNAILS    = 'thumbnails'
+
+# Thumbnail Types
+THUMBNAIL_TYPE_COVER     = 1
+THUMBNAIL_TYPE_SERIES    = 2
+THUMBNAIL_TYPE_AUTHOR    = 3
+
+# Thumbnails Sizes
+COVER_THUMBNAIL_ORIGINAL = 0
+COVER_THUMBNAIL_SMALL    = 1
+COVER_THUMBNAIL_MEDIUM   = 2
+COVER_THUMBNAIL_LARGE    = 4

 # clean-up the module namespace
 del sys, os, namedtuple
@@ -16,10 +16,10 @@
 #  You should have received a copy of the GNU General Public License
 #  along with this program. If not, see <http://www.gnu.org/licenses/>.

-from __future__ import division, print_function, unicode_literals
 import os
 import re
-from flask_babel import gettext as _
+
+from flask_babel import lazy_gettext as N_

 from . import config, logger
 from .subproc_wrapper import process_wait
@@ -27,10 +27,9 @@ from .subproc_wrapper import process_wait

 log = logger.create()

-# _() necessary to make babel aware of string for translation
-_NOT_CONFIGURED = _('not configured')
-_NOT_INSTALLED = _('not installed')
-_EXECUTION_ERROR = _('Execution permissions missing')
+# strings getting translated when used
+_NOT_INSTALLED = N_('not installed')
+_EXECUTION_ERROR = N_('Execution permissions missing')


 def _get_command_version(path, pattern, argument=None):
@@ -39,9 +38,9 @@ def _get_command_version(path, pattern, argument=None):
        if argument:
            command.append(argument)
        try:
-            for line in process_wait(command):
-                if re.search(pattern, line):
-                    return line
+            match = process_wait(command, pattern=pattern)
+            if isinstance(match, re.Match):
+                return match.string
        except Exception as ex:
            log.warning("%s: %s", path, ex)
            return _EXECUTION_ERROR
@@ -49,14 +48,15 @@ def _get_command_version(path, pattern, argument=None):


 def get_calibre_version():
-    return _get_command_version(config.config_converterpath, r'ebook-convert.*\(calibre', '--version') \
-           or _NOT_CONFIGURED
+    return _get_command_version(config.config_converterpath, r'ebook-convert.*\(calibre', '--version')


 def get_unrar_version():
-    return _get_command_version(config.config_rarfile_location, r'UNRAR.*\d') or _NOT_CONFIGURED
+    unrar_version = _get_command_version(config.config_rarfile_location, r'UNRAR.*\d')
+    if unrar_version == "not installed":
+        unrar_version = _get_command_version(config.config_rarfile_location, r'unrar.*\d', '-V')
+    return unrar_version
+

 def get_kepubify_version():
-    return _get_command_version(config.config_kepubifypath, r'kepubify\s','--version') or _NOT_CONFIGURED
-
-
+    return _get_command_version(config.config_kepubifypath, r'kepubify\s', '--version')
@@ -0,0 +1,49 @@
+# -*- coding: utf-8 -*-
+
+#   This file is part of the Calibre-Web (https://github.com/janeczku/calibre-web)
+#     Copyright (C) 2022 OzzieIsaacs
+#
+#   This program is free software: you can redistribute it and/or modify
+#   it under the terms of the GNU General Public License as published by
+#   the Free Software Foundation, either version 3 of the License, or
+#   (at your option) any later version.
+#
+#   This program is distributed in the hope that it will be useful,
+#   but WITHOUT ANY WARRANTY; without even the implied warranty of
+#   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+#   GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public License
+#   along with this program. If not, see <http://www.gnu.org/licenses/>.
+
+import os
+
+try:
+    from wand.image import Image
+    use_IM = True
+except (ImportError, RuntimeError) as e:
+    use_IM = False
+
+
+NO_JPEG_EXTENSIONS = ['.png', '.webp', '.bmp']
+COVER_EXTENSIONS = ['.png', '.webp', '.bmp', '.jpg', '.jpeg']
+
+
+def cover_processing(tmp_file_path, img, extension):
+    # tmp_cover_name = os.path.join(os.path.dirname(tmp_file_name), 'cover.jpg')
+    tmp_cover_name = tmp_file_path + '.jpg'
+    if extension in NO_JPEG_EXTENSIONS:
+        if use_IM:
+            with Image(blob=img) as imgc:
+                imgc.format = 'jpeg'
+                imgc.transform_colorspace('srgb')
+                imgc.save(filename=tmp_cover_name)
+                return tmp_cover_name
+        else:
+            return None
+    if img:
+        with open(tmp_cover_name, 'wb') as f:
+            f.write(img)
+        return tmp_cover_name
+    else:
+        return None
@@ -0,0 +1,22 @@
+#
+# Copyright 2015 Jordan Milne
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# Source: https://github.com/JordanMilne/Advocate
+
+
+from .adapters import ValidatingHTTPAdapter
+from .api import *
+from .addrvalidator import AddrValidator
+from .exceptions import UnacceptableAddressException
@@ -0,0 +1,48 @@
+#
+# Copyright 2015 Jordan Milne
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# Source: https://github.com/JordanMilne/Advocate
+
+from requests.adapters import HTTPAdapter, DEFAULT_POOLBLOCK
+
+from .addrvalidator import AddrValidator
+from .exceptions import ProxyDisabledException
+from .poolmanager import ValidatingPoolManager
+
+
+class ValidatingHTTPAdapter(HTTPAdapter):
+    __attrs__ = HTTPAdapter.__attrs__ + ['_validator']
+
+    def __init__(self, *args, **kwargs):
+        self._validator = kwargs.pop('validator', None)
+        if not self._validator:
+            self._validator = AddrValidator()
+        super().__init__(*args, **kwargs)
+
+    def init_poolmanager(self, connections, maxsize, block=DEFAULT_POOLBLOCK,
+                         **pool_kwargs):
+        self._pool_connections = connections
+        self._pool_maxsize = maxsize
+        self._pool_block = block
+        self.poolmanager = ValidatingPoolManager(
+            num_pools=connections,
+            maxsize=maxsize,
+            block=block,
+            validator=self._validator,
+            **pool_kwargs
+        )
+
+    def proxy_manager_for(self, proxy, **proxy_kwargs):
+        raise ProxyDisabledException("Proxies cannot be used with Advocate")
@@ -0,0 +1,281 @@
+#
+# Copyright 2015 Jordan Milne
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# Source: https://github.com/JordanMilne/Advocate
+
+import functools
+import fnmatch
+import ipaddress
+import re
+
+try:
+    import netifaces
+    HAVE_NETIFACES = True
+except ImportError:
+    netifaces = None
+    HAVE_NETIFACES = False
+
+from .exceptions import NameserverException, ConfigException
+
+
+def canonicalize_hostname(hostname):
+    """Lowercase and punycodify a hostname"""
+    # We do the lowercasing after IDNA encoding because we only want to
+    # lowercase the *ASCII* chars.
+    # TODO: The differences between IDNA2003 and IDNA2008 might be relevant
+    # to us, but both specs are damn confusing.
+    return str(hostname.encode("idna").lower(), 'utf-8')
+
+
+def determine_local_addresses():
+    """Get all IPs that refer to this machine according to netifaces"""
+    if not HAVE_NETIFACES:
+        raise ConfigException("Tried to determine local addresses, "
+                              "but netifaces module was not importable")
+    ips = []
+    for interface in netifaces.interfaces():
+        if_families = netifaces.ifaddresses(interface)
+        for family_kind in {netifaces.AF_INET, netifaces.AF_INET6}:
+            addrs = if_families.get(family_kind, [])
+            for addr in (x.get("addr", "") for x in addrs):
+                if family_kind == netifaces.AF_INET6:
+                    # We can't do anything sensible with the scope here
+                    addr = addr.split("%")[0]
+                ips.append(ipaddress.ip_network(addr))
+    return ips
+
+
+def add_local_address_arg(func):
+    """Add the "_local_addresses" kwarg if it's missing
+
+    IMO this information shouldn't be cached between calls (what if one of the
+    adapters got a new IP at runtime?,) and we don't want each function to
+    recalculate it. Just recalculate it if the caller didn't provide it for us.
+    """
+    @functools.wraps(func)
+    def wrapper(self, *args, **kwargs):
+        if "_local_addresses" not in kwargs:
+            if self.autodetect_local_addresses:
+                kwargs["_local_addresses"] = determine_local_addresses()
+            else:
+                kwargs["_local_addresses"] = []
+        return func(self, *args, **kwargs)
+    return wrapper
+
+
+class AddrValidator:
+    _6TO4_RELAY_NET = ipaddress.ip_network("192.88.99.0/24")
+    # Just the well known prefix, DNS64 servers can set their own
+    # prefix, but in practice most probably don't.
+    _DNS64_WK_PREFIX = ipaddress.ip_network("64:ff9b::/96")
+    DEFAULT_PORT_WHITELIST = {80, 8080, 443, 8443, 8000}
+
+    def __init__(
+            self,
+            ip_blacklist=None,
+            ip_whitelist=None,
+            port_whitelist=None,
+            port_blacklist=None,
+            hostname_blacklist=None,
+            allow_ipv6=False,
+            allow_teredo=False,
+            allow_6to4=False,
+            allow_dns64=False,
+            # Must be explicitly set to "False" if you don't want to try
+            # detecting local interface addresses with netifaces.
+            autodetect_local_addresses=True,
+    ):
+        if not port_blacklist and not port_whitelist:
+            # An assortment of common HTTPS? ports.
+            port_whitelist = self.DEFAULT_PORT_WHITELIST.copy()
+        self.ip_blacklist = ip_blacklist or set()
+        self.ip_whitelist = ip_whitelist or set()
+        self.port_blacklist = port_blacklist or set()
+        self.port_whitelist = port_whitelist or set()
+        # TODO: ATM this can contain either regexes or globs that are converted
+        # to regexes upon every check. Create a collection that automagically
+        # converts them to regexes on insert?
+        self.hostname_blacklist = hostname_blacklist or set()
+        self.allow_ipv6 = allow_ipv6
+        self.allow_teredo = allow_teredo
+        self.allow_6to4 = allow_6to4
+        self.allow_dns64 = allow_dns64
+        self.autodetect_local_addresses = autodetect_local_addresses
+
+    @add_local_address_arg
+    def is_ip_allowed(self, addr_ip, _local_addresses=None):
+        if not isinstance(addr_ip,
+                          (ipaddress.IPv4Address, ipaddress.IPv6Address)):
+            addr_ip = ipaddress.ip_address(addr_ip)
+
+        # The whitelist should take precedence over the blacklist so we can
+        # punch holes in blacklisted ranges
+        if any(addr_ip in net for net in self.ip_whitelist):
+            return True
+
+        if any(addr_ip in net for net in self.ip_blacklist):
+            return False
+
+        if any(addr_ip in net for net in _local_addresses):
+            return False
+
+        if addr_ip.version == 4:
+            if not addr_ip.is_private:
+                # IPs for carrier-grade NAT. Seems weird that it doesn't set
+                # `is_private`, but we need to check `not is_global`
+                if not ipaddress.ip_network(addr_ip).is_global:
+                    return False
+        elif addr_ip.version == 6:
+            # You'd better have a good reason for enabling IPv6
+            # because Advocate's techniques don't work well without NAT.
+            if not self.allow_ipv6:
+                return False
+
+            # v6 addresses can also map to IPv4 addresses! Tricky!
+            v4_nested = []
+            if addr_ip.ipv4_mapped:
+                v4_nested.append(addr_ip.ipv4_mapped)
+            # WTF IPv6? Why you gotta have a billion tunneling mechanisms?
+            # XXX: Do we even really care about these? If we're tunneling
+            # through public servers we shouldn't be able to access
+            # addresses on our private network, right?
+            if addr_ip.sixtofour:
+                if not self.allow_6to4:
+                    return False
+                v4_nested.append(addr_ip.sixtofour)
+            if addr_ip.teredo:
+                if not self.allow_teredo:
+                    return False
+                # Check both the client *and* server IPs
+                v4_nested.extend(addr_ip.teredo)
+            if addr_ip in self._DNS64_WK_PREFIX:
+                if not self.allow_dns64:
+                    return False
+                # When using the well-known prefix the last 4 bytes
+                # are the IPv4 addr
+                v4_nested.append(ipaddress.ip_address(addr_ip.packed[-4:]))
+
+            if not all(self.is_ip_allowed(addr_v4) for addr_v4 in v4_nested):
+                return False
+
+            # fec0::*, apparently deprecated?
+            if addr_ip.is_site_local:
+                return False
+        else:
+            raise ValueError("Unsupported IP version(?): %r" % addr_ip)
+
+        # 169.254.XXX.XXX, AWS uses these for autoconfiguration
+        if addr_ip.is_link_local:
+            return False
+        # 127.0.0.1, ::1, etc.
+        if addr_ip.is_loopback:
+            return False
+        if addr_ip.is_multicast:
+            return False
+        # 192.168.XXX.XXX, 10.XXX.XXX.XXX
+        if addr_ip.is_private:
+            return False
+        # 255.255.255.255, ::ffff:XXXX:XXXX (v6->v4) mapping
+        if addr_ip.is_reserved:
+            return False
+        # There's no reason to connect directly to a 6to4 relay
+        if addr_ip in self._6TO4_RELAY_NET:
+            return False
+        # 0.0.0.0
+        if addr_ip.is_unspecified:
+            return False
+
+        # It doesn't look bad, so... it's must be ok!
+        return True
+
+    def _hostname_matches_pattern(self, hostname, pattern):
+        # If they specified a string, just assume they only want basic globbing.
+        # This stops people from not realizing they're dealing in REs and
+        # not escaping their periods unless they specifically pass in an RE.
+        # This has the added benefit of letting us sanely handle globbed
+        # IDNs by default.
+        if isinstance(pattern, str):
+            # convert the glob to a punycode glob, then a regex
+            pattern = fnmatch.translate(canonicalize_hostname(pattern))
+
+        hostname = canonicalize_hostname(hostname)
+        # Down the line the hostname may get treated as a null-terminated string
+        # (as with `socket.getaddrinfo`.) Try to account for that.
+        #
+        #    >>> socket.getaddrinfo("example.com\x00aaaa", 80)
+        #    [(2, 1, 6, '', ('93.184.216.34', 80)), [...]
+        no_null_hostname = hostname.split("\x00")[0]
+
+        return any(re.match(pattern, x.strip(".")) for x
+                   in (no_null_hostname, hostname))
+
+    def is_hostname_allowed(self, hostname):
+        # Sometimes (like with "external" services that your IP has privileged
+        # access to) you might not always know the IP range to blacklist access
+        # to, or the `A` record might change without you noticing.
+        # For e.x.: `foocorp.external.org`.
+        #
+        # Another option is doing something like:
+        #
+        #     for addrinfo in socket.getaddrinfo("foocorp.external.org", 80):
+        #         global_validator.ip_blacklist.add(ip_address(addrinfo[4][0]))
+        #
+        # but that's not always a good idea if they're behind a third-party lb.
+        for pattern in self.hostname_blacklist:
+            if self._hostname_matches_pattern(hostname, pattern):
+                return False
+        return True
+
+    @add_local_address_arg
+    def is_addrinfo_allowed(self, addrinfo, _local_addresses=None):
+        assert(len(addrinfo) == 5)
+        # XXX: Do we care about any of the other elements? Guessing not.
+        family, socktype, proto, canonname, sockaddr = addrinfo
+
+        # The 4th elem inaddrinfo may either be a touple of two or four items,
+        # depending on whether we're dealing with IPv4 or v6
+        if len(sockaddr) == 2:
+            # v4
+            ip, port = sockaddr
+        elif len(sockaddr) == 4:
+            # v6
+            # XXX: what *are* `flow_info` and `scope_id`? Anything useful?
+            # Seems like we can figure out all we need about the scope from
+            # the `is_<x>` properties.
+            ip, port, flow_info, scope_id = sockaddr
+        else:
+            raise ValueError("Unexpected addrinfo format %r" % sockaddr)
+
+        # Probably won't help protect against SSRF, but might prevent our being
+        # used to attack others' non-HTTP services. See
+        # http://www.remote.org/jochen/sec/hfpa/
+        if self.port_whitelist and port not in self.port_whitelist:
+            return False
+        if port in self.port_blacklist:
+            return False
+
+        if self.hostname_blacklist:
+            if not canonname:
+                raise NameserverException(
+                    "addrinfo must contain the canon name to do blacklisting "
+                    "based on hostname. Make sure you use the "
+                    "`socket.AI_CANONNAME` flag, and that each record contains "
+                    "the canon name. Your DNS server might also be garbage."
+                )
+
+            if not self.is_hostname_allowed(canonname):
+                return False
+
+        return self.is_ip_allowed(ip, _local_addresses=_local_addresses)
@@ -0,0 +1,202 @@
+#
+# Copyright 2015 Jordan Milne
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# Source: https://github.com/JordanMilne/Advocate
+
+"""
+advocate.api
+~~~~~~~~~~~~
+
+This module implements the Requests API, largely a copy/paste from `requests`
+itself.
+
+:copyright: (c) 2015 by Jordan Milne.
+:license: Apache2, see LICENSE for more details.
+
+"""
+from collections import OrderedDict
+import hashlib
+import pickle
+
+from requests import Session as RequestsSession
+
+# import cw_advocate
+from .adapters import ValidatingHTTPAdapter
+from .exceptions import MountDisabledException
+
+
+class Session(RequestsSession):
+    """Convenience wrapper around `requests.Session` set up for `advocate`ing"""
+
+    __attrs__ = RequestsSession.__attrs__ + ["validator"]
+    DEFAULT_VALIDATOR = None
+    """
+    User-replaceable default validator to use for all Advocate sessions,
+    includes sessions created by advocate.get()
+    """
+
+    def __init__(self, *args, **kwargs):
+        self.validator = kwargs.pop("validator", None) or self.DEFAULT_VALIDATOR
+        adapter_kwargs = kwargs.pop("_adapter_kwargs", {})
+
+        # `Session.__init__()` calls `mount()` internally, so we need to allow
+        # it temporarily
+        self.__mount_allowed = True
+        RequestsSession.__init__(self, *args, **kwargs)
+
+        # Drop any existing adapters
+        self.adapters = OrderedDict()
+
+        self.mount("http://", ValidatingHTTPAdapter(validator=self.validator, **adapter_kwargs))
+        self.mount("https://", ValidatingHTTPAdapter(validator=self.validator, **adapter_kwargs))
+        self.__mount_allowed = False
+
+    def mount(self, *args, **kwargs):
+        """Wrapper around `mount()` to prevent a protection bypass"""
+        if self.__mount_allowed:
+            super().mount(*args, **kwargs)
+        else:
+            raise MountDisabledException(
+                "mount() is disabled to prevent protection bypasses"
+            )
+
+
+def session(*args, **kwargs):
+    return Session(*args, **kwargs)
+
+
+def request(method, url, **kwargs):
+    """Constructs and sends a :class:`Request <Request>`.
+
+    :param method: method for the new :class:`Request` object.
+    :param url: URL for the new :class:`Request` object.
+    :param params: (optional) Dictionary or bytes to be sent in the query string for the :class:`Request`.
+    :param data: (optional) Dictionary, bytes, or file-like object to send in the body of the :class:`Request`.
+    :param json: (optional) json data to send in the body of the :class:`Request`.
+    :param headers: (optional) Dictionary of HTTP Headers to send with the :class:`Request`.
+    :param cookies: (optional) Dict or CookieJar object to send with the :class:`Request`.
+    :param files: (optional) Dictionary of ``'name': file-like-objects`` (or ``{'name': ('filename', fileobj)}``) for multipart encoding upload.
+    :param auth: (optional) Auth tuple to enable Basic/Digest/Custom HTTP Auth.
+    :param timeout: (optional) How long to wait for the server to send data
+        before giving up, as a float, or a (`connect timeout, read timeout
+        <user/advanced.html#timeouts>`_) tuple.
+    :type timeout: float or tuple
+    :param allow_redirects: (optional) Boolean. Set to True if POST/PUT/DELETE redirect following is allowed.
+    :type allow_redirects: bool
+    :param proxies: (optional) Dictionary mapping protocol to the URL of the proxy.
+    :param verify: (optional) if ``True``, the SSL cert will be verified. A CA_BUNDLE path can also be provided.
+    :param stream: (optional) if ``False``, the response content will be immediately downloaded.
+    :param cert: (optional) if String, path to ssl client cert file (.pem). If Tuple, ('cert', 'key') pair.
+    :return: :class:`Response <Response>` object
+    :rtype: requests.Response
+    """
+
+    validator = kwargs.pop("validator", None)
+    with Session(validator=validator) as sess:
+        response = sess.request(method=method, url=url, **kwargs)
+    return response
+
+
+def get(url, **kwargs):
+    """Sends a GET request.
+
+    :param url: URL for the new :class:`Request` object.
+    :param **kwargs: Optional arguments that ``request`` takes.
+    :return: :class:`Response <Response>` object
+    :rtype: requests.Response
+    """
+
+    kwargs.setdefault('allow_redirects', True)
+    return request('get', url, **kwargs)
+
+
+class RequestsAPIWrapper:
+    """Provides a `requests.api`-like interface with a specific validator"""
+
+    # Due to how the classes are dynamically constructed pickling may not work
+    # correctly unless loaded within the same interpreter instance.
+    # Enable at your peril.
+    SUPPORT_WRAPPER_PICKLING = False
+
+    def __init__(self, validator):
+        # Do this here to avoid circular import issues
+        try:
+            from .futures import FuturesSession
+            have_requests_futures = True
+        except ImportError as e:
+            have_requests_futures = False
+
+        self.validator = validator
+        outer_self = self
+
+        class _WrappedSession(Session):
+            """An `advocate.Session` that uses the wrapper's blacklist
+
+            the wrapper is meant to be a transparent replacement for `requests`,
+            so people should be able to subclass `wrapper.Session` and still
+            get the desired validation behaviour
+            """
+            DEFAULT_VALIDATOR = outer_self.validator
+
+        self._make_wrapper_cls_global(_WrappedSession)
+
+        if have_requests_futures:
+
+            class _WrappedFuturesSession(FuturesSession):
+                """Like _WrappedSession, but for `FuturesSession`s"""
+                DEFAULT_VALIDATOR = outer_self.validator
+            self._make_wrapper_cls_global(_WrappedFuturesSession)
+
+            self.FuturesSession = _WrappedFuturesSession
+
+        self.request = self._default_arg_wrapper(request)
+        self.get = self._default_arg_wrapper(get)
+        self.Session = _WrappedSession
+
+    def __getattr__(self, item):
+        # This class is meant to mimic the requests base module, so if we don't
+        # have this attribute, it might be on the base module (like the Request
+        # class, etc.)
+        try:
+            return object.__getattribute__(self, item)
+        except AttributeError:
+            from . import cw_advocate
+            return getattr(cw_advocate, item)
+
+    def _default_arg_wrapper(self, fun):
+        def wrapped_func(*args, **kwargs):
+            kwargs.setdefault("validator", self.validator)
+            return fun(*args, **kwargs)
+        return wrapped_func
+
+    def _make_wrapper_cls_global(self, cls):
+        if not self.SUPPORT_WRAPPER_PICKLING:
+            return
+        # Gnarly, but necessary to give pickle a consistent module-level
+        # reference for each wrapper.
+        wrapper_hash = hashlib.sha256(pickle.dumps(self)).hexdigest()
+        cls.__name__ = "_".join((cls.__name__, wrapper_hash))
+        cls.__qualname__ = ".".join((__name__, cls.__name__))
+        if not globals().get(cls.__name__):
+            globals()[cls.__name__] = cls
+
+
+__all__ = (
+    "get",
+    "request",
+    "session",
+    "Session",
+    "RequestsAPIWrapper",
+)
@@ -0,0 +1,201 @@
+#
+# Copyright 2015 Jordan Milne
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# Source: https://github.com/JordanMilne/Advocate
+
+import ipaddress
+import socket
+from socket import timeout as SocketTimeout
+
+from urllib3.connection import HTTPSConnection, HTTPConnection
+from urllib3.exceptions import ConnectTimeoutError
+from urllib3.util.connection import _set_socket_options
+from urllib3.util.connection import create_connection as old_create_connection
+
+from . import addrvalidator
+from .exceptions import UnacceptableAddressException
+
+
+def advocate_getaddrinfo(host, port, get_canonname=False):
+    addrinfo = socket.getaddrinfo(
+        host,
+        port,
+        0,
+        socket.SOCK_STREAM,
+        0,
+        # We need what the DNS client sees the hostname as, correctly handles
+        # IDNs and tricky things like `private.foocorp.org\x00.google.com`.
+        # All IDNs will be converted to punycode.
+        socket.AI_CANONNAME if get_canonname else 0,
+    )
+    return fix_addrinfo(addrinfo)
+
+
+def fix_addrinfo(records):
+    """
+    Propagate the canonname across records and parse IPs
+
+    I'm not sure if this is just the behaviour of `getaddrinfo` on Linux, but
+    it seems like only the first record in the set has the canonname field
+    populated.
+    """
+    def fix_record(record, canonname):
+        sa = record[4]
+        sa = (ipaddress.ip_address(sa[0]),) + sa[1:]
+        return record[0], record[1], record[2], canonname, sa
+
+    canonname = None
+    if records:
+        # Apparently the canonical name is only included in the first record?
+        # Add it to all of them.
+        assert(len(records[0]) == 5)
+        canonname = records[0][3]
+    return tuple(fix_record(x, canonname) for x in records)
+
+
+# Lifted from requests' urllib3, which in turn lifted it from `socket.py`. Oy!
+def validating_create_connection(address,
+                       timeout=socket._GLOBAL_DEFAULT_TIMEOUT,
+                       source_address=None, socket_options=None,
+                       validator=None):
+    """Connect to *address* and return the socket object.
+
+    Convenience function.  Connect to *address* (a 2-tuple ``(host,
+    port)``) and return the socket object.  Passing the optional
+    *timeout* parameter will set the timeout on the socket instance
+    before attempting to connect.  If no *timeout* is supplied, the
+    global default timeout setting returned by :func:`getdefaulttimeout`
+    is used.  If *source_address* is set it must be a tuple of (host, port)
+    for the socket to bind as a source address before making the connection.
+    An host of '' or port 0 tells the OS to use the default.
+    """
+
+    host, port = address
+    # We can skip asking for the canon name if we're not doing hostname-based
+    # blacklisting.
+    need_canonname = False
+    if validator.hostname_blacklist:
+        need_canonname = True
+        # We check both the non-canonical and canonical hostnames so we can
+        # catch both of these:
+        # CNAME from nonblacklisted.com -> blacklisted.com
+        # CNAME from blacklisted.com -> nonblacklisted.com
+        if not validator.is_hostname_allowed(host):
+            raise UnacceptableAddressException(host)
+
+    err = None
+    addrinfo = advocate_getaddrinfo(host, port, get_canonname=need_canonname)
+    if addrinfo:
+        if validator.autodetect_local_addresses:
+            local_addresses = addrvalidator.determine_local_addresses()
+        else:
+            local_addresses = []
+        for res in addrinfo:
+            # Are we allowed to connect with this result?
+            if not validator.is_addrinfo_allowed(
+                res,
+                _local_addresses=local_addresses,
+            ):
+                continue
+            af, socktype, proto, canonname, sa = res
+            # Unparse the validated IP
+            sa = (sa[0].exploded,) + sa[1:]
+            sock = None
+            try:
+                sock = socket.socket(af, socktype, proto)
+
+                # If provided, set socket level options before connecting.
+                # This is the only addition urllib3 makes to this function.
+                _set_socket_options(sock, socket_options)
+
+                if timeout is not socket._GLOBAL_DEFAULT_TIMEOUT:
+                    sock.settimeout(timeout)
+                if source_address:
+                    sock.bind(source_address)
+                sock.connect(sa)
+                return sock
+
+            except socket.error as _:
+                err = _
+                if sock is not None:
+                    sock.close()
+                    sock = None
+
+        if err is None:
+            # If we got here, none of the results were acceptable
+            err = UnacceptableAddressException(address)
+    if err is not None:
+        raise err
+    else:
+        raise socket.error("getaddrinfo returns an empty list")
+
+
+# TODO: Is there a better way to add this to multiple classes with different
+# base classes? I tried a mixin, but it used the base method instead.
+def _validating_new_conn(self):
+    """ Establish a socket connection and set nodelay settings on it.
+
+    :return: New socket connection.
+    """
+    extra_kw = {}
+    if self.source_address:
+        extra_kw['source_address'] = self.source_address
+
+    if self.socket_options:
+        extra_kw['socket_options'] = self.socket_options
+
+    try:
+        # Hack around HTTPretty's patched sockets
+        # TODO: some better method of hacking around it that checks if we
+        # _would have_ connected to a private addr?
+        conn_func = validating_create_connection
+        if socket.getaddrinfo.__module__.startswith("httpretty"):
+            conn_func = old_create_connection
+        else:
+            extra_kw["validator"] = self._validator
+
+        conn = conn_func(
+            (self.host, self.port),
+            self.timeout,
+            **extra_kw
+        )
+
+    except SocketTimeout:
+        raise ConnectTimeoutError(
+            self, "Connection to %s timed out. (connect timeout=%s)" %
+            (self.host, self.timeout))
+
+    return conn
+
+
+# Don't silently break if the private API changes across urllib3 versions
+assert(hasattr(HTTPConnection, '_new_conn'))
+assert(hasattr(HTTPSConnection, '_new_conn'))
+
+
+class ValidatingHTTPConnection(HTTPConnection):
+    _new_conn = _validating_new_conn
+
+    def __init__(self, *args, **kwargs):
+        self._validator = kwargs.pop("validator")
+        HTTPConnection.__init__(self, *args, **kwargs)
+
+
+class ValidatingHTTPSConnection(HTTPSConnection):
+    _new_conn = _validating_new_conn
+
+    def __init__(self, *args, **kwargs):
+        self._validator = kwargs.pop("validator")
+        HTTPSConnection.__init__(self, *args, **kwargs)
@@ -0,0 +1,39 @@
+#
+# Copyright 2015 Jordan Milne
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# Source: https://github.com/JordanMilne/Advocate
+
+from urllib3 import HTTPConnectionPool, HTTPSConnectionPool
+
+from .connection import (
+    ValidatingHTTPConnection,
+    ValidatingHTTPSConnection,
+)
+
+# Don't silently break if the private API changes across urllib3 versions
+assert(hasattr(HTTPConnectionPool, 'ConnectionCls'))
+assert(hasattr(HTTPSConnectionPool, 'ConnectionCls'))
+assert(hasattr(HTTPConnectionPool, 'scheme'))
+assert(hasattr(HTTPSConnectionPool, 'scheme'))
+
+
+class ValidatingHTTPConnectionPool(HTTPConnectionPool):
+    scheme = 'http'
+    ConnectionCls = ValidatingHTTPConnection
+
+
+class ValidatingHTTPSConnectionPool(HTTPSConnectionPool):
+    scheme = 'https'
+    ConnectionCls = ValidatingHTTPSConnection
@@ -0,0 +1,39 @@
+#
+# Copyright 2015 Jordan Milne
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# Source: https://github.com/JordanMilne/Advocate
+
+class AdvocateException(Exception):
+    pass
+
+
+class UnacceptableAddressException(AdvocateException):
+    pass
+
+
+class NameserverException(AdvocateException):
+    pass
+
+
+class MountDisabledException(AdvocateException):
+    pass
+
+
+class ProxyDisabledException(NotImplementedError, AdvocateException):
+    pass
+
+
+class ConfigException(AdvocateException):
+    pass
@@ -0,0 +1,61 @@
+#
+# Copyright 2015 Jordan Milne
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# Source: https://github.com/JordanMilne/Advocate
+
+import collections
+import functools
+
+from urllib3 import PoolManager
+from urllib3.poolmanager import _default_key_normalizer, PoolKey
+
+from .connectionpool import (
+    ValidatingHTTPSConnectionPool,
+    ValidatingHTTPConnectionPool,
+)
+
+pool_classes_by_scheme = {
+    "http": ValidatingHTTPConnectionPool,
+    "https": ValidatingHTTPSConnectionPool,
+}
+
+AdvocatePoolKey = collections.namedtuple('AdvocatePoolKey',
+                                         PoolKey._fields + ('key_validator',))
+
+
+def key_normalizer(key_class, request_context):
+    request_context = request_context.copy()
+    # TODO: add ability to serialize validator rules to dict,
+    # allowing pool to be shared between sessions with the same
+    # rules.
+    request_context["validator"] = id(request_context["validator"])
+    return _default_key_normalizer(key_class, request_context)
+
+
+key_fn_by_scheme = {
+    'http': functools.partial(key_normalizer, AdvocatePoolKey),
+    'https': functools.partial(key_normalizer, AdvocatePoolKey),
+}
+
+
+class ValidatingPoolManager(PoolManager):
+    def __init__(self, *args, **kwargs):
+        super().__init__(*args, **kwargs)
+
+        # Make sure the API hasn't changed
+        assert (hasattr(self, 'pool_classes_by_scheme'))
+
+        self.pool_classes_by_scheme = pool_classes_by_scheme
+        self.key_fn_by_scheme = key_fn_by_scheme.copy()
@@ -0,0 +1,41 @@
+from babel import negotiate_locale
+from flask_babel import Babel, Locale
+from babel.core import UnknownLocaleError
+from flask import request
+from .cw_login import current_user
+
+from . import logger
+
+log = logger.create()
+
+babel = Babel()
+
+
+def get_locale():
+    # if a user is logged in, use the locale from the user settings
+    if current_user is not None and hasattr(current_user, "locale"):
+        # if the account is the guest account bypass the config lang settings
+        if current_user.name != 'Guest':
+            return current_user.locale
+
+    preferred = list()
+    if request.accept_languages:
+        for x in request.accept_languages.values():
+            try:
+                preferred.append(str(Locale.parse(x.replace('-', '_'))))
+            except (UnknownLocaleError, ValueError) as e:
+                log.debug('Could not parse locale "%s": %s', x, e)
+
+    return negotiate_locale(preferred or ['en'], get_available_translations())
+
+
+def get_user_locale_language(user_language):
+    return Locale.parse(user_language).get_language_name(get_locale())
+
+
+def get_available_locale():
+    return sorted(babel.list_translations(), key=lambda x: x.display_name.lower())
+
+
+def get_available_translations():
+    return set(str(item) for item in get_available_locale())
@@ -0,0 +1,98 @@
+# from .__about__ import __version__
+from .config import AUTH_HEADER_NAME
+from .config import COOKIE_DURATION
+from .config import COOKIE_HTTPONLY
+from .config import COOKIE_NAME
+from .config import COOKIE_SECURE
+from .config import ID_ATTRIBUTE
+from .config import LOGIN_MESSAGE
+from .config import LOGIN_MESSAGE_CATEGORY
+from .config import REFRESH_MESSAGE
+from .config import REFRESH_MESSAGE_CATEGORY
+from .login_manager import LoginManager
+from .mixins import AnonymousUserMixin
+from .mixins import UserMixin
+from .signals import session_protected
+from .signals import user_accessed
+from .signals import user_loaded_from_cookie
+from .signals import user_loaded_from_request
+from .signals import user_logged_in
+from .signals import user_logged_out
+from .signals import user_login_confirmed
+from .signals import user_needs_refresh
+from .signals import user_unauthorized
+# from .test_client import FlaskLoginClient
+from .utils import confirm_login
+from .utils import current_user
+from .utils import decode_cookie
+from .utils import encode_cookie
+from .utils import fresh_login_required
+from .utils import login_fresh
+from .utils import login_remembered
+from .utils import login_required
+from .utils import login_url
+from .utils import login_user
+from .utils import logout_user
+from .utils import make_next_param
+from .utils import set_login_view
+
+__version_info__ = ("0", "6", "3")
+__version__ = ".".join(__version_info__)
+
+
+__all__ = [
+    "__version__",
+    "AUTH_HEADER_NAME",
+    "COOKIE_DURATION",
+    "COOKIE_HTTPONLY",
+    "COOKIE_NAME",
+    "COOKIE_SECURE",
+    "ID_ATTRIBUTE",
+    "LOGIN_MESSAGE",
+    "LOGIN_MESSAGE_CATEGORY",
+    "REFRESH_MESSAGE",
+    "REFRESH_MESSAGE_CATEGORY",
+    "LoginManager",
+    "AnonymousUserMixin",
+    "UserMixin",
+    "session_protected",
+    "user_accessed",
+    "user_loaded_from_cookie",
+    "user_loaded_from_request",
+    "user_logged_in",
+    "user_logged_out",
+    "user_login_confirmed",
+    "user_needs_refresh",
+    "user_unauthorized",
+    # "FlaskLoginClient",
+    "confirm_login",
+    "current_user",
+    "decode_cookie",
+    "encode_cookie",
+    "fresh_login_required",
+    "login_fresh",
+    "login_remembered",
+    "login_required",
+    "login_url",
+    "login_user",
+    "logout_user",
+    "make_next_param",
+    "set_login_view",
+]
+
+
+def __getattr__(name):
+    if name == "user_loaded_from_header":
+        import warnings
+        from .signals import _user_loaded_from_header
+
+        warnings.warn(
+            "'user_loaded_from_header' is deprecated and will be"
+            " removed in Flask-Login 0.7. Use"
+            " 'user_loaded_from_request' instead.",
+            DeprecationWarning,
+            stacklevel=2,
+        )
+        return _user_loaded_from_header
+
+    raise AttributeError(name)
@@ -0,0 +1,55 @@
+from datetime import timedelta
+
+#: The default name of the "remember me" cookie (``remember_token``)
+COOKIE_NAME = "remember_token"
+
+#: The default time before the "remember me" cookie expires (365 days).
+COOKIE_DURATION = timedelta(days=365)
+
+#: Whether the "remember me" cookie requires Secure; defaults to ``False``
+COOKIE_SECURE = False
+
+#: Whether the "remember me" cookie uses HttpOnly or not; defaults to ``True``
+COOKIE_HTTPONLY = True
+
+#: Whether the "remember me" cookie requires same origin; defaults to ``None``
+COOKIE_SAMESITE = None
+
+#: The default flash message to display when users need to log in.
+LOGIN_MESSAGE = "Please log in to access this page."
+
+#: The default flash message category to display when users need to log in.
+LOGIN_MESSAGE_CATEGORY = "message"
+
+#: The default flash message to display when users need to reauthenticate.
+REFRESH_MESSAGE = "Please reauthenticate to access this page."
+
+#: The default flash message category to display when users need to
+#: reauthenticate.
+REFRESH_MESSAGE_CATEGORY = "message"
+
+#: The default attribute to retreive the str id of the user
+ID_ATTRIBUTE = "get_id"
+
+#: Default name of the auth header (``Authorization``)
+AUTH_HEADER_NAME = "Authorization"
+
+#: A set of session keys that are populated by Flask-Login. Use this set to
+#: purge keys safely and accurately.
+SESSION_KEYS = {
+    "_user_id",
+    "_remember",
+    "_remember_seconds",
+    "_id",
+    "_fresh",
+    "next",
+}
+
+#: A set of HTTP methods which are exempt from `login_required` and
+#: `fresh_login_required`. By default, this is just ``OPTIONS``.
+EXEMPT_METHODS = {"OPTIONS"}
+
+#: If true, the page the user is attempting to access is stored in the session
+#: rather than a url parameter when redirecting to the login view; defaults to
+#: ``False``.
+USE_SESSION_FOR_NEXT = False
@@ -0,0 +1,523 @@
+from datetime import datetime
+from datetime import timezone
+from datetime import timedelta
+import hashlib
+
+from flask import abort
+from flask import current_app
+from flask import flash
+from flask import g
+from flask import redirect
+from flask import request
+from flask import session
+from itsdangerous import URLSafeSerializer
+from flask.json.tag import TaggedJSONSerializer
+
+from .config import AUTH_HEADER_NAME
+from .config import COOKIE_DURATION
+from .config import COOKIE_HTTPONLY
+from .config import COOKIE_NAME
+from .config import COOKIE_SAMESITE
+from .config import COOKIE_SECURE
+from .config import ID_ATTRIBUTE
+from .config import LOGIN_MESSAGE
+from .config import LOGIN_MESSAGE_CATEGORY
+from .config import REFRESH_MESSAGE
+from .config import REFRESH_MESSAGE_CATEGORY
+from .config import SESSION_KEYS
+from .config import USE_SESSION_FOR_NEXT
+from .mixins import AnonymousUserMixin
+from .signals import session_protected
+from .signals import user_accessed
+from .signals import user_loaded_from_cookie
+from .signals import user_loaded_from_request
+from .signals import user_needs_refresh
+from .signals import user_unauthorized
+from .utils import _create_identifier
+from .utils import _user_context_processor
+from .utils import confirm_login
+from .utils import expand_login_view
+from .utils import login_url as make_login_url
+from .utils import make_next_param
+
+
+class LoginManager:
+    """This object is used to hold the settings used for logging in. Instances
+    of :class:`LoginManager` are *not* bound to specific apps, so you can
+    create one in the main body of your code and then bind it to your
+    app in a factory function.
+    """
+
+    def __init__(self, app=None, add_context_processor=True):
+        #: A class or factory function that produces an anonymous user, which
+        #: is used when no one is logged in.
+        self.anonymous_user = AnonymousUserMixin
+
+        #: The name of the view to redirect to when the user needs to log in.
+        #: (This can be an absolute URL as well, if your authentication
+        #: machinery is external to your application.)
+        self.login_view = None
+
+        #: Names of views to redirect to when the user needs to log in,
+        #: per blueprint. If the key value is set to None the value of
+        #: :attr:`login_view` will be used instead.
+        self.blueprint_login_views = {}
+
+        #: The message to flash when a user is redirected to the login page.
+        self.login_message = LOGIN_MESSAGE
+
+        #: The message category to flash when a user is redirected to the login
+        #: page.
+        self.login_message_category = LOGIN_MESSAGE_CATEGORY
+
+        #: The name of the view to redirect to when the user needs to
+        #: reauthenticate.
+        self.refresh_view = None
+
+        #: The message to flash when a user is redirected to the 'needs
+        #: refresh' page.
+        self.needs_refresh_message = REFRESH_MESSAGE
+
+        #: The message category to flash when a user is redirected to the
+        #: 'needs refresh' page.
+        self.needs_refresh_message_category = REFRESH_MESSAGE_CATEGORY
+
+        #: The mode to use session protection in. This can be either
+        #: ``'basic'`` (the default) or ``'strong'``, or ``None`` to disable
+        #: it.
+        self.session_protection = "basic"
+
+        #: If present, used to translate flash messages ``self.login_message``
+        #: and ``self.needs_refresh_message``
+        self.localize_callback = None
+
+        self.unauthorized_callback = None
+
+        self.needs_refresh_callback = None
+
+        self.id_attribute = ID_ATTRIBUTE
+
+        self._user_callback = None
+
+        self._header_callback = None
+
+        self._request_callback = None
+
+        self._session_identifier_generator = _create_identifier
+
+        if app is not None:
+            self.init_app(app, add_context_processor)
+
+    def setup_app(self, app, add_context_processor=True):  # pragma: no cover
+        """
+        This method has been deprecated. Please use
+        :meth:`LoginManager.init_app` instead.
+        """
+        import warnings
+
+        warnings.warn(
+            "'setup_app' is deprecated and will be removed in"
+            " Flask-Login 0.7. Use 'init_app' instead.",
+            DeprecationWarning,
+            stacklevel=2,
+        )
+        self.init_app(app, add_context_processor)
+
+    def init_app(self, app, add_context_processor=True):
+        """
+        Configures an application. This registers an `after_request` call, and
+        attaches this `LoginManager` to it as `app.login_manager`.
+
+        :param app: The :class:`flask.Flask` object to configure.
+        :type app: :class:`flask.Flask`
+        :param add_context_processor: Whether to add a context processor to
+            the app that adds a `current_user` variable to the template.
+            Defaults to ``True``.
+        :type add_context_processor: bool
+        """
+        app.login_manager = self
+        app.after_request(self._update_remember_cookie)
+
+        if add_context_processor:
+            app.context_processor(_user_context_processor)
+
+    def unauthorized(self):
+        """
+        This is called when the user is required to log in. If you register a
+        callback with :meth:`LoginManager.unauthorized_handler`, then it will
+        be called. Otherwise, it will take the following actions:
+
+            - Flash :attr:`LoginManager.login_message` to the user.
+
+            - If the app is using blueprints find the login view for
+              the current blueprint using `blueprint_login_views`. If the app
+              is not using blueprints or the login view for the current
+              blueprint is not specified use the value of `login_view`.
+
+            - Redirect the user to the login view. (The page they were
+              attempting to access will be passed in the ``next`` query
+              string variable, so you can redirect there if present instead
+              of the homepage. Alternatively, it will be added to the session
+              as ``next`` if USE_SESSION_FOR_NEXT is set.)
+
+        If :attr:`LoginManager.login_view` is not defined, then it will simply
+        raise a HTTP 401 (Unauthorized) error instead.
+
+        This should be returned from a view or before/after_request function,
+        otherwise the redirect will have no effect.
+        """
+        user_unauthorized.send(current_app._get_current_object())
+
+        if self.unauthorized_callback:
+            return self.unauthorized_callback()
+
+        if request.blueprint in self.blueprint_login_views:
+            login_view = self.blueprint_login_views[request.blueprint]
+        else:
+            login_view = self.login_view
+
+        if not login_view:
+            abort(401)
+
+        if self.login_message:
+            if self.localize_callback is not None:
+                flash(
+                    self.localize_callback(self.login_message),
+                    category=self.login_message_category,
+                )
+            else:
+                flash(self.login_message, category=self.login_message_category)
+
+        config = current_app.config
+        if config.get("USE_SESSION_FOR_NEXT", USE_SESSION_FOR_NEXT):
+            login_url = expand_login_view(login_view)
+            session["_id"] = self._session_identifier_generator()
+            session["next"] = make_next_param(login_url, request.url)
+            redirect_url = make_login_url(login_view)
+        else:
+            redirect_url = make_login_url(login_view, next_url=request.url)
+
+        return redirect(redirect_url)
+
+    def user_loader(self, callback):
+        """
+        This sets the callback for reloading a user from the session. The
+        function you set should take a user ID (a ``str``) and return a
+        user object, or ``None`` if the user does not exist.
+
+        :param callback: The callback for retrieving a user object.
+        :type callback: callable
+        """
+        self._user_callback = callback
+        return self.user_callback
+
+    @property
+    def user_callback(self):
+        """Gets the user_loader callback set by user_loader decorator."""
+        return self._user_callback
+
+    def request_loader(self, callback):
+        """
+        This sets the callback for loading a user from a Flask request.
+        The function you set should take Flask request object and
+        return a user object, or `None` if the user does not exist.
+
+        :param callback: The callback for retrieving a user object.
+        :type callback: callable
+        """
+        self._request_callback = callback
+        return self.request_callback
+
+    @property
+    def request_callback(self):
+        """Gets the request_loader callback set by request_loader decorator."""
+        return self._request_callback
+
+    def unauthorized_handler(self, callback):
+        """
+        This will set the callback for the `unauthorized` method, which among
+        other things is used by `login_required`. It takes no arguments, and
+        should return a response to be sent to the user instead of their
+        normal view.
+
+        :param callback: The callback for unauthorized users.
+        :type callback: callable
+        """
+        self.unauthorized_callback = callback
+        return callback
+
+    def needs_refresh_handler(self, callback):
+        """
+        This will set the callback for the `needs_refresh` method, which among
+        other things is used by `fresh_login_required`. It takes no arguments,
+        and should return a response to be sent to the user instead of their
+        normal view.
+
+        :param callback: The callback for unauthorized users.
+        :type callback: callable
+        """
+        self.needs_refresh_callback = callback
+        return callback
+
+    def needs_refresh(self):
+        """
+        This is called when the user is logged in, but they need to be
+        reauthenticated because their session is stale. If you register a
+        callback with `needs_refresh_handler`, then it will be called.
+        Otherwise, it will take the following actions:
+
+            - Flash :attr:`LoginManager.needs_refresh_message` to the user.
+
+            - Redirect the user to :attr:`LoginManager.refresh_view`. (The page
+              they were attempting to access will be passed in the ``next``
+              query string variable, so you can redirect there if present
+              instead of the homepage.)
+
+        If :attr:`LoginManager.refresh_view` is not defined, then it will
+        simply raise a HTTP 401 (Unauthorized) error instead.
+
+        This should be returned from a view or before/after_request function,
+        otherwise the redirect will have no effect.
+        """
+        user_needs_refresh.send(current_app._get_current_object())
+
+        if self.needs_refresh_callback:
+            return self.needs_refresh_callback()
+
+        if not self.refresh_view:
+            abort(401)
+
+        if self.needs_refresh_message:
+            if self.localize_callback is not None:
+                flash(
+                    self.localize_callback(self.needs_refresh_message),
+                    category=self.needs_refresh_message_category,
+                )
+            else:
+                flash(
+                    self.needs_refresh_message,
+                    category=self.needs_refresh_message_category,
+                )
+
+        config = current_app.config
+        if config.get("USE_SESSION_FOR_NEXT", USE_SESSION_FOR_NEXT):
+            login_url = expand_login_view(self.refresh_view)
+            session["_id"] = self._session_identifier_generator()
+            session["next"] = make_next_param(login_url, request.url)
+            redirect_url = make_login_url(self.refresh_view)
+        else:
+            login_url = self.refresh_view
+            redirect_url = make_login_url(login_url, next_url=request.url)
+
+        return redirect(redirect_url)
+
+    def _update_request_context_with_user(self, user=None):
+        """Store the given user as ctx.user."""
+
+        if user is None:
+            user = self.anonymous_user()
+
+        g._login_user = user
+
+    def _load_user(self):
+        """Loads user from session or remember_me cookie as applicable"""
+
+        if self._user_callback is None and self._request_callback is None:
+            raise Exception(
+                "Missing user_loader or request_loader. Refer to "
+                "https://flask-login.readthedocs.io/#how-it-works "
+                "for more info."
+            )
+
+        user_accessed.send(current_app._get_current_object())
+
+        # Check SESSION_PROTECTION
+        if self._session_protection_failed():
+            return self._update_request_context_with_user()
+
+        user = None
+
+        # Load user from Flask Session
+        user_id = session.get("_user_id")
+        user_random = session.get("_random")
+        user_session_key = session.get("_id")
+        if (user_id is not None
+            and user_random is not None
+            and user_session_key is not None
+            and self._user_callback is not None):
+              user = self._user_callback(user_id, user_random, user_session_key)
+
+        # Load user from Remember Me Cookie or Request Loader
+        if user is None:
+            config = current_app.config
+            cookie_name = config.get("REMEMBER_COOKIE_NAME", COOKIE_NAME)
+            header_name = config.get("AUTH_HEADER_NAME", AUTH_HEADER_NAME)
+            has_cookie = (
+                cookie_name in request.cookies and session.get("_remember") != "clear"
+            )
+            if has_cookie:
+                cookie = request.cookies[cookie_name]
+                user = self._load_user_from_remember_cookie(cookie)
+            elif self._request_callback:
+                user = self._load_user_from_request(request)
+            elif header_name in request.headers:
+                header = request.headers[header_name]
+                user = self._load_user_from_header(header)
+        if not user:
+            self._update_request_context_with_user()
+        return self._update_request_context_with_user(user)
+
+    def _session_protection_failed(self):
+        sess = session._get_current_object()
+        ident = self._session_identifier_generator()
+
+        app = current_app._get_current_object()
+        mode = app.config.get("SESSION_PROTECTION", self.session_protection)
+
+        if not mode or mode not in ["basic", "strong"]:
+            return False
+
+        # if the sess is empty, it's an anonymous user or just logged out
+        # so we can skip this
+        if sess and ident != sess.get("_id", None):
+            if mode == "basic" or sess.permanent:
+                if sess.get("_fresh") is not False:
+                    sess["_fresh"] = False
+                session_protected.send(app)
+                return False
+            elif mode == "strong":
+                for k in SESSION_KEYS:
+                    sess.pop(k, None)
+
+                sess["_remember"] = "clear"
+                session_protected.send(app)
+                return True
+
+        return False
+
+    def _load_user_from_remember_cookie(self, cookie):
+        signer_kwargs = dict(
+            key_derivation="hmac", digest_method=hashlib.sha1
+        )
+        try:
+            remember_dict = URLSafeSerializer(
+                current_app.secret_key,
+                salt="remember",
+                serializer=TaggedJSONSerializer(),
+                signer_kwargs=signer_kwargs,
+            ).loads(cookie)
+        except Exception:
+            return None
+
+        if remember_dict['user'] is not None:
+            session["_user_id"] = remember_dict['user']
+            if "_random" not in session:
+                session["_random"] = remember_dict['random']
+            session["_fresh"] = False
+            user = None
+            if self._user_callback:
+                user = self._user_callback(remember_dict['user'], session["_random"], None)
+            if user is not None:
+                app = current_app._get_current_object()
+                user_loaded_from_cookie.send(app, user=user)
+                # if session was restored from remember me cookie make login valid
+                confirm_login()
+                return user
+        return None
+
+    def _load_user_from_header(self, header):
+        if self._header_callback:
+            user = self._header_callback(header)
+            if user is not None:
+                app = current_app._get_current_object()
+
+                from .signals import _user_loaded_from_header
+
+                _user_loaded_from_header.send(app, user=user)
+                return user
+        return None
+
+    def _load_user_from_request(self, request):
+        if self._request_callback:
+            user = self._request_callback(request)
+            if user is not None:
+                app = current_app._get_current_object()
+                user_loaded_from_request.send(app, user=user)
+                return user
+        return None
+
+    def _update_remember_cookie(self, response):
+        # Don't modify the session unless there's something to do.
+        if "_remember" not in session and current_app.config.get(
+            "REMEMBER_COOKIE_REFRESH_EACH_REQUEST"
+        ):
+            session["_remember"] = "set"
+
+        if "_remember" in session:
+            operation = session.pop("_remember", None)
+
+            if operation == "set" and "_user_id" in session:
+                self._set_cookie(response)
+            elif operation == "clear":
+                self._clear_cookie(response)
+
+        return response
+
+    def _set_cookie(self, response):
+        # cookie settings
+        config = current_app.config
+        cookie_name = config.get("REMEMBER_COOKIE_NAME", COOKIE_NAME)
+        domain = config.get("REMEMBER_COOKIE_DOMAIN")
+        path = config.get("REMEMBER_COOKIE_PATH", current_app.wsgi_app.script_name)
+
+        secure = config.get("REMEMBER_COOKIE_SECURE", COOKIE_SECURE)
+        httponly = config.get("REMEMBER_COOKIE_HTTPONLY", COOKIE_HTTPONLY)
+        samesite = config.get("REMEMBER_COOKIE_SAMESITE", COOKIE_SAMESITE)
+
+        if "_remember_seconds" in session:
+            duration = timedelta(seconds=session["_remember_seconds"])
+        else:
+            duration = config.get("REMEMBER_COOKIE_DURATION", COOKIE_DURATION)
+
+        # prepare data
+        max_age = int(current_app.permanent_session_lifetime.total_seconds())
+        signer_kwargs = dict(
+            key_derivation="hmac", digest_method=hashlib.sha1
+        )
+        # save
+        data = URLSafeSerializer(
+            current_app.secret_key,
+            salt="remember",
+            serializer=TaggedJSONSerializer(),
+            signer_kwargs=signer_kwargs,
+        ).dumps({"user":session["_user_id"], "random":session["_random"]})
+
+        if isinstance(duration, int):
+            duration = timedelta(seconds=duration)
+
+        try:
+            expires = datetime.now(timezone.utc) + duration
+        except TypeError as e:
+            raise Exception(
+                "REMEMBER_COOKIE_DURATION must be a datetime.timedelta,"
+                f" instead got: {duration}"
+            ) from e
+
+        # actually set it
+        response.set_cookie(
+            cookie_name,
+            value=data,
+            expires=expires,
+            domain=domain,
+            path=path,
+            secure=secure,
+            httponly=httponly,
+            samesite=samesite,
+        )
+
+    def _clear_cookie(self, response):
+        config = current_app.config
+        cookie_name = config.get("REMEMBER_COOKIE_NAME", COOKIE_NAME)
+        domain = config.get("REMEMBER_COOKIE_DOMAIN")
+        path = config.get("REMEMBER_COOKIE_PATH", current_app.wsgi_app.script_name)
+        response.delete_cookie(cookie_name, domain=domain, path=path)
@@ -0,0 +1,65 @@
+class UserMixin:
+    """
+    This provides default implementations for the methods that Flask-Login
+    expects user objects to have.
+    """
+
+    # Python 3 implicitly set __hash__ to None if we override __eq__
+    # We set it back to its default implementation
+    __hash__ = object.__hash__
+
+    @property
+    def is_active(self):
+        return True
+
+    @property
+    def is_authenticated(self):
+        return self.is_active
+
+    @property
+    def is_anonymous(self):
+        return False
+
+    def get_id(self):
+        try:
+            return str(self.id)
+        except AttributeError:
+            raise NotImplementedError("No `id` attribute - override `get_id`") from None
+
+    def __eq__(self, other):
+        """
+        Checks the equality of two `UserMixin` objects using `get_id`.
+        """
+        if isinstance(other, UserMixin):
+            return self.get_id() == other.get_id()
+        return NotImplemented
+
+    def __ne__(self, other):
+        """
+        Checks the inequality of two `UserMixin` objects using `get_id`.
+        """
+        equal = self.__eq__(other)
+        if equal is NotImplemented:
+            return NotImplemented
+        return not equal
+
+
+class AnonymousUserMixin:
+    """
+    This is the default object for representing an anonymous user.
+    """
+
+    @property
+    def is_authenticated(self):
+        return False
+
+    @property
+    def is_active(self):
+        return False
+
+    @property
+    def is_anonymous(self):
+        return True
+
+    def get_id(self):
+        return
@@ -0,0 +1,61 @@
+from flask.signals import Namespace
+
+_signals = Namespace()
+
+#: Sent when a user is logged in. In addition to the app (which is the
+#: sender), it is passed `user`, which is the user being logged in.
+user_logged_in = _signals.signal("logged-in")
+
+#: Sent when a user is logged out. In addition to the app (which is the
+#: sender), it is passed `user`, which is the user being logged out.
+user_logged_out = _signals.signal("logged-out")
+
+#: Sent when the user is loaded from the cookie. In addition to the app (which
+#: is the sender), it is passed `user`, which is the user being reloaded.
+user_loaded_from_cookie = _signals.signal("loaded-from-cookie")
+
+#: Sent when the user is loaded from the header. In addition to the app (which
+#: is the #: sender), it is passed `user`, which is the user being reloaded.
+_user_loaded_from_header = _signals.signal("loaded-from-header")
+
+#: Sent when the user is loaded from the request. In addition to the app (which
+#: is the #: sender), it is passed `user`, which is the user being reloaded.
+user_loaded_from_request = _signals.signal("loaded-from-request")
+
+#: Sent when a user's login is confirmed, marking it as fresh. (It is not
+#: called for a normal login.)
+#: It receives no additional arguments besides the app.
+user_login_confirmed = _signals.signal("login-confirmed")
+
+#: Sent when the `unauthorized` method is called on a `LoginManager`. It
+#: receives no additional arguments besides the app.
+user_unauthorized = _signals.signal("unauthorized")
+
+#: Sent when the `needs_refresh` method is called on a `LoginManager`. It
+#: receives no additional arguments besides the app.
+user_needs_refresh = _signals.signal("needs-refresh")
+
+#: Sent whenever the user is accessed/loaded
+#: receives no additional arguments besides the app.
+user_accessed = _signals.signal("accessed")
+
+#: Sent whenever session protection takes effect, and a session is either
+#: marked non-fresh or deleted. It receives no additional arguments besides
+#: the app.
+session_protected = _signals.signal("session-protected")
+
+
+def __getattr__(name):
+    if name == "user_loaded_from_header":
+        import warnings
+
+        warnings.warn(
+            "'user_loaded_from_header' is deprecated and will be"
+            " removed in Flask-Login 0.7. Use"
+            " 'user_loaded_from_request' instead.",
+            DeprecationWarning,
+            stacklevel=2,
+        )
+        return _user_loaded_from_header
+
+    raise AttributeError(name)
@@ -0,0 +1,424 @@
+import hmac
+import os
+from functools import wraps
+from hashlib import sha512
+from urllib.parse import parse_qs
+from urllib.parse import urlencode
+from urllib.parse import urlsplit
+from urllib.parse import urlunsplit
+
+from flask import current_app
+from flask import g
+from flask import has_request_context
+from flask import request
+from flask import session
+from flask import url_for
+from werkzeug.local import LocalProxy
+
+from .config import COOKIE_NAME
+from .config import EXEMPT_METHODS
+from .signals import user_logged_in
+from .signals import user_logged_out
+from .signals import user_login_confirmed
+
+#: A proxy for the current user. If no user is logged in, this will be an
+#: anonymous user
+current_user = LocalProxy(lambda: _get_user())
+
+
+def encode_cookie(payload, key=None):
+    """
+    This will encode a ``str`` value into a cookie, and sign that cookie
+    with the app's secret key.
+
+    :param payload: The value to encode, as `str`.
+    :type payload: str
+
+    :param key: The key to use when creating the cookie digest. If not
+                specified, the SECRET_KEY value from app config will be used.
+    :type key: str
+    """
+    return f"{payload}|{_cookie_digest(payload, key=key)}"
+
+
+def decode_cookie(cookie, key=None):
+    """
+    This decodes a cookie given by `encode_cookie`. If verification of the
+    cookie fails, ``None`` will be implicitly returned.
+
+    :param cookie: An encoded cookie.
+    :type cookie: str
+
+    :param key: The key to use when creating the cookie digest. If not
+                specified, the SECRET_KEY value from app config will be used.
+    :type key: str
+    """
+    try:
+        payload, digest = cookie.rsplit("|", 1)
+        if hasattr(digest, "decode"):
+            digest = digest.decode("ascii")  # pragma: no cover
+    except ValueError:
+        return
+
+    if hmac.compare_digest(_cookie_digest(payload, key=key), digest):
+        return payload
+
+
+def make_next_param(login_url, current_url):
+    """
+    Reduces the scheme and host from a given URL so it can be passed to
+    the given `login` URL more efficiently.
+
+    :param login_url: The login URL being redirected to.
+    :type login_url: str
+    :param current_url: The URL to reduce.
+    :type current_url: str
+    """
+    l_url = urlsplit(login_url)
+    c_url = urlsplit(current_url)
+
+    if (not l_url.scheme or l_url.scheme == c_url.scheme) and (
+        not l_url.netloc or l_url.netloc == c_url.netloc
+    ):
+        return urlunsplit(("", "", c_url.path, c_url.query, ""))
+    return current_url
+
+
+def expand_login_view(login_view):
+    """
+    Returns the url for the login view, expanding the view name to a url if
+    needed.
+
+    :param login_view: The name of the login view or a URL for the login view.
+    :type login_view: str
+    """
+    if login_view.startswith(("https://", "http://", "/")):
+        return login_view
+
+    return url_for(login_view)
+
+
+def login_url(login_view, next_url=None, next_field="next"):
+    """
+    Creates a URL for redirecting to a login page. If only `login_view` is
+    provided, this will just return the URL for it. If `next_url` is provided,
+    however, this will append a ``next=URL`` parameter to the query string
+    so that the login view can redirect back to that URL. Flask-Login's default
+    unauthorized handler uses this function when redirecting to your login url.
+    To force the host name used, set `FORCE_HOST_FOR_REDIRECTS` to a host. This
+    prevents from redirecting to external sites if request headers Host or
+    X-Forwarded-For are present.
+
+    :param login_view: The name of the login view. (Alternately, the actual
+                       URL to the login view.)
+    :type login_view: str
+    :param next_url: The URL to give the login view for redirection.
+    :type next_url: str
+    :param next_field: What field to store the next URL in. (It defaults to
+                       ``next``.)
+    :type next_field: str
+    """
+    base = expand_login_view(login_view)
+
+    if next_url is None:
+        return base
+
+    parsed_result = urlsplit(base)
+    md = parse_qs(parsed_result.query, keep_blank_values=True)
+    md[next_field] = make_next_param(base, next_url)
+    netloc = current_app.config.get("FORCE_HOST_FOR_REDIRECTS") or parsed_result.netloc
+    parsed_result = parsed_result._replace(
+        netloc=netloc, query=urlencode(md, doseq=True)
+    )
+    return urlunsplit(parsed_result)
+
+
+def login_fresh():
+    """
+    This returns ``True`` if the current login is fresh.
+    """
+    return session.get("_fresh", False)
+
+
+def login_remembered():
+    """
+    This returns ``True`` if the current login is remembered across sessions.
+    """
+    config = current_app.config
+    cookie_name = config.get("REMEMBER_COOKIE_NAME", COOKIE_NAME)
+    has_cookie = cookie_name in request.cookies and session.get("_remember") != "clear"
+    if has_cookie:
+        cookie = request.cookies[cookie_name]
+        user_id = decode_cookie(cookie)
+        return user_id is not None
+    return False
+
+
+def login_user(user, remember=False, duration=None, force=False, fresh=True):
+    """
+    Logs a user in. You should pass the actual user object to this. If the
+    user's `is_active` property is ``False``, they will not be logged in
+    unless `force` is ``True``.
+
+    This will return ``True`` if the log in attempt succeeds, and ``False`` if
+    it fails (i.e. because the user is inactive).
+
+    :param user: The user object to log in.
+    :type user: object
+    :param remember: Whether to remember the user after their session expires.
+        Defaults to ``False``.
+    :type remember: bool
+    :param duration: The amount of time before the remember cookie expires. If
+        ``None`` the value set in the settings is used. Defaults to ``None``.
+    :type duration: :class:`datetime.timedelta`
+    :param force: If the user is inactive, setting this to ``True`` will log
+        them in regardless. Defaults to ``False``.
+    :type force: bool
+    :param fresh: setting this to ``False`` will log in the user with a session
+        marked as not "fresh". Defaults to ``True``.
+    :type fresh: bool
+    """
+    if not force and not user.is_active:
+        return False
+
+    user_id = getattr(user, current_app.login_manager.id_attribute)()
+    session["_user_id"] = user_id
+    session["_fresh"] = fresh
+    session["_id"] = current_app.login_manager._session_identifier_generator()
+    session["_random"] = os.urandom(10).hex()
+
+    if remember:
+        session["_remember"] = "set"
+        if duration is not None:
+            try:
+                # equal to timedelta.total_seconds() but works with Python 2.6
+                session["_remember_seconds"] = (
+                    duration.microseconds
+                    + (duration.seconds + duration.days * 24 * 3600) * 10**6
+                ) / 10.0**6
+            except AttributeError as e:
+                raise Exception(
+                    f"duration must be a datetime.timedelta, instead got: {duration}"
+                ) from e
+
+    current_app.login_manager._update_request_context_with_user(user)
+    user_logged_in.send(current_app._get_current_object(), user=_get_user())
+    return True
+
+
+def logout_user():
+    """
+    Logs a user out. (You do not need to pass the actual user.) This will
+    also clean up the remember me cookie if it exists.
+    """
+
+    user = _get_user()
+
+    if "_user_id" in session:
+        session.pop("_user_id")
+
+    if "_fresh" in session:
+        session.pop("_fresh")
+
+    if "_id" in session:
+        session.pop("_id")
+
+    if "_random" in session:
+        session.pop("_random")
+
+
+    cookie_name = current_app.config.get("REMEMBER_COOKIE_NAME", COOKIE_NAME)
+    if cookie_name in request.cookies:
+        session["_remember"] = "clear"
+        if "_remember_seconds" in session:
+            session.pop("_remember_seconds")
+
+    user_logged_out.send(current_app._get_current_object(), user=user)
+
+    current_app.login_manager._update_request_context_with_user()
+    return True
+
+
+def confirm_login():
+    """
+    This sets the current session as fresh. Sessions become stale when they
+    are reloaded from a cookie.
+    """
+    session["_fresh"] = True
+    session["_id"] = current_app.login_manager._session_identifier_generator()
+    user_login_confirmed.send(current_app._get_current_object())
+
+
+def login_required(func):
+    """
+    If you decorate a view with this, it will ensure that the current user is
+    logged in and authenticated before calling the actual view. (If they are
+    not, it calls the :attr:`LoginManager.unauthorized` callback.) For
+    example::
+
+        @app.route('/post')
+        @user_login_required
+        def post():
+            pass
+
+    If there are only certain times you need to require that your user is
+    logged in, you can do so with::
+
+        if not current_user.is_authenticated:
+            return current_app.login_manager.unauthorized()
+
+    ...which is essentially the code that this function adds to your views.
+
+    It can be convenient to globally turn off authentication when unit testing.
+    To enable this, if the application configuration variable `LOGIN_DISABLED`
+    is set to `True`, this decorator will be ignored.
+
+    .. Note ::
+
+        Per `W3 guidelines for CORS preflight requests
+        <http://www.w3.org/TR/cors/#cross-origin-request-with-preflight-0>`_,
+        HTTP ``OPTIONS`` requests are exempt from login checks.
+
+    :param func: The view function to decorate.
+    :type func: function
+    """
+
+    @wraps(func)
+    def decorated_view(*args, **kwargs):
+        if request.method in EXEMPT_METHODS or current_app.config.get("LOGIN_DISABLED"):
+            pass
+        elif not current_user.is_authenticated:
+            return current_app.login_manager.unauthorized()
+
+        # flask 1.x compatibility
+        # current_app.ensure_sync is only available in Flask >= 2.0
+        if callable(getattr(current_app, "ensure_sync", None)):
+            return current_app.ensure_sync(func)(*args, **kwargs)
+        return func(*args, **kwargs)
+
+    return decorated_view
+
+
+def fresh_login_required(func):
+    """
+    If you decorate a view with this, it will ensure that the current user's
+    login is fresh - i.e. their session was not restored from a 'remember me'
+    cookie. Sensitive operations, like changing a password or e-mail, should
+    be protected with this, to impede the efforts of cookie thieves.
+
+    If the user is not authenticated, :meth:`LoginManager.unauthorized` is
+    called as normal. If they are authenticated, but their session is not
+    fresh, it will call :meth:`LoginManager.needs_refresh` instead. (In that
+    case, you will need to provide a :attr:`LoginManager.refresh_view`.)
+
+    Behaves identically to the :func:`login_required` decorator with respect
+    to configuration variables.
+
+    .. Note ::
+
+        Per `W3 guidelines for CORS preflight requests
+        <http://www.w3.org/TR/cors/#cross-origin-request-with-preflight-0>`_,
+        HTTP ``OPTIONS`` requests are exempt from login checks.
+
+    :param func: The view function to decorate.
+    :type func: function
+    """
+
+    @wraps(func)
+    def decorated_view(*args, **kwargs):
+        if request.method in EXEMPT_METHODS or current_app.config.get("LOGIN_DISABLED"):
+            pass
+        elif not current_user.is_authenticated:
+            return current_app.login_manager.unauthorized()
+        elif not login_fresh():
+            return current_app.login_manager.needs_refresh()
+        try:
+            # current_app.ensure_sync available in Flask >= 2.0
+            return current_app.ensure_sync(func)(*args, **kwargs)
+        except AttributeError:  # pragma: no cover
+            return func(*args, **kwargs)
+
+    return decorated_view
+
+
+def set_login_view(login_view, blueprint=None):
+    """
+    Sets the login view for the app or blueprint. If a blueprint is passed,
+    the login view is set for this blueprint on ``blueprint_login_views``.
+
+    :param login_view: The user object to log in.
+    :type login_view: str
+    :param blueprint: The blueprint which this login view should be set on.
+        Defaults to ``None``.
+    :type blueprint: object
+    """
+
+    num_login_views = len(current_app.login_manager.blueprint_login_views)
+    if blueprint is not None or num_login_views != 0:
+        (current_app.login_manager.blueprint_login_views[blueprint.name]) = login_view
+
+        if (
+            current_app.login_manager.login_view is not None
+            and None not in current_app.login_manager.blueprint_login_views
+        ):
+            (
+                current_app.login_manager.blueprint_login_views[None]
+            ) = current_app.login_manager.login_view
+
+        current_app.login_manager.login_view = None
+    else:
+        current_app.login_manager.login_view = login_view
+
+
+def _get_user():
+    if has_request_context():
+        if "flask_httpauth_user" in g:
+            if g.flask_httpauth_user is not None:
+                return g.flask_httpauth_user
+        if "_login_user" not in g:
+            current_app.login_manager._load_user()
+
+        return g._login_user
+
+    return None
+
+
+def _cookie_digest(payload, key=None):
+    key = _secret_key(key)
+
+    return hmac.new(key, payload.encode("utf-8"), sha512).hexdigest()
+
+
+def _get_remote_addr():
+    address = request.headers.get("X-Forwarded-For", request.remote_addr)
+    if address is not None:
+        # An 'X-Forwarded-For' header includes a comma separated list of the
+        # addresses, the first address being the actual remote address.
+        address = address.encode("utf-8").split(b",")[0].strip()
+    return address
+
+
+def _create_identifier():
+    user_agent = request.headers.get("User-Agent")
+    if user_agent is not None:
+        user_agent = user_agent.encode("utf-8")
+    base = f"{_get_remote_addr()}|{user_agent}"
+    if str is bytes:
+        base = str(base, "utf-8", errors="replace")  # pragma: no cover
+    h = sha512()
+    h.update(base.encode("utf8"))
+    return h.hexdigest()
+
+
+def _user_context_processor():
+    return dict(current_user=_get_user())
+
+
+def _secret_key(key=None):
+    if key is None:
+        key = current_app.config["SECRET_KEY"]
+
+    if isinstance(key, str):  # pragma: no cover
+        key = key.encode("latin1")  # ensure bytes
+
+    return key
@@ -22,11 +22,8 @@ import glob
 import zipfile
 import json
 from io import BytesIO
-try:
-    from StringIO import StringIO
-except ImportError:
-    from io import StringIO
-
+from flask_babel.speaklater import LazyString
+from importlib.metadata import metadata
 import os

 from flask import send_file
@@ -36,16 +33,32 @@ from .about import collect_stats

 log = logger.create()

+
+class lazyEncoder(json.JSONEncoder):
+    def default(self, obj):
+        if isinstance(obj, LazyString):
+            return str(obj)
+        # Let the base class default method raise the TypeError
+        return json.JSONEncoder.default(self, obj)
+
+
 def assemble_logfiles(file_name):
    log_list = sorted(glob.glob(file_name + '*'), reverse=True)
-    wfd = StringIO()
+    wfd = BytesIO()
    for f in log_list:
-        with open(f, 'r') as fd:
+        with open(f, 'rb') as fd:
            shutil.copyfileobj(fd, wfd)
    wfd.seek(0)
-    return send_file(wfd,
-                     as_attachment=True,
-                     attachment_filename=os.path.basename(file_name))
+    version = metadata("flask")["Version"]
+    if int(version.split('.')[0]) < 2:
+        return send_file(wfd,
+                         as_attachment=True,
+                         attachment_filename=os.path.basename(file_name))
+    else:
+        return send_file(wfd,
+                         as_attachment=True,
+                         download_name=os.path.basename(file_name))
+

 def send_debug():
    file_list = glob.glob(logger.get_logfile(config.config_logfile) + '*')
@@ -55,11 +68,17 @@ def send_debug():
            file_list.remove(element)
    memory_zip = BytesIO()
    with zipfile.ZipFile(memory_zip, 'w', compression=zipfile.ZIP_DEFLATED) as zf:
-        zf.writestr('settings.txt', json.dumps(config.toDict()))
-        zf.writestr('libs.txt', json.dumps(collect_stats()))
+        zf.writestr('settings.txt', json.dumps(config.to_dict(), sort_keys=True, indent=2))
+        zf.writestr('libs.txt', json.dumps(collect_stats(), sort_keys=True, indent=2, cls=lazyEncoder))
        for fp in file_list:
            zf.write(fp, os.path.basename(fp))
    memory_zip.seek(0)
-    return send_file(memory_zip,
-                     as_attachment=True,
-                     attachment_filename="Calibre-Web-debug-pack.zip")
+    version = metadata("flask")["Version"]
+    if int(version.split('.')[0]) < 2:
+        return send_file(memory_zip,
+                         as_attachment=True,
+                         attachment_filename="Calibre-Web-debug-pack.zip")
+    else:
+        return send_file(memory_zip,
+                         as_attachment=True,
+                         download_name="Calibre-Web-debug-pack.zip")
@@ -0,0 +1,127 @@
+import os
+import re
+import sys
+import json
+
+from .constants import BASE_DIR
+try:
+    from importlib.metadata import version
+    importlib = True
+    ImportNotFound = BaseException
+except ImportError:
+    importlib = False
+    version = None
+
+if not importlib:
+    try:
+        import pkg_resources
+        from pkg_resources import DistributionNotFound as ImportNotFound
+        pkgresources = True
+    except ImportError as e:
+        pkgresources = False
+
+
+def load_dependencies(optional=False):
+    deps = list()
+    if getattr(sys, 'frozen', False):
+        pip_installed = os.path.join(BASE_DIR, ".pip_installed")
+        if os.path.exists(pip_installed):
+            with open(pip_installed) as f:
+                exe_deps = json.loads("".join(f.readlines()))
+        else:
+            return deps
+    if importlib or pkgresources:
+        if optional:
+            req_path = os.path.join(BASE_DIR, "optional-requirements.txt")
+        else:
+            req_path = os.path.join(BASE_DIR, "requirements.txt")
+        if os.path.exists(req_path):
+            with open(req_path, 'r') as f:
+                for line in f:
+                    if not line.startswith('#') and not line == '\n' and not line.startswith('git'):
+                        res = re.match(r'(.*?)([<=>\s]+)([\d\.]+),?\s?([<=>\s]+)?([\d\.]+)?(?:\s?;\s?'
+                                       r'(?:(python_version)\s?([<=>]+)\s?\'([\d\.]+)\'|'
+                                       r'(sys_platform)\s?([\!=]+)\s?\'([\w]+)\'))?', line.strip())
+                        try:
+                            if res.group(7) and res.group(8):
+                                val = res.group(8).split(".")
+                                if not eval(str(sys.version_info[0]) + "." + "{:02d}".format(sys.version_info[1]) +
+                                            res.group(7) + val[0] + "." + "{:02d}".format(int(val[1]))):
+                                    continue
+                            elif res.group(10) and res.group(11):
+                                # only installed if platform is eqal, don't check if platform is not equal
+                                if res.group(10) == "==":
+                                    if sys.platform != res.group(11):
+                                        continue
+                                # installed if platform is not eqal, don't check if platform is equal
+                                elif res.group(10) == "!=":
+                                    if sys.platform == res.group(11):
+                                        continue
+                            if getattr(sys, 'frozen', False):
+                                dep_version = exe_deps[res.group(1).lower().replace('_', '-')]
+                            else:
+                                if importlib:
+                                    dep_version = version(res.group(1))
+                                else:
+                                    dep_version = pkg_resources.get_distribution(res.group(1)).version
+                        except (ImportNotFound, KeyError):
+                            if optional:
+                                continue
+                            dep_version = "not installed"
+                        deps.append([dep_version, res.group(1), res.group(2), res.group(3), res.group(4), res.group(5)])
+    return deps
+
+
+def dependency_check(optional=False):
+    d = list()
+    dep_version_int = None
+    low_check = None
+    deps = load_dependencies(optional)
+    for dep in deps:
+        try:
+            dep_version_int = [int(x) if x.isnumeric() else 0 for x in dep[0].split('.')[:3]]
+            low_check = [int(x) for x in dep[3].split('.')]
+            high_check = [int(x) for x in dep[5].split('.')]
+        except AttributeError:
+            high_check = []
+        except ValueError:
+            d.append({'name': dep[1],
+                      'target': "available",
+                      'found': "Not available"
+                      })
+            continue
+
+        if dep[2].strip() == "==":
+            if dep_version_int != low_check:
+                d.append({'name': dep[1],
+                          'found': dep[0],
+                          "target": dep[2] + dep[3]})
+                continue
+        elif dep[2].strip() == ">=":
+            if dep_version_int < low_check:
+                d.append({'name': dep[1],
+                          'found': dep[0],
+                          "target": dep[2] + dep[3]})
+                continue
+        elif dep[2].strip() == ">":
+            if dep_version_int <= low_check:
+                d.append({'name': dep[1],
+                          'found': dep[0],
+                          "target": dep[2] + dep[3]})
+                continue
+        if dep[4] and dep[5]:
+            if dep[4].strip() == "<":
+                if dep_version_int >= high_check:
+                    d.append(
+                        {'name': dep[1],
+                         'found': dep[0],
+                         "target": dep[4] + dep[5]})
+                    continue
+            elif dep[4].strip() == "<=":
+                if dep_version_int > high_check:
+                    d.append(
+                        {'name': dep[1],
+                         'found': dep[0],
+                         "target": dep[4] + dep[5]})
+                    continue
+    return d
@@ -0,0 +1,62 @@
+# -*- coding: utf-8 -*-
+
+#  This file is part of the Calibre-Web (https://github.com/janeczku/calibre-web)
+#    Copyright (C) 2024 OzzieIsaacs
+#
+#  This program is free software: you can redistribute it and/or modify
+#  it under the terms of the GNU General Public License as published by
+#  the Free Software Foundation, either version 3 of the License, or
+#  (at your option) any later version.
+#
+#  This program is distributed in the hope that it will be useful,
+#  but WITHOUT ANY WARRANTY; without even the implied warranty of
+#  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+#  GNU General Public License for more details.
+#
+#  You should have received a copy of the GNU General Public License
+#  along with this program. If not, see <http://www.gnu.org/licenses/>.
+from uuid import uuid4
+import os
+
+from .file_helper import get_temp_dir
+from .subproc_wrapper import process_open
+from . import logger, config
+from .constants import SUPPORTED_CALIBRE_BINARIES
+
+log = logger.create()
+
+
+def do_calibre_export(book_id, book_format):
+    try:
+        quotes = [4, 6]
+        tmp_dir = get_temp_dir()
+        calibredb_binarypath = get_calibre_binarypath("calibredb")
+        temp_file_name = str(uuid4())
+        my_env = os.environ.copy()
+        if config.config_calibre_split:
+            my_env['CALIBRE_OVERRIDE_DATABASE_PATH'] = os.path.join(config.config_calibre_dir, "metadata.db")
+        library_path = config.get_book_path()
+        opf_command = [calibredb_binarypath, 'export', '--dont-write-opf', '--dont-save-cover',
+                       '--with-library', library_path,
+                       '--to-dir', tmp_dir, '--formats', book_format, "--template", "{}".format(temp_file_name),
+                       str(book_id)]
+        p = process_open(opf_command, quotes, my_env)
+        _, err = p.communicate()
+        if err:
+            log.error('Metadata embedder encountered an error: %s', err)
+        return tmp_dir, temp_file_name
+    except OSError as ex:
+        # ToDo real error handling
+        log.error_or_exception(ex)
+        return None, None
+
+
+def get_calibre_binarypath(binary):
+    binariesdir = config.config_binariesdir
+    if binariesdir:
+        try:
+            return os.path.join(binariesdir, SUPPORTED_CALIBRE_BINARIES[binary])
+        except KeyError as ex:
+            log.error("Binary not supported by Calibre-Web: %s", SUPPORTED_CALIBRE_BINARIES[binary])
+            pass
+    return ""
@@ -16,68 +16,95 @@
 #  You should have received a copy of the GNU General Public License
 #  along with this program. If not, see <http://www.gnu.org/licenses/>.

-from __future__ import division, print_function, unicode_literals
 import os
 import zipfile
 from lxml import etree

-from . import isoLanguages
+from . import isoLanguages, cover
+from . import config, logger
 from .helper import split_authors
+from .epub_helper import get_content_opf, default_ns
 from .constants import BookMeta
+from .string_helper import strip_whitespaces
+
+log = logger.create()


+def _extract_cover(zip_file, cover_file, cover_path, tmp_file_name):
+    if cover_file is None:
+        return None

-def extractCover(zipFile, coverFile, coverpath, tmp_file_name):
-    if coverFile is None:
+    cf = extension = None
+    zip_cover_path = os.path.join(cover_path, cover_file).replace('\\', '/')
+
+    prefix = os.path.splitext(tmp_file_name)[0]
+    tmp_cover_name = prefix + '.' + os.path.basename(zip_cover_path)
+    ext = os.path.splitext(tmp_cover_name)
+    if len(ext) > 1:
+        extension = ext[1].lower()
+    if extension in cover.COVER_EXTENSIONS:
+        cf = zip_file.read(zip_cover_path)
+    return cover.cover_processing(tmp_file_name, cf, extension)
+
+
+def get_epub_layout(book, book_data):
+    file_path = os.path.normpath(os.path.join(config.get_book_path(),
+                                              book.path, book_data.name + "." + book_data.format.lower()))
+
+    try:
+        tree, __ = get_content_opf(file_path, default_ns)
+        p = tree.xpath('/pkg:package/pkg:metadata', namespaces=default_ns)[0]
+
+        layout = p.xpath('pkg:meta[@property="rendition:layout"]/text()', namespaces=default_ns)
+    except (etree.XMLSyntaxError, KeyError, IndexError, OSError, UnicodeDecodeError) as e:
+        log.error("Could not parse epub metadata of book {} during kobo sync: {}".format(book.id, e))
+        layout = []
+
+    if len(layout) == 0:
        return None
    else:
-        zipCoverPath = os.path.join(coverpath, coverFile).replace('\\', '/')
-        cf = zipFile.read(zipCoverPath)
-        prefix = os.path.splitext(tmp_file_name)[0]
-        tmp_cover_name = prefix + '.' + os.path.basename(zipCoverPath)
-        image = open(tmp_cover_name, 'wb')
-        image.write(cf)
-        image.close()
-        return tmp_cover_name
+        return layout[0]


-def get_epub_info(tmp_file_path, original_file_name, original_file_extension):
+def get_epub_info(tmp_file_path, original_file_name, original_file_extension, no_cover_processing):
    ns = {
        'n': 'urn:oasis:names:tc:opendocument:xmlns:container',
        'pkg': 'http://www.idpf.org/2007/opf',
        'dc': 'http://purl.org/dc/elements/1.1/'
    }

-    epubZip = zipfile.ZipFile(tmp_file_path)
+    tree, cf_name = get_content_opf(tmp_file_path, ns)

-    txt = epubZip.read('META-INF/container.xml')
-    tree = etree.fromstring(txt)
-    cfname = tree.xpath('n:rootfiles/n:rootfile/@full-path', namespaces=ns)[0]
-    cf = epubZip.read(cfname)
-    tree = etree.fromstring(cf)
-
-    coverpath = os.path.dirname(cfname)
+    cover_path = os.path.dirname(cf_name)

    p = tree.xpath('/pkg:package/pkg:metadata', namespaces=ns)[0]

    epub_metadata = {}

-    for s in ['title', 'description', 'creator', 'language', 'subject']:
+    for s in ['title', 'description', 'creator', 'language', 'subject', 'publisher', 'date']:
        tmp = p.xpath('dc:%s/text()' % s, namespaces=ns)
        if len(tmp) > 0:
            if s == 'creator':
                epub_metadata[s] = ' & '.join(split_authors(tmp))
            elif s == 'subject':
                epub_metadata[s] = ', '.join(tmp)
+            elif s == 'date':
+                epub_metadata[s] = tmp[0][:10]
            else:
-                epub_metadata[s] = tmp[0]
+                epub_metadata[s] = strip_whitespaces(tmp[0])
        else:
-            epub_metadata[s] = u'Unknown'
+            epub_metadata[s] = 'Unknown'

-    if epub_metadata['subject'] == u'Unknown':
+    if epub_metadata['subject'] == 'Unknown':
        epub_metadata['subject'] = ''

-    if epub_metadata['description'] == u'Unknown':
+    if epub_metadata['publisher'] == 'Unknown':
+        epub_metadata['publisher'] = ''
+
+    if epub_metadata['date'] == 'Unknown':
+        epub_metadata['date'] = ''
+
+    if epub_metadata['description'] == 'Unknown':
        description = tree.xpath("//*[local-name() = 'description']/text()")
        if len(description) > 0:
            epub_metadata['description'] = description
@@ -87,45 +114,24 @@ def get_epub_info(tmp_file_path, original_file_name, original_file_extension):
    lang = epub_metadata['language'].split('-', 1)[0].lower()
    epub_metadata['language'] = isoLanguages.get_lang3(lang)

-    series = tree.xpath("/pkg:package/pkg:metadata/pkg:meta[@name='calibre:series']/@content", namespaces=ns)
-    if len(series) > 0:
-        epub_metadata['series'] = series[0]
-    else:
-        epub_metadata['series'] = ''
+    epub_metadata = parse_epub_series(ns, tree, epub_metadata)

-    series_id = tree.xpath("/pkg:package/pkg:metadata/pkg:meta[@name='calibre:series_index']/@content", namespaces=ns)
-    if len(series_id) > 0:
-        epub_metadata['series_id'] = series_id[0]
+    epub_zip = zipfile.ZipFile(tmp_file_path)
+    if not no_cover_processing:
+        cover_file = parse_epub_cover(ns, tree, epub_zip, cover_path, tmp_file_path)
    else:
-        epub_metadata['series_id'] = '1'
+        cover_file = None

-    coversection = tree.xpath("/pkg:package/pkg:manifest/pkg:item[@id='cover-image']/@href", namespaces=ns)
-    coverfile = None
-    if len(coversection) > 0:
-        coverfile = extractCover(epubZip, coversection[0], coverpath, tmp_file_path)
-    else:
-        meta_cover = tree.xpath("/pkg:package/pkg:metadata/pkg:meta[@name='cover']/@content", namespaces=ns)
-        if len(meta_cover) > 0:
-            coversection = tree.xpath("/pkg:package/pkg:manifest/pkg:item[@id='"+meta_cover[0]+"']/@href", namespaces=ns)
-        else:
-            coversection = tree.xpath("/pkg:package/pkg:guide/pkg:reference/@href", namespaces=ns)
-        if len(coversection) > 0:
-            filetype = coversection[0].rsplit('.', 1)[-1]
-            if filetype == "xhtml" or filetype == "html":  # if cover is (x)html format
-                markup = epubZip.read(os.path.join(coverpath, coversection[0]))
-                markupTree = etree.fromstring(markup)
-                # no matter xhtml or html with no namespace
-                imgsrc = markupTree.xpath("//*[local-name() = 'img']/@src")
-                # Alternative image source
-                if not len(imgsrc):
-                    imgsrc = markupTree.xpath("//attribute::*[contains(local-name(), 'href')]")
-                if len(imgsrc):
-                    # imgsrc maybe startwith "../"" so fullpath join then relpath to cwd
-                    filename = os.path.relpath(os.path.join(os.path.dirname(os.path.join(coverpath, coversection[0])),
-                                                            imgsrc[0]))
-                    coverfile = extractCover(epubZip, filename, "", tmp_file_path)
-            else:
-                coverfile = extractCover(epubZip, coversection[0], coverpath, tmp_file_path)
+    identifiers = []
+    for node in p.xpath('dc:identifier', namespaces=ns):
+        try:
+            identifier_name = node.attrib.values()[-1]
+        except IndexError:
+            continue
+        identifier_value = node.text
+        if identifier_name in ('uuid', 'calibre') or identifier_value is None:
+            continue
+        identifiers.append([identifier_name, identifier_value])

    if not epub_metadata['title']:
        title = original_file_name
@@ -137,9 +143,66 @@ def get_epub_info(tmp_file_path, original_file_name, original_file_extension):
        extension=original_file_extension,
        title=title.encode('utf-8').decode('utf-8'),
        author=epub_metadata['creator'].encode('utf-8').decode('utf-8'),
-        cover=coverfile,
+        cover=cover_file,
        description=epub_metadata['description'],
        tags=epub_metadata['subject'].encode('utf-8').decode('utf-8'),
        series=epub_metadata['series'].encode('utf-8').decode('utf-8'),
        series_id=epub_metadata['series_id'].encode('utf-8').decode('utf-8'),
-        languages=epub_metadata['language'])
+        languages=epub_metadata['language'],
+        publisher=epub_metadata['publisher'].encode('utf-8').decode('utf-8'),
+        pubdate=epub_metadata['date'],
+        identifiers=identifiers)
+
+
+def parse_epub_cover(ns, tree, epub_zip, cover_path, tmp_file_path):
+    cover_section = tree.xpath("/pkg:package/pkg:manifest/pkg:item[@id='cover-image']/@href", namespaces=ns)
+    for cs in cover_section:
+        cover_file = _extract_cover(epub_zip, cs, cover_path, tmp_file_path)
+        if cover_file:
+            return cover_file
+
+    meta_cover = tree.xpath("/pkg:package/pkg:metadata/pkg:meta[@name='cover']/@content", namespaces=ns)
+    if len(meta_cover) > 0:
+        cover_section = tree.xpath(
+            "/pkg:package/pkg:manifest/pkg:item[@id='"+meta_cover[0]+"']/@href", namespaces=ns)
+        if not cover_section:
+            cover_section = tree.xpath(
+                "/pkg:package/pkg:manifest/pkg:item[@properties='" + meta_cover[0] + "']/@href", namespaces=ns)
+    else:
+        cover_section = tree.xpath("/pkg:package/pkg:guide/pkg:reference/@href", namespaces=ns)
+
+    cover_file = None
+    for cs in cover_section:
+        if cs.endswith('.xhtml') or cs.endswith('.html'):
+            markup = epub_zip.read(os.path.join(cover_path, cs))
+            markup_tree = etree.fromstring(markup, parser=etree.XMLParser(resolve_entities=False, no_network=True))
+            # no matter xhtml or html with no namespace
+            img_src = markup_tree.xpath("//*[local-name() = 'img']/@src")
+            # Alternative image source
+            if not len(img_src):
+                img_src = markup_tree.xpath("//attribute::*[contains(local-name(), 'href')]")
+            if len(img_src):
+                # img_src maybe start with "../"" so fullpath join then relpath to cwd
+                filename = os.path.relpath(os.path.join(os.path.dirname(os.path.join(cover_path, cover_section[0])),
+                                                        img_src[0]))
+                cover_file = _extract_cover(epub_zip, filename, "", tmp_file_path)
+        else:
+            cover_file = _extract_cover(epub_zip, cs, cover_path, tmp_file_path)
+        if cover_file:
+            break
+    return cover_file
+
+
+def parse_epub_series(ns, tree, epub_metadata):
+    series = tree.xpath("/pkg:package/pkg:metadata/pkg:meta[@name='calibre:series']/@content", namespaces=ns)
+    if len(series) > 0:
+        epub_metadata['series'] = series[0]
+    else:
+        epub_metadata['series'] = ''
+
+    series_id = tree.xpath("/pkg:package/pkg:metadata/pkg:meta[@name='calibre:series_index']/@content", namespaces=ns)
+    if len(series_id) > 0:
+        epub_metadata['series_id'] = series_id[0]
+    else:
+        epub_metadata['series_id'] = '1'
+    return epub_metadata
@@ -0,0 +1,173 @@
+# -*- coding: utf-8 -*-
+
+#  This file is part of the Calibre-Web (https://github.com/janeczku/calibre-web)
+#    Copyright (C) 2018 lemmsh, Kennyl, Kyosfonica, matthazinski
+#
+#  This program is free software: you can redistribute it and/or modify
+#  it under the terms of the GNU General Public License as published by
+#  the Free Software Foundation, either version 3 of the License, or
+#  (at your option) any later version.
+#
+#  This program is distributed in the hope that it will be useful,
+#  but WITHOUT ANY WARRANTY; without even the implied warranty of
+#  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+#  GNU General Public License for more details.
+#
+#  You should have received a copy of the GNU General Public License
+#  along with this program. If not, see <http://www.gnu.org/licenses/>.
+
+import zipfile
+from lxml import etree
+
+from . import isoLanguages
+
+default_ns = {
+    'n': 'urn:oasis:names:tc:opendocument:xmlns:container',
+    'pkg': 'http://www.idpf.org/2007/opf',
+}
+
+OPF_NAMESPACE = "http://www.idpf.org/2007/opf"
+PURL_NAMESPACE = "http://purl.org/dc/elements/1.1/"
+
+OPF = "{%s}" % OPF_NAMESPACE
+PURL = "{%s}" % PURL_NAMESPACE
+
+etree.register_namespace("opf", OPF_NAMESPACE)
+etree.register_namespace("dc", PURL_NAMESPACE)
+
+OPF_NS = {None: OPF_NAMESPACE}  # the default namespace (no prefix)
+NSMAP = {'dc': PURL_NAMESPACE, 'opf': OPF_NAMESPACE}
+
+
+def updateEpub(src, dest, filename, data, ):
+    # create a temp copy of the archive without filename
+    with zipfile.ZipFile(src, 'r') as zin:
+        with zipfile.ZipFile(dest, 'w') as zout:
+            zout.comment = zin.comment  # preserve the comment
+            for item in zin.infolist():
+                if item.filename != filename:
+                    zout.writestr(item, zin.read(item.filename))
+
+    # now add filename with its new data
+    with zipfile.ZipFile(dest, mode='a', compression=zipfile.ZIP_DEFLATED) as zf:
+        zf.writestr(filename, data)
+
+
+# Safe parser: disable entity resolution and network access to prevent XXE attacks
+_safe_parser = etree.XMLParser(resolve_entities=False, no_network=True)
+
+
+def get_content_opf(file_path, ns=None):
+    if ns is None:
+        ns = default_ns
+    epubZip = zipfile.ZipFile(file_path)
+    txt = epubZip.read('META-INF/container.xml')
+    tree = etree.fromstring(txt, parser=_safe_parser)
+    cf_name = tree.xpath('n:rootfiles/n:rootfile/@full-path', namespaces=ns)[0]
+    cf = epubZip.read(cf_name)
+
+    return etree.fromstring(cf, parser=_safe_parser), cf_name
+
+
+def create_new_metadata_backup(book,  custom_columns, export_language, translated_cover_name, lang_type=3):
+    # generate root package element
+    package = etree.Element(OPF + "package", nsmap=OPF_NS)
+    package.set("unique-identifier", "uuid_id")
+    package.set("version", "2.0")
+
+    # generate metadata element and all sub elements of it
+    metadata = etree.SubElement(package, "metadata", nsmap=NSMAP)
+    identifier = etree.SubElement(metadata, PURL + "identifier", id="calibre_id", nsmap=NSMAP)
+    identifier.set(OPF + "scheme", "calibre")
+    identifier.text = str(book.id)
+    identifier2 = etree.SubElement(metadata, PURL + "identifier", id="uuid_id", nsmap=NSMAP)
+    identifier2.set(OPF + "scheme", "uuid")
+    identifier2.text = book.uuid
+    for i in book.identifiers:
+        identifier = etree.SubElement(metadata, PURL + "identifier", nsmap=NSMAP)
+        identifier.set(OPF + "scheme", i.format_type())
+        identifier.text = str(i.val)
+    title = etree.SubElement(metadata, PURL + "title", nsmap=NSMAP)
+    title.text = book.title
+    for author in book.authors:
+        creator = etree.SubElement(metadata, PURL + "creator", nsmap=NSMAP)
+        creator.text = str(author.name)
+        creator.set(OPF + "file-as", book.author_sort)     # ToDo Check
+        creator.set(OPF + "role", "aut")
+    contributor = etree.SubElement(metadata, PURL + "contributor", nsmap=NSMAP)
+    contributor.text = "calibre (5.7.2) [https://calibre-ebook.com]"
+    contributor.set(OPF + "file-as", "calibre")     # ToDo Check
+    contributor.set(OPF + "role", "bkp")
+
+    date = etree.SubElement(metadata, PURL + "date", nsmap=NSMAP)
+    date.text = '{d.year:04}-{d.month:02}-{d.day:02}T{d.hour:02}:{d.minute:02}:{d.second:02}'.format(d=book.pubdate)
+    if book.comments and book.comments[0].text:
+        for b in book.comments:
+            description = etree.SubElement(metadata, PURL + "description", nsmap=NSMAP)
+            description.text = b.text
+    for b in book.publishers:
+        publisher = etree.SubElement(metadata, PURL + "publisher", nsmap=NSMAP)
+        publisher.text = str(b.name)
+    if not book.languages:
+        language = etree.SubElement(metadata, PURL + "language", nsmap=NSMAP)
+        language.text = export_language
+    else:
+        for b in book.languages:
+            language = etree.SubElement(metadata, PURL + "language", nsmap=NSMAP)
+            language.text = str(b.lang_code) if lang_type == 3 else isoLanguages.get(part3=b.lang_code).part1
+    for b in book.tags:
+        subject = etree.SubElement(metadata, PURL + "subject", nsmap=NSMAP)
+        subject.text = str(b.name)
+    etree.SubElement(metadata, "meta", name="calibre:author_link_map",
+                     content="{" + ", ".join(['"' + str(a.name) + '": ""' for a in book.authors]) + "}",
+                     nsmap=NSMAP)
+    for b in book.series:
+        etree.SubElement(metadata, "meta", name="calibre:series",
+                         content=str(str(b.name)),
+                         nsmap=NSMAP)
+    if book.series:
+        etree.SubElement(metadata, "meta", name="calibre:series_index",
+                         content=str(book.series_index),
+                         nsmap=NSMAP)
+    if len(book.ratings) and book.ratings[0].rating > 0:
+        etree.SubElement(metadata, "meta", name="calibre:rating",
+                         content=str(book.ratings[0].rating),
+                         nsmap=NSMAP)
+    etree.SubElement(metadata, "meta", name="calibre:timestamp",
+                     content='{d.year:04}-{d.month:02}-{d.day:02}T{d.hour:02}:{d.minute:02}:{d.second:02}'.format(
+                         d=book.timestamp),
+                     nsmap=NSMAP)
+    etree.SubElement(metadata, "meta", name="calibre:title_sort",
+                     content=book.sort,
+                     nsmap=NSMAP)
+    sequence = 0
+    for cc in custom_columns:
+        value = None
+        extra = None
+        cc_entry = getattr(book, "custom_column_" + str(cc.id))
+        if cc_entry.__len__():
+            value = [c.value for c in cc_entry] if cc.is_multiple else cc_entry[0].value
+            extra = cc_entry[0].extra if hasattr(cc_entry[0], "extra") else None
+        etree.SubElement(metadata, "meta", name="calibre:user_metadata:#{}".format(cc.label),
+                         content=cc.to_json(value, extra, sequence),
+                         nsmap=NSMAP)
+        sequence += 1
+
+    # generate guide element and all sub elements of it
+    # Title is translated from default export language
+    guide = etree.SubElement(package, "guide")
+    etree.SubElement(guide, "reference", type="cover", title=translated_cover_name, href="cover.jpg")
+
+    return package
+
+
+def replace_metadata(tree, package):
+    rep_element = tree.xpath('/pkg:package/pkg:metadata', namespaces=default_ns)[0]
+    new_element = package.xpath('//metadata', namespaces=default_ns)[0]
+    tree.replace(rep_element, new_element)
+    return etree.tostring(tree,
+                          xml_declaration=True,
+                          encoding='utf-8',
+                          pretty_print=True).decode('utf-8')
+
+
@@ -17,37 +17,72 @@
 #  along with this program. If not, see <http://www.gnu.org/licenses/>.

 import traceback
-from flask import render_template
+
+from flask import render_template, request, flash, make_response
+from flask_limiter import RateLimitExceeded
+from flask_babel import gettext as _
 from werkzeug.exceptions import default_exceptions
+
+from .cw_login import current_user
 try:
    from werkzeug.exceptions import FailedDependency
 except ImportError:
    from werkzeug.exceptions import UnprocessableEntity as FailedDependency

 from . import config, app, logger, services
-
+from .render_template import render_title_template
+from .web import render_login
+from .usermanagement import auth
+from cps.string_helper import strip_whitespaces

 log = logger.create()

 # custom error page
+
 def error_http(error):
+    headers = {'WWW-Authenticate': 'Basic realm="calibre-web"'} if error.code == 401 else {}
    return render_template('http_error.html',
                           error_code="Error {0}".format(error.code),
                           error_name=error.name,
                           issue=False,
+                           goto_admin=False,
+                           unconfigured=not config.db_configured,
                           instance=config.config_calibre_web_title
-                           ), error.code
+                           ), error.code, headers


 def internal_error(error):
+    if (isinstance(error.original_exception, AttributeError) and
+        error.original_exception.args[0] == "'NoneType' object has no attribute 'query'"
+        and error.original_exception.name == "query"):
+        return render_template('http_error.html',
+                               error_code="Database Error",
+                               error_name='The library used is invalid or has permission errors',
+                               issue=False,
+                               goto_admin=True,
+                               unconfigured=False,
+                               error_stack="",
+                               instance=config.config_calibre_web_title
+                               ), 500
+    log.error("500 Internal Server Error: %s", traceback.format_exc())
+    error_stack = ""
+    try:
+        if current_user.is_authenticated and current_user.role_admin():
+            error_stack = traceback.format_exc().split("\n")
+    except Exception:
+        pass
    return render_template('http_error.html',
-                           error_code="Internal Server Error",
-                           error_name=str(error),
+                           error_code="500 Internal Server Error",
+                           error_name='The server encountered an internal error and was unable to complete your '
+                                      'request. There is an error in the application.',
                           issue=True,
-                           error_stack=traceback.format_exc().split("\n"),
+                           goto_admin=False,
+                           unconfigured=False,
+                           error_stack=error_stack,
                           instance=config.config_calibre_web_title
                           ), 500

+
 def init_errorhandler():
    # http error handling
    for ex in default_exceptions:
@@ -56,18 +91,29 @@ def init_errorhandler():
        elif ex == 500:
            app.register_error_handler(ex, internal_error)

-
    if services.ldap:
        # Only way of catching the LDAPException upon logging in with LDAP server down
        @app.errorhandler(services.ldap.LDAPException)
+        # pylint: disable=unused-variable
        def handle_exception(e):
            log.debug('LDAP server not accessible while trying to login to opds feed')
            return error_http(FailedDependency())


-# @app.errorhandler(InvalidRequestError)
-#@app.errorhandler(OperationalError)
-#def handle_db_exception(e):
-#    db.session.rollback()
-#    log.error('Database request error: %s',e)
-#    return internal_error(InternalServerError(e))
+@app.errorhandler(RateLimitExceeded)
+def handle_rate_limit(__):
+    log.error("Rate limit exceeded {}".format(request.endpoint))
+    if "register" in request.endpoint:
+        flash(_(u"Please wait one minute to register next user"), category="error")
+        return render_title_template('register.html', config=config, title=_("Register"), page="register")
+    elif "login" in request.endpoint:
+        form = request.form.to_dict()
+        username = strip_whitespaces(form.get('username', "")).lower().replace("\n", "").replace("\r", "")
+        flash(_("Please wait one minute before next login"), category="error")
+        return render_login(username, form.get("password", ""))
+    elif "opds" in request.endpoint:
+        return auth.auth_error_callback(429)
+    else:
+        return make_response('', 429)
+
+
@@ -16,11 +16,13 @@
 #  You should have received a copy of the GNU General Public License
 #  along with this program. If not, see <http://www.gnu.org/licenses/>.

-from __future__ import division, print_function, unicode_literals
 from lxml import etree

 from .constants import BookMeta

+# Safe parser: disable entity resolution and network access to prevent XXE attacks
+_safe_parser = etree.XMLParser(resolve_entities=False, no_network=True)
+

 def get_fb2_info(tmp_file_path, original_file_extension):

@@ -29,52 +31,55 @@ def get_fb2_info(tmp_file_path, original_file_extension):
        'l': 'http://www.w3.org/1999/xlink',
    }

-    fb2_file = open(tmp_file_path)
-    tree = etree.fromstring(fb2_file.read())
+    fb2_file = open(tmp_file_path, encoding="utf-8")
+    tree = etree.fromstring(fb2_file.read().encode(), parser=_safe_parser)

    authors = tree.xpath('/fb:FictionBook/fb:description/fb:title-info/fb:author', namespaces=ns)

    def get_author(element):
        last_name = element.xpath('fb:last-name/text()', namespaces=ns)
        if len(last_name):
-            last_name = last_name[0].encode('utf-8')
+            last_name = last_name[0]
        else:
-            last_name = u''
+            last_name = ''
        middle_name = element.xpath('fb:middle-name/text()', namespaces=ns)
        if len(middle_name):
-            middle_name = middle_name[0].encode('utf-8')
+            middle_name = middle_name[0]
        else:
-            middle_name = u''
+            middle_name = ''
        first_name = element.xpath('fb:first-name/text()', namespaces=ns)
        if len(first_name):
-            first_name = first_name[0].encode('utf-8')
+            first_name = first_name[0]
        else:
-            first_name = u''
-        return (first_name.decode('utf-8') + u' '
-                + middle_name.decode('utf-8') + u' '
-                + last_name.decode('utf-8')).encode('utf-8')
+            first_name = ''
+        return (first_name + ' '
+                + middle_name + ' '
+                + last_name)

    author = str(", ".join(map(get_author, authors)))

    title = tree.xpath('/fb:FictionBook/fb:description/fb:title-info/fb:book-title/text()', namespaces=ns)
    if len(title):
-        title = str(title[0].encode('utf-8'))
+        title = str(title[0])
    else:
-        title = u''
+        title = ''
    description = tree.xpath('/fb:FictionBook/fb:description/fb:publish-info/fb:book-name/text()', namespaces=ns)
    if len(description):
-        description = str(description[0].encode('utf-8'))
+        description = str(description[0])
    else:
-        description = u''
+        description = ''

    return BookMeta(
        file_path=tmp_file_path,
        extension=original_file_extension,
-        title=title.decode('utf-8'),
-        author=author.decode('utf-8'),
+        title=title,
+        author=author,
        cover=None,
-        description=description.decode('utf-8'),
+        description=description,
        tags="",
        series="",
        series_id="",
-        languages="")
+        languages="",
+        publisher="",
+        pubdate="",
+        identifiers=[])
@@ -0,0 +1,83 @@
+# -*- coding: utf-8 -*-
+
+#  This file is part of the Calibre-Web (https://github.com/janeczku/calibre-web)
+#    Copyright (C) 2023 OzzieIsaacs
+#
+#  This program is free software: you can redistribute it and/or modify
+#  it under the terms of the GNU General Public License as published by
+#  the Free Software Foundation, either version 3 of the License, or
+#  (at your option) any later version.
+#
+#  This program is distributed in the hope that it will be useful,
+#  but WITHOUT ANY WARRANTY; without even the implied warranty of
+#  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+#  GNU General Public License for more details.
+#
+#  You should have received a copy of the GNU General Public License
+#  along with this program. If not, see <http://www.gnu.org/licenses/>.
+
+from tempfile import gettempdir
+import os
+import shutil
+import zipfile
+import mimetypes
+from io import BytesIO
+
+from . import logger
+
+log = logger.create()
+
+try:
+    import magic
+    error = None
+except ImportError as e:
+    error = "Cannot import python-magic, checking uploaded file metadata will not work: {}".format(e)
+
+
+def get_mimetype(ext):
+    # overwrite some mimetypes for proper file detection
+    mimes = {".fb2": "text/xml",
+             ".cbz": "application/zip",
+             ".cbr": "application/x-rar"
+             }
+    return mimes.get(ext, mimetypes.types_map[ext])
+
+
+def get_temp_dir():
+    tmp_dir = os.path.join(gettempdir(), 'calibre_web')
+    if not os.path.isdir(tmp_dir):
+        os.mkdir(tmp_dir)
+    return tmp_dir
+
+
+def del_temp_dir():
+    tmp_dir = os.path.join(gettempdir(), 'calibre_web')
+    shutil.rmtree(tmp_dir)
+
+
+def validate_mime_type(file_buffer, allowed_extensions):
+    if error:
+        log.error(error)
+        return False
+    mime = magic.Magic(mime=True)
+    allowed_mimetypes = list()
+    for x in allowed_extensions:
+        try:
+            allowed_mimetypes.append(get_mimetype("." + x))
+        except KeyError:
+            log.error("Unkown mimetype for Extension: {}".format(x))
+    tmp_mime_type = mime.from_buffer(file_buffer.read())
+    file_buffer.seek(0)
+    if any(mime_type in tmp_mime_type for mime_type in allowed_mimetypes):
+        return True
+    # Some epubs show up as zip mimetypes
+    elif "zip" in tmp_mime_type:
+        try:
+            with zipfile.ZipFile(BytesIO(file_buffer.read()), 'r') as epub:
+                file_buffer.seek(0)
+                if "mimetype" in epub.namelist():
+                    return True
+        except:
+            file_buffer.seek(0)
+    log.error("Mimetype '{}' not found in allowed types".format(tmp_mime_type))
+    return False
@@ -0,0 +1,95 @@
+# -*- coding: utf-8 -*-
+
+#   This file is part of the Calibre-Web (https://github.com/janeczku/calibre-web)
+#     Copyright (C) 2020 mmonkey
+#
+#   This program is free software: you can redistribute it and/or modify
+#   it under the terms of the GNU General Public License as published by
+#   the Free Software Foundation, either version 3 of the License, or
+#   (at your option) any later version.
+#
+#   This program is distributed in the hope that it will be useful,
+#   but WITHOUT ANY WARRANTY; without even the implied warranty of
+#   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+#   GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public License
+#   along with this program. If not, see <http://www.gnu.org/licenses/>.
+
+from . import logger
+from .constants import CACHE_DIRECTORY
+from os import makedirs, remove
+from os.path import isdir, isfile, join
+from shutil import rmtree
+
+
+class FileSystem:
+    _instance = None
+    _cache_dir = CACHE_DIRECTORY
+
+    def __new__(cls):
+        if cls._instance is None:
+            cls._instance = super(FileSystem, cls).__new__(cls)
+            cls.log = logger.create()
+        return cls._instance
+
+    def get_cache_dir(self, cache_type=None):
+        if not isdir(self._cache_dir):
+            try:
+                makedirs(self._cache_dir)
+            except OSError:
+                self.log.info(f'Failed to create path {self._cache_dir} (Permission denied).')
+                raise
+
+        path = join(self._cache_dir, cache_type)
+        if cache_type and not isdir(path):
+            try:
+                makedirs(path)
+            except OSError:
+                self.log.info(f'Failed to create path {path} (Permission denied).')
+                raise
+
+        return path if cache_type else self._cache_dir
+
+    def get_cache_file_dir(self, filename, cache_type=None):
+        path = join(self.get_cache_dir(cache_type), filename[:2])
+        if not isdir(path):
+            try:
+                makedirs(path)
+            except OSError:
+                self.log.info(f'Failed to create path {path} (Permission denied).')
+                raise
+
+        return path
+
+    def get_cache_file_path(self, filename, cache_type=None):
+        return join(self.get_cache_file_dir(filename, cache_type), filename) if filename else None
+
+    def get_cache_file_exists(self, filename, cache_type=None):
+        path = self.get_cache_file_path(filename, cache_type)
+        return isfile(path)
+
+    def delete_cache_dir(self, cache_type=None):
+        if not cache_type and isdir(self._cache_dir):
+            try:
+                rmtree(self._cache_dir)
+            except OSError:
+                self.log.info(f'Failed to delete path {self._cache_dir} (Permission denied).')
+                raise
+
+        path = join(self._cache_dir, cache_type)
+        if cache_type and isdir(path):
+            try:
+                rmtree(path)
+            except OSError:
+                self.log.info(f'Failed to delete path {path} (Permission denied).')
+                raise
+
+    def delete_cache_file(self, filename, cache_type=None):
+        path = self.get_cache_file_path(filename, cache_type)
+        if isfile(path):
+            try:
+                remove(path)
+            except OSError:
+                self.log.info(f'Failed to delete path {path} (Permission denied).')
+                raise
@@ -20,22 +20,20 @@
 #  You should have received a copy of the GNU General Public License
 #  along with this program. If not, see <http://www.gnu.org/licenses/>.

-from __future__ import division, print_function, unicode_literals
 import os
-import sys
 import hashlib
 import json
-import tempfile
 from uuid import uuid4
 from time import time
 from shutil import move, copyfile

 from flask import Blueprint, flash, request, redirect, url_for, abort
 from flask_babel import gettext as _
-from flask_login import login_required

-from . import logger, gdriveutils, config, ub, calibre_db
+from . import logger, gdriveutils, config, ub, calibre_db, csrf
 from .admin import admin_required
+from .file_helper import get_temp_dir
+from .usermanagement import user_login_required

 gdrive = Blueprint('gdrive', __name__, url_prefix='/gdrive')
 log = logger.create()
@@ -47,17 +45,17 @@ except ImportError as err:

 current_milli_time = lambda: int(round(time() * 1000))

-gdrive_watch_callback_token = 'target=calibreweb-watch_files'
+gdrive_watch_callback_token = 'target=calibreweb-watch_files'  # nosec


@gdrive.route("/authenticate")
-@login_required
+@user_login_required
@admin_required
 def authenticate_google_drive():
    try:
        authUrl = gdriveutils.Gauth.Instance().auth.GetAuthUrl()
    except gdriveutils.InvalidConfigError:
-        flash(_(u'Google Drive setup not completed, try to deactivate and activate Google Drive again'),
+        flash(_('Google Drive setup not completed, try to deactivate and activate Google Drive again'),
              category="error")
        return redirect(url_for('web.index'))
    return redirect(authUrl)
@@ -74,11 +72,11 @@ def google_drive_callback():
            f.write(credentials.to_json())
    except (ValueError, AttributeError) as error:
        log.error(error)
-    return redirect(url_for('admin.configuration'))
+    return redirect(url_for('admin.db_configuration'))


@gdrive.route("/watch/subscribe")
-@login_required
+@user_login_required
@admin_required
 def watch_gdrive():
    if not config.config_google_drive_watch_changes_response:
@@ -88,22 +86,23 @@ def watch_gdrive():
        notification_id = str(uuid4())
        try:
            result = gdriveutils.watchChange(gdriveutils.Gdrive.Instance().drive, notification_id,
-                               'web_hook', address, gdrive_watch_callback_token, current_milli_time() + 604800*1000)
+                                 'web_hook', address, gdrive_watch_callback_token, current_milli_time() + 604800*1000)
+
            config.config_google_drive_watch_changes_response = result
            config.save()
        except HttpError as e:
-            reason=json.loads(e.content)['error']['errors'][0]
-            if reason['reason'] == u'push.webhookUrlUnauthorized':
-                flash(_(u'Callback domain is not verified, '
-                        u'please follow steps to verify domain in google developer console'), category="error")
+            reason = json.loads(e.content)['error']['errors'][0]
+            if reason['reason'] == 'push.webhookUrlUnauthorized':
+                flash(_('Callback domain is not verified, '
+                        'please follow steps to verify domain in google developer console'), category="error")
            else:
                flash(reason['message'], category="error")

-    return redirect(url_for('admin.configuration'))
+    return redirect(url_for('admin.db_configuration'))


@gdrive.route("/watch/revoke")
-@login_required
+@user_login_required
@admin_required
 def revoke_watch_gdrive():
    last_watch_response = config.config_google_drive_watch_changes_response
@@ -111,50 +110,49 @@ def revoke_watch_gdrive():
        try:
            gdriveutils.stopChannel(gdriveutils.Gdrive.Instance().drive, last_watch_response['id'],
                                    last_watch_response['resourceId'])
-        except HttpError:
+        except (HttpError, AttributeError):
            pass
        config.config_google_drive_watch_changes_response = {}
        config.save()
-    return redirect(url_for('admin.configuration'))
+    return redirect(url_for('admin.db_configuration'))


-@gdrive.route("/watch/callback", methods=['GET', 'POST'])
-def on_received_watch_confirmation():
-    if not config.config_google_drive_watch_changes_response:
-        return ''
-    if request.headers.get('X-Goog-Channel-Token') != gdrive_watch_callback_token \
-            or request.headers.get('X-Goog-Resource-State') != 'change' \
-            or not request.data:
-        return ''
+try:
+    @csrf.exempt
+    @gdrive.route("/watch/callback", methods=['GET', 'POST'])
+    def on_received_watch_confirmation():
+        if not config.config_google_drive_watch_changes_response:
+            return ''
+        if request.headers.get('X-Goog-Channel-Token') != gdrive_watch_callback_token \
+                or request.headers.get('X-Goog-Resource-State') != 'change' \
+                or not request.data:
+            return ''

-    log.debug('%r', request.headers)
-    log.debug('%r', request.data)
-    log.info('Change received from gdrive')
+        log.debug('%r', request.headers)
+        log.debug('%r', request.data)
+        log.info('Change received from gdrive')

-    try:
-        j = json.loads(request.data)
-        log.info('Getting change details')
-        response = gdriveutils.getChangeById(gdriveutils.Gdrive.Instance().drive, j['id'])
-        log.debug('%r', response)
-        if response:
-            if sys.version_info < (3, 0):
-                dbpath = os.path.join(config.config_calibre_dir, "metadata.db")
-            else:
+        try:
+            j = json.loads(request.data)
+            log.info('Getting change details')
+            response = gdriveutils.getChangeById(gdriveutils.Gdrive.Instance().drive, j['id'])
+            log.debug('%r', response)
+            if response:
                dbpath = os.path.join(config.config_calibre_dir, "metadata.db").encode()
-            if not response['deleted'] and response['file']['title'] == 'metadata.db' \
-                and response['file']['md5Checksum'] != hashlib.md5(dbpath):
-                tmp_dir = os.path.join(tempfile.gettempdir(), 'calibre_web')
-                if not os.path.isdir(tmp_dir):
-                    os.mkdir(tmp_dir)
+                if not response['deleted'] and response['file']['title'] == 'metadata.db' \
+                  and response['file']['md5Checksum'] != hashlib.md5(dbpath).hexdigest():  # nosec
+                    tmp_dir = get_temp_dir()

-                log.info('Database file updated')
-                copyfile(dbpath, os.path.join(tmp_dir, "metadata.db_" + str(current_milli_time())))
-                log.info('Backing up existing and downloading updated metadata.db')
-                gdriveutils.downloadFile(None, "metadata.db", os.path.join(tmp_dir, "tmp_metadata.db"))
-                log.info('Setting up new DB')
-                # prevent error on windows, as os.rename does on existing files, also allow cross hdd move
-                move(os.path.join(tmp_dir, "tmp_metadata.db"), dbpath)
-                calibre_db.reconnect_db(config, ub.app_DB_path)
-    except Exception as e:
-        log.debug_or_exception(e)
-    return ''
+                    log.info('Database file updated')
+                    copyfile(dbpath, os.path.join(tmp_dir, "metadata.db_" + str(current_milli_time())))
+                    log.info('Backing up existing and downloading updated metadata.db')
+                    gdriveutils.downloadFile(None, "metadata.db", os.path.join(tmp_dir, "tmp_metadata.db"))
+                    log.info('Setting up new DB')
+                    # prevent error on windows, as os.rename does on existing files, also allow cross hdd move
+                    move(os.path.join(tmp_dir, "tmp_metadata.db"), dbpath)
+                    calibre_db.reconnect_db(config, ub.app_DB_path)
+        except Exception as ex:
+            log.error_or_exception(ex)
+        return ''
+except AttributeError:
+    pass
@@ -16,20 +16,32 @@
 #  You should have received a copy of the GNU General Public License
 #  along with this program. If not, see <http://www.gnu.org/licenses/>.

-from __future__ import division, print_function, unicode_literals
 import os
 import json
 import shutil
 import chardet
 import ssl
+import sqlite3
+import mimetypes

+from werkzeug.datastructures import Headers
 from flask import Response, stream_with_context
 from sqlalchemy import create_engine
 from sqlalchemy import Column, UniqueConstraint
 from sqlalchemy import String, Integer
 from sqlalchemy.orm import sessionmaker, scoped_session
-from sqlalchemy.ext.declarative import declarative_base
-from sqlalchemy.exc import OperationalError, InvalidRequestError
+try:
+    # Compatibility with sqlalchemy 2.0
+    from sqlalchemy.orm import declarative_base
+except ImportError:
+    from sqlalchemy.ext.declarative import declarative_base
+from sqlalchemy.exc import OperationalError, InvalidRequestError, IntegrityError
+from sqlalchemy.orm.exc import StaleDataError
+
+try:
+    from httplib2 import __version__ as httplib2_version
+except ImportError:
+    httplib2_version = "not installed"

 try:
    from apiclient import errors
@@ -43,16 +55,18 @@ try:
    from pydrive2.auth import GoogleAuth
    from pydrive2.drive import GoogleDrive
    from pydrive2.auth import RefreshError
+    from pydrive2.files import ApiRequestError
 except ImportError as err:
    try:
        from pydrive.auth import GoogleAuth
        from pydrive.drive import GoogleDrive
        from pydrive.auth import RefreshError
+        from pydrive.files import ApiRequestError
    except ImportError as err:
        importError = err
        gdrive_support = False

-from . import logger, cli, config
+from . import logger, cli_param, config, db
 from .constants import CONFIG_DIR as _CONFIG_DIR


@@ -66,7 +80,7 @@ if gdrive_support:
    if not logger.is_debug_enabled():
        logger.get('googleapiclient.discovery').setLevel(logger.logging.ERROR)
 else:
-    log.debug("Cannot import pydrive,httplib2, using gdrive will not work: %s", importError)
+    log.debug("Cannot import pydrive, httplib2, using gdrive will not work: {}".format(importError))


 class Singleton:
@@ -126,15 +140,16 @@ class Gdrive:
    def __init__(self):
        self.drive = getDrive(gauth=Gauth.Instance().auth)

+
 def is_gdrive_ready():
    return os.path.exists(SETTINGS_YAML) and os.path.exists(CREDENTIALS)


-engine = create_engine('sqlite:///{0}'.format(cli.gdpath), echo=False)
+engine = create_engine('sqlite:///{0}'.format(cli_param.gd_path), echo=False)
 Base = declarative_base()

 # Open session for database connection
-Session = sessionmaker()
+Session = sessionmaker(autoflush=False)
 Session.configure(bind=engine)
 session = scoped_session(Session)

@@ -161,29 +176,12 @@ class PermissionAdded(Base):
        return str(self.gdrive_id)


-def migrate():
-    if not engine.dialect.has_table(engine.connect(), "permissions_added"):
-        PermissionAdded.__table__.create(bind = engine)
-    for sql in session.execute("select sql from sqlite_master where type='table'"):
-        if 'CREATE TABLE gdrive_ids' in sql[0]:
-            currUniqueConstraint = 'UNIQUE (gdrive_id)'
-            if currUniqueConstraint in sql[0]:
-                sql=sql[0].replace(currUniqueConstraint, 'UNIQUE (gdrive_id, path)')
-                sql=sql.replace(GdriveId.__tablename__, GdriveId.__tablename__ + '2')
-                session.execute(sql)
-                session.execute("INSERT INTO gdrive_ids2 (id, gdrive_id, path) SELECT id, "
-                                "gdrive_id, path FROM gdrive_ids;")
-                session.commit()
-                session.execute('DROP TABLE %s' % 'gdrive_ids')
-                session.execute('ALTER TABLE gdrive_ids2 RENAME to gdrive_ids')
-            break
-
-if not os.path.exists(cli.gdpath):
+if not os.path.exists(cli_param.gd_path):
    try:
        Base.metadata.create_all(engine)
-    except Exception:
+    except Exception as ex:
+        log.error("Error connect to database: {} - {}".format(cli_param.gd_path, ex))
        raise
-migrate()


 def getDrive(drive=None, gauth=None):
@@ -197,9 +195,9 @@ def getDrive(drive=None, gauth=None):
            try:
                gauth.Refresh()
            except RefreshError as e:
-                log.error("Google Drive error: %s", e)
-            except Exception as e:
-                log.debug_or_exception(e)
+                log.error("Google Drive error: {}".format(e))
+            except Exception as ex:
+                log.error_or_exception(ex)
        else:
            # Initialize the saved creds
            gauth.Authorize()
@@ -209,16 +207,17 @@ def getDrive(drive=None, gauth=None):
        try:
            drive.auth.Refresh()
        except RefreshError as e:
-            log.error("Google Drive error: %s", e)
+            log.error("Google Drive error: {}".format(e))
    return drive

+
 def listRootFolders():
    try:
        drive = getDrive(Gdrive.Instance().drive)
        folder = "'root' in parents and mimeType = 'application/vnd.google-apps.folder' and trashed = false"
        fileList = drive.ListFile({'q': folder}).GetList()
-    except (ServerNotFoundError, ssl.SSLError) as e:
-        log.info("GDrive Error %s" % e)
+    except (ServerNotFoundError, ssl.SSLError, RefreshError) as e:
+        log.info("GDrive Error {}".format(e))
        fileList = []
    return fileList

@@ -229,7 +228,7 @@ def getEbooksFolder(drive):

 def getFolderInFolder(parentId, folderName, drive):
    # drive = getDrive(drive)
-    query=""
+    query = ""
    if folderName:
        query = "title = '%s' and " % folderName.replace("'", r"\'")
    folder = query + "'%s' in parents and mimeType = 'application/vnd.google-apps.folder'" \
@@ -240,6 +239,7 @@ def getFolderInFolder(parentId, folderName, drive):
    else:
        return fileList[0]

+
 # Search for id of root folder in gdrive database, if not found request from gdrive and store in internal database
 def getEbooksFolderId(drive=None):
    storedPathName = session.query(GdriveId).filter(GdriveId.path == '/').first()
@@ -253,56 +253,73 @@ def getEbooksFolderId(drive=None):
            log.error('Error gDrive, root ID not found')
        gDriveId.path = '/'
        session.merge(gDriveId)
-        session.commit()
+        try:
+            session.commit()
+        except OperationalError as ex:
+            log.error_or_exception('Database error: {}'.format(ex))
+            session.rollback()
        return gDriveId.gdrive_id


-def getFile(pathId, fileName, drive):
-    metaDataFile = "'%s' in parents and trashed = false and title = '%s'" % (pathId, fileName.replace("'", r"\'"))
+def getFile(pathId, fileName, drive, nocase):
+    metaDataFile = "'%s' in parents and trashed = false and title contains '%s'" % (pathId, fileName.replace("'", r"\'"))
    fileList = drive.ListFile({'q': metaDataFile}).GetList()
    if fileList.__len__() == 0:
        return None
-    else:
-        return fileList[0]
+    if nocase:
+        return fileList[0] if db.lcase(fileList[0]['title']) == db.lcase(fileName) else None
+    for f in fileList:
+        if f['title'] == fileName:
+            return f
+    return None


 def getFolderId(path, drive):
-    # drive = getDrive(drive)
-    currentFolderId = getEbooksFolderId(drive)
-    sqlCheckPath = path if path[-1] == '/' else path + '/'
-    storedPathName = session.query(GdriveId).filter(GdriveId.path == sqlCheckPath).first()
+    currentFolderId = None
+    try:
+        currentFolderId = getEbooksFolderId(drive)
+        sqlCheckPath = path if path[-1] == '/' else path + '/'
+        storedPathName = session.query(GdriveId).filter(GdriveId.path == sqlCheckPath).first()

-    if not storedPathName:
-        dbChange = False
-        s = path.split('/')
-        for i, x in enumerate(s):
-            if len(x) > 0:
-                currentPath = "/".join(s[:i+1])
-                if currentPath[-1] != '/':
-                    currentPath = currentPath + '/'
-                storedPathName = session.query(GdriveId).filter(GdriveId.path == currentPath).first()
-                if storedPathName:
-                    currentFolderId = storedPathName.gdrive_id
-                else:
-                    currentFolder = getFolderInFolder(currentFolderId, x, drive)
-                    if currentFolder:
-                        gDriveId = GdriveId()
-                        gDriveId.gdrive_id = currentFolder['id']
-                        gDriveId.path = currentPath
-                        session.merge(gDriveId)
-                        dbChange = True
-                        currentFolderId = currentFolder['id']
+        if not storedPathName:
+            dbChange = False
+            s = path.split('/')
+            for i, x in enumerate(s):
+                if len(x) > 0:
+                    currentPath = "/".join(s[:i+1])
+                    if currentPath[-1] != '/':
+                        currentPath = currentPath + '/'
+                    storedPathName = session.query(GdriveId).filter(GdriveId.path == currentPath).first()
+                    if storedPathName:
+                        currentFolderId = storedPathName.gdrive_id
                    else:
-                        currentFolderId = None
-                        break
-        if dbChange:
-            session.commit()
-    else:
-        currentFolderId = storedPathName.gdrive_id
+                        currentFolder = getFolderInFolder(currentFolderId, x, drive)
+                        if currentFolder:
+                            gDriveId = GdriveId()
+                            gDriveId.gdrive_id = currentFolder['id']
+                            gDriveId.path = currentPath
+                            session.merge(gDriveId)
+                            dbChange = True
+                            currentFolderId = currentFolder['id']
+                        else:
+                            currentFolderId = None
+                            break
+            if dbChange:
+                session.commit()
+        else:
+            currentFolderId = storedPathName.gdrive_id
+    except (OperationalError, IntegrityError, StaleDataError, sqlite3.IntegrityError) as ex:
+        log.error_or_exception('Database error: {}'.format(ex))
+        session.rollback()
+    except ApiRequestError as ex:
+        log.error('{} {}'.format(ex.error['message'], path))
+        session.rollback()
+    except RefreshError as ex:
+        log.error(ex)
    return currentFolderId


-def getFileFromEbooksFolder(path, fileName):
+def getFileFromEbooksFolder(path, fileName, nocase=False):
    drive = getDrive(Gdrive.Instance().drive)
    if path:
        # sqlCheckPath=path if path[-1] =='/' else path + '/'
@@ -310,13 +327,13 @@ def getFileFromEbooksFolder(path, fileName):
    else:
        folderId = getEbooksFolderId(drive)
    if folderId:
-        return getFile(folderId, fileName, drive)
+        return getFile(folderId, fileName, drive, nocase)
    else:
        return None


 def moveGdriveFileRemote(origin_file_id, new_title):
-    origin_file_id['title']= new_title
+    origin_file_id['title'] = new_title
    origin_file_id.Upload()


@@ -326,43 +343,58 @@ def downloadFile(path, filename, output):
    f.GetContentFile(output)


-def moveGdriveFolderRemote(origin_file, target_folder):
+def moveGdriveFolderRemote(origin_file, target_folder, single_book=False):
    drive = getDrive(Gdrive.Instance().drive)
    previous_parents = ",".join([parent["id"] for parent in origin_file.get('parents')])
    children = drive.auth.service.children().list(folderId=previous_parents).execute()
-    gFileTargetDir = getFileFromEbooksFolder(None, target_folder)
-    if not gFileTargetDir:
+    if single_book:
+        gFileTargetDir = getFileFromEbooksFolder(None, target_folder, nocase=True)
+        if gFileTargetDir:
+            # Move the file to the new folder
+            drive.auth.service.files().update(fileId=origin_file['id'],
+                                              addParents=gFileTargetDir['id'],
+                                              removeParents=previous_parents,
+                                              fields='id, parents').execute()
+        else:
+            gFileTargetDir = drive.CreateFile(
+                {'title': target_folder, 'parents': [{"kind": "drive#fileLink", 'id': getEbooksFolderId()}],
+                 "mimeType": "application/vnd.google-apps.folder"})
+            gFileTargetDir.Upload()
+            # Move the file to the new folder
+            drive.auth.service.files().update(fileId=origin_file['id'],
+                                              addParents=gFileTargetDir['id'],
+                                              removeParents=previous_parents,
+                                              fields='id, parents').execute()
+    elif origin_file['title'] != target_folder:
+        #gFileTargetDir = getFileFromEbooksFolder(None, target_folder, nocase=True)
+        #if gFileTargetDir:
+        deleteDatabasePath(origin_file['title'])
        # Folder is not existing, create, and move folder
-        gFileTargetDir = drive.CreateFile(
-            {'title': target_folder, 'parents': [{"kind": "drive#fileLink", 'id': getEbooksFolderId()}],
-             "mimeType": "application/vnd.google-apps.folder"})
-        gFileTargetDir.Upload()
-    # Move the file to the new folder
-    drive.auth.service.files().update(fileId=origin_file['id'],
-                                      addParents=gFileTargetDir['id'],
-                                      removeParents=previous_parents,
-                                      fields='id, parents').execute()
-    # if previous_parents has no childs anymore, delete original fileparent
+        drive.auth.service.files().patch(fileId=origin_file['id'],
+                                         body={'title': target_folder},
+                                         fields='title').execute()
+
+    # if previous_parents has no children anymore, delete original fileparent
    if len(children['items']) == 1:
        deleteDatabaseEntry(previous_parents)
        drive.auth.service.files().delete(fileId=previous_parents).execute()


 def copyToDrive(drive, uploadFile, createRoot, replaceFiles,
-        ignoreFiles=None,
-        parent=None, prevDir=''):
+                ignoreFiles=None,
+                parent=None, prevDir=''):
    ignoreFiles = ignoreFiles or []
    drive = getDrive(drive)
    isInitial = not bool(parent)
    if not parent:
        parent = getEbooksFolder(drive)
-    if os.path.isdir(os.path.join(prevDir,uploadFile)):
+    if os.path.isdir(os.path.join(prevDir, uploadFile)):
        existingFolder = drive.ListFile({'q': "title = '%s' and '%s' in parents and trashed = false" %
                                              (os.path.basename(uploadFile).replace("'", r"\'"), parent['id'])}).GetList()
        if len(existingFolder) == 0 and (not isInitial or createRoot):
            parent = drive.CreateFile({'title': os.path.basename(uploadFile),
                                       'parents': [{"kind": "drive#fileLink", 'id': parent['id']}],
-                "mimeType": "application/vnd.google-apps.folder"})
+                                       "mimeType": "application/vnd.google-apps.folder"})
            parent.Upload()
        else:
            if (not isInitial or createRoot) and len(existingFolder) > 0:
@@ -378,39 +410,42 @@ def copyToDrive(drive, uploadFile, createRoot, replaceFiles,
                driveFile = existingFiles[0]
            else:
                driveFile = drive.CreateFile({'title': os.path.basename(uploadFile).replace("'", r"\'"),
-                                              'parents': [{"kind":"drive#fileLink", 'id': parent['id']}], })
+                                              'parents': [{"kind": "drive#fileLink", 'id': parent['id']}], })
            driveFile.SetContentFile(os.path.join(prevDir, uploadFile))
            driveFile.Upload()


-def uploadFileToEbooksFolder(destFile, f):
+def uploadFileToEbooksFolder(destFile, f, string=False):
    drive = getDrive(Gdrive.Instance().drive)
    parent = getEbooksFolder(drive)
    splitDir = destFile.split('/')
    for i, x in enumerate(splitDir):
        if i == len(splitDir)-1:
-            existingFiles = drive.ListFile({'q': "title = '%s' and '%s' in parents and trashed = false" %
-                                                 (x.replace("'", r"\'"), parent['id'])}).GetList()
-            if len(existingFiles) > 0:
-                driveFile = existingFiles[0]
+            existing_Files = drive.ListFile({'q': "title = '%s' and '%s' in parents and trashed = false" %
+                                                  (x.replace("'", r"\'"), parent['id'])}).GetList()
+            if len(existing_Files) > 0:
+                driveFile = existing_Files[0]
            else:
                driveFile = drive.CreateFile({'title': x,
                                              'parents': [{"kind": "drive#fileLink", 'id': parent['id']}], })
-            driveFile.SetContentFile(f)
+            if not string:
+                driveFile.SetContentFile(f)
+            else:
+                driveFile.SetContentString(f)
            driveFile.Upload()
        else:
-            existingFolder = drive.ListFile({'q': "title = '%s' and '%s' in parents and trashed = false" %
-                                                  (x.replace("'", r"\'"), parent['id'])}).GetList()
-            if len(existingFolder) == 0:
+            existing_Folder = drive.ListFile({'q': "title = '%s' and '%s' in parents and trashed = false" %
+                                                   (x.replace("'", r"\'"), parent['id'])}).GetList()
+            if len(existing_Folder) == 0:
                parent = drive.CreateFile({'title': x, 'parents': [{"kind": "drive#fileLink", 'id': parent['id']}],
-                    "mimeType": "application/vnd.google-apps.folder"})
+                                           "mimeType": "application/vnd.google-apps.folder"})
                parent.Upload()
            else:
-                parent = existingFolder[0]
+                parent = existing_Folder[0]


 def watchChange(drive, channel_id, channel_type, channel_address,
-              channel_token=None, expiration=None):
+                channel_token=None, expiration=None):
    # Watch for all changes to a user's Drive.
    # Args:
    # service: Drive API service instance.
@@ -481,7 +516,7 @@ def stopChannel(drive, channel_id, resource_id):
    return drive.auth.service.channels().stop(body=body).execute()


-def getChangeById (drive, change_id):
+def getChangeById(drive, change_id):
    # Print a single Change resource information.
    #
    # Args:
@@ -493,8 +528,8 @@ def getChangeById (drive, change_id):
    except (errors.HttpError) as error:
        log.error(error)
        return None
-    except Exception as e:
-        log.error(e)
+    except Exception as ex:
+        log.error(ex)
        return None


@@ -503,9 +538,10 @@ def deleteDatabaseOnChange():
    try:
        session.query(GdriveId).delete()
        session.commit()
-    except (OperationalError, InvalidRequestError):
+    except (OperationalError, InvalidRequestError) as ex:
+        session.rollback()
+        log.error_or_exception('Database error: {}'.format(ex))
        session.rollback()
-        log.info(u"GDrive DB is not Writeable")


 def updateGdriveCalibreFromLocal():
@@ -514,22 +550,40 @@ def updateGdriveCalibreFromLocal():
        if os.path.isdir(os.path.join(config.config_calibre_dir, x)):
            shutil.rmtree(os.path.join(config.config_calibre_dir, x))

+
 # update gdrive.db on edit of books title
-def updateDatabaseOnEdit(ID,newPath):
-    sqlCheckPath = newPath if newPath[-1] == '/' else newPath + u'/'
+def updateDatabaseOnEdit(ID, newPath):
+    sqlCheckPath = newPath if newPath[-1] == '/' else newPath + '/'
    storedPathName = session.query(GdriveId).filter(GdriveId.gdrive_id == ID).first()
    if storedPathName:
        storedPathName.path = sqlCheckPath
-        session.commit()
+        try:
+            session.commit()
+        except OperationalError as ex:
+            log.error_or_exception('Database error: {}'.format(ex))
+            session.rollback()


 # Deletes the hashes in database of deleted book
 def deleteDatabaseEntry(ID):
    session.query(GdriveId).filter(GdriveId.gdrive_id == ID).delete()
-    session.commit()
+    try:
+        session.commit()
+    except OperationalError as ex:
+        log.error_or_exception('Database error: {}'.format(ex))
+        session.rollback()
+
+def deleteDatabasePath(Pathname):
+    session.query(GdriveId).filter(GdriveId.path.contains(Pathname)).delete()
+    try:
+        session.commit()
+    except OperationalError as ex:
+        log.error_or_exception('Database error: {}'.format(ex))
+        session.rollback()


 # Gets cover file from gdrive
+# ToDo: Check is this right everyone get read permissions on cover files?
 def get_cover_via_gdrive(cover_path):
    df = getFileFromEbooksFolder(cover_path, 'cover.jpg')
    if df:
@@ -543,11 +597,43 @@ def get_cover_via_gdrive(cover_path):
            permissionAdded = PermissionAdded()
            permissionAdded.gdrive_id = df['id']
            session.add(permissionAdded)
-            session.commit()
+            try:
+                session.commit()
+            except (OperationalError, IntegrityError) as ex:
+                log.error_or_exception('Database error: {}'.format(ex))
+                session.rollback()
+        headers = Headers()
+        headers["Content-Type"] = 'image/jpeg'
+        resp, content = df.auth.Get_Http_Object().request(df.metadata.get('downloadUrl'), headers=headers)
+        return content
+    else:
+        return None
+
+
+# Gets cover file from gdrive
+def get_metadata_backup_via_gdrive(metadata_path):
+    df = getFileFromEbooksFolder(metadata_path, 'metadata.opf')
+    if df:
+        if not session.query(PermissionAdded).filter(PermissionAdded.gdrive_id == df['id']).first():
+            df.GetPermissions()
+            df.InsertPermission({
+                            'type': 'anyone',
+                            'value': 'anyone',
+                            'role': 'writer',       # ToDo needs write access
+                            'withLink': True})
+            permissionAdded = PermissionAdded()
+            permissionAdded.gdrive_id = df['id']
+            session.add(permissionAdded)
+            try:
+                session.commit()
+            except OperationalError as ex:
+                log.error_or_exception('Database error: {}'.format(ex))
+                session.rollback()
        return df.metadata.get('webContentLink')
    else:
        return None

+
 # Creates chunks for downloading big files
 def partial(total_byte_len, part_size_limit):
    s = []
@@ -556,6 +642,7 @@ def partial(total_byte_len, part_size_limit):
        s.append([p, last])
    return s

+
 # downloads files in chunks from gdrive
 def do_gdrive_download(df, headers, convert_encoding=False):
    total_size = int(df.metadata.get('fileSize'))
@@ -564,7 +651,7 @@ def do_gdrive_download(df, headers, convert_encoding=False):

    def stream(convert_encoding):
        for byte in s:
-            headers = {"Range": 'bytes=%s-%s' % (byte[0], byte[1])}
+            headers = {"Range": 'bytes={}-{}'.format(byte[0], byte[1])}
            resp, content = df.auth.Get_Http_Object().request(download_url, headers=headers)
            if resp.status == 206:
                if convert_encoding:
@@ -572,7 +659,7 @@ def do_gdrive_download(df, headers, convert_encoding=False):
                    content = content.decode(result['encoding']).encode('utf-8')
                yield content
            else:
-                log.warning('An error occurred: %s', resp)
+                log.warning('An error occurred: {}'.format(resp))
                return
    return Response(stream_with_context(stream(convert_encoding)), headers=headers)

@@ -595,6 +682,7 @@ oauth_scope:
  - https://www.googleapis.com/auth/drive
 """

+
 def update_settings(client_id, client_secret, redirect_uri):
    if redirect_uri.endswith('/'):
        redirect_uri = redirect_uri[:-1]
@@ -0,0 +1,52 @@
+# -*- coding: utf-8 -*-
+
+#  This file is part of the Calibre-Web (https://github.com/janeczku/calibre-web)
+#    Copyright (C) 2022 OzzieIsaacs
+#
+#  This program is free software: you can redistribute it and/or modify
+#  it under the terms of the GNU General Public License as published by
+#  the Free Software Foundation, either version 3 of the License, or
+#  (at your option) any later version.
+#
+#  This program is distributed in the hope that it will be useful,
+#  but WITHOUT ANY WARRANTY; without even the implied warranty of
+#  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+#  GNU General Public License for more details.
+#
+#  You should have received a copy of the GNU General Public License
+#  along with this program. If not, see <http://www.gnu.org/licenses/>.
+
+from datetime import datetime
+from gevent.pywsgi import WSGIHandler
+
+
+class MyWSGIHandler(WSGIHandler):
+    def get_environ(self):
+        env = super().get_environ()
+        path, __ = self.path.split('?', 1) if '?' in self.path else (self.path, '')
+        env['RAW_URI'] = path
+        return env
+
+    def format_request(self):
+        now = datetime.now().replace(microsecond=0)
+        length = self.response_length or '-'
+        if self.time_finish:
+            delta = '%.6f' % (self.time_finish - self.time_start)
+        else:
+            delta = '-'
+        forwarded = self.environ.get('HTTP_X_FORWARDED_FOR', None)
+        if forwarded:
+            client_address = forwarded
+        else:
+            client_address = self.client_address[0] if isinstance(self.client_address, tuple) else self.client_address
+        return '%s - - [%s] "%s" %s %s %s' % (
+            client_address or '-',
+            now,
+            self.requestline or '',
+            # Use the native string version of the status, saved so we don't have to
+            # decode. But fallback to the encoded 'status' in case of subclasses
+            # (Is that really necessary? At least there's no overhead.)
+            (self._orig_status or self.status or '000').split()[0],
+            length,
+            delta)
+
@@ -15,23 +15,17 @@
 #
 #   You should have received a copy of the GNU General Public License
 #   along with this program. If not, see <http://www.gnu.org/licenses/>.
-
-from __future__ import division, print_function, unicode_literals
+import sys

 from .iso_language_names import LANGUAGE_NAMES as _LANGUAGE_NAMES
+from . import logger
+from .string_helper import strip_whitespaces
+
+log = logger.create()


 try:
-    from iso639 import languages, __version__
-    get = languages.get
-except ImportError:
    from pycountry import languages as pyc_languages
-    try:
-        import pkg_resources
-        __version__ = pkg_resources.get_distribution('pycountry').version + ' (PyCountry)'
-        del pkg_resources
-    except (ImportError, Exception):
-        __version__ = "? (PyCountry)"

    def _copy_fields(l):
        l.part1 = getattr(l, 'alpha_2', None)
@@ -45,39 +39,59 @@ except ImportError:
            return _copy_fields(pyc_languages.get(alpha_2=part1))
        if name is not None:
            return _copy_fields(pyc_languages.get(name=name))
+except ImportError as ex:
+    if sys.version_info >= (3, 12):
+        print("Python 3.12 isn't compatible with iso-639. Please install pycountry.")
+    from iso639 import languages
+    get = languages.get


 def get_language_names(locale):
-    return _LANGUAGE_NAMES.get(locale)
+    names = _LANGUAGE_NAMES.get(str(locale))
+    if names is None:
+        names = _LANGUAGE_NAMES.get(locale.language)
+    return names


 def get_language_name(locale, lang_code):
-    return get_language_names(locale)[lang_code]
+    UNKNOWN_TRANSLATION = "Unknown"
+    names = get_language_names(locale)
+    if names is None:
+        log.error(f"Missing language names for locale: {str(locale)}/{locale.language}")
+        return UNKNOWN_TRANSLATION
+
+    name = names.get(lang_code, UNKNOWN_TRANSLATION)
+    if name == UNKNOWN_TRANSLATION:
+        log.error("Missing translation for language name: {}".format(lang_code))
+
+    return name


-def get_language_codes(locale, language_names, remainder=None):
-    language_names = set(x.strip().lower() for x in language_names if x)
-    languages = list()
-    for k, v in get_language_names(locale).items():
-        v = v.lower()
-        if v in language_names:
-            languages.append(k)
-            language_names.remove(v)
-    if remainder is not None:
+def get_language_code_from_name(locale, language_names, remainder=None):
+    language_names = set(strip_whitespaces(x).lower() for x in language_names if x)
+    lang = list()
+    for key, val in get_language_names(locale).items():
+        val = val.lower()
+        if val in language_names:
+            lang.append(key)
+            language_names.remove(val)
+    if remainder is not None and language_names:
        remainder.extend(language_names)
-    return languages
+    return lang

-def get_valid_language_codes(locale, language_names, remainder=None):
-    languages = list()
+
+def get_valid_language_codes_from_code(locale, language_names, remainder=None):
+    lang = list()
    if "" in language_names:
        language_names.remove("")
-    for k, v in get_language_names(locale).items():
+    for k, __ in get_language_names(locale).items():
        if k in language_names:
-            languages.append(k)
+            lang.append(k)
            language_names.remove(k)
    if remainder is not None and len(language_names):
        remainder.extend(language_names)
-    return languages
+    return lang
+

 def get_lang3(lang):
    try:
@@ -87,6 +101,6 @@ def get_lang3(lang):
            ret_value = lang
        else:
            ret_value = ""
-    except KeyError:
+    except (KeyError, AttributeError):
        ret_value = lang
    return ret_value
@@ -22,18 +22,17 @@

 # custom jinja filters

-from __future__ import division, print_function, unicode_literals
+from markupsafe import escape
 import datetime
 import mimetypes
 from uuid import uuid4

-from babel.dates import format_date
-from flask import Blueprint, request, url_for
-from flask_babel import get_locale
-from flask_login import current_user
-
-from . import logger
+from flask import Blueprint, request, url_for, g
+from flask_babel import format_date
+from .cw_login import current_user
+from .clean_html import clean_string as html_clean_string

+from . import constants, logger

 jinjia = Blueprint('jinjia', __name__)
 log = logger.create()
@@ -45,6 +44,8 @@ def url_for_other_page(page):
    args = request.view_args.copy()
    args['page'] = page
    for get, val in request.args.items():
+        if get == "page":
+            continue
        args[get] = val
    return url_for(request.endpoint, **args)

@@ -78,11 +79,11 @@ def mimetype_filter(val):
@jinjia.app_template_filter('formatdate')
 def formatdate_filter(val):
    try:
-        return format_date(val, format='medium', locale=get_locale())
+        return format_date(val, format='medium')
    except AttributeError as e:
        log.error('Babel error: %s, Current user locale: %s, Current User: %s', e,
                  current_user.locale,
-                  current_user.nickname
+                  current_user.name
                  )
        return val

@@ -113,23 +114,77 @@ def yesno(value, yes, no):

@jinjia.app_template_filter('formatfloat')
 def formatfloat(value, decimals=1):
-    formatedstring = '%d' % value
-    if (value % 1) != 0:
-        formatedstring = ('%s.%d' % (formatedstring, (value % 1) * 10**decimals)).rstrip('0')
-    return formatedstring
+    if not value or (isinstance(value, str) and not value.is_numeric()):
+        return value
+    formated_value = ('{0:.' + str(decimals) + 'f}').format(value)
+    if formated_value.endswith('.' + "0" * decimals):
+        formated_value = formated_value.rstrip('0').rstrip('.')
+    return formated_value


-@jinjia.app_template_filter('formatseriesindex')
-def formatseriesindex_filter(series_index):
-    if series_index:
-        if int(series_index) - series_index == 0:
-            return int(series_index)
-        else:
-            return series_index
-    return 0
+@jinjia.app_template_filter('escapedlink')
+def escapedlink_filter(url, text):
+    return "<a href='{}'>{}</a>".format(url, escape(text))
+

@jinjia.app_template_filter('uuidfilter')
 def uuidfilter(var):
    return uuid4()


+@jinjia.app_template_filter('cache_timestamp')
+def cache_timestamp(rolling_period='month'):
+    if rolling_period == 'day':
+        return str(int(datetime.datetime.today().replace(hour=1, minute=1).timestamp()))
+    elif rolling_period == 'year':
+        return str(int(datetime.datetime.today().replace(day=1).timestamp()))
+    else:
+        return str(int(datetime.datetime.today().replace(month=1, day=1).timestamp()))
+
+
+@jinjia.app_template_filter('last_modified')
+def book_last_modified(book):
+    return str(int(book.last_modified.timestamp()))
+
+
+@jinjia.app_template_filter('get_cover_srcset')
+def get_cover_srcset(book):
+    srcset = list()
+    resolutions = {
+        constants.COVER_THUMBNAIL_SMALL: 'sm',
+        constants.COVER_THUMBNAIL_MEDIUM: 'md',
+        constants.COVER_THUMBNAIL_LARGE: 'lg'
+    }
+    for resolution, shortname in resolutions.items():
+        url = url_for('web.get_cover', book_id=book.id, resolution=shortname, c=book_last_modified(book))
+        srcset.append(f'{url} {resolution}x')
+    return ', '.join(srcset)
+
+
+@jinjia.app_template_filter('get_series_srcset')
+def get_cover_srcset(series):
+    srcset = list()
+    resolutions = {
+        constants.COVER_THUMBNAIL_SMALL: 'sm',
+        constants.COVER_THUMBNAIL_MEDIUM: 'md',
+        constants.COVER_THUMBNAIL_LARGE: 'lg'
+    }
+    for resolution, shortname in resolutions.items():
+        url = url_for('web.get_series_cover', series_id=series.id, resolution=shortname, c=cache_timestamp())
+        srcset.append(f'{url} {resolution}x')
+    return ', '.join(srcset)
+
+
+@jinjia.app_template_filter('music')
+def contains_music(book_formats):
+    result = False
+    for format in book_formats:
+        if format.format.lower() in g.constants.EXTENSIONS_AUDIO:
+            result = True
+    return result
+
+@jinjia.app_template_filter('clean_string')
+def clean_string(unsafe_text):
+    return html_clean_string(unsafe_text)
+
+
@@ -22,7 +22,7 @@
 This module also includes research notes into the auth protocol used by Kobo devices.

 Log-in:
-When first booting a Kobo device the user must sign into a Kobo (or affiliate) account.
+When first booting a Kobo device the user must log in to a Kobo (or affiliate) account.
 Upon successful sign-in, the user is redirected to
    https://auth.kobobooks.com/CrossDomainSignIn?id=<some id>
 which serves the following response:
@@ -41,7 +41,7 @@ issue for a few years now https://www.mobileread.com/forums/showpost.php?p=34768
 will still grant access given the userkey.)

 Official Kobo Store Api authorization:
-* For most of the endpoints we care about (sync, metadata, tags, etc), the userKey is
+* For most of the endpoints we care about (sync, metadata, tags, etc.), the userKey is
 passed in the x-kobo-userkey header, and is sufficient to authorize the API call.
 * Some endpoints (e.g: AnnotationService) instead make use of Bearer tokens pass through
 an authorization header. To get a BearerToken, the device makes a POST request to the
@@ -62,27 +62,76 @@ particular calls to non-Kobo specific endpoints such as the CalibreWeb book down
 from binascii import hexlify
 from datetime import datetime
 from os import urandom
+from functools import wraps

-from flask import g, Blueprint, url_for, abort, request
-from flask_login import login_user, login_required
+from flask import g, Blueprint, abort, request
+from .cw_login import login_user, current_user
 from flask_babel import gettext as _

-from . import logger, ub, lm
+from . import logger, config, calibre_db, db, helper, ub, lm, limiter
 from .render_template import render_title_template
-
-try:
-    from functools import wraps
-except ImportError:
-    pass  # We're not using Python 3
+from .usermanagement import user_login_required


 log = logger.create()

+kobo_auth = Blueprint("kobo_auth", __name__, url_prefix="/kobo_auth")

-def register_url_value_preprocessor(kobo):
-    @kobo.url_value_preprocessor
-    def pop_auth_token(__, values):
-        g.auth_token = values.pop("auth_token")
+
+@kobo_auth.route("/generate_auth_token/<int:user_id>")
+@user_login_required
+def generate_auth_token(user_id):
+    if current_user.id != user_id and not current_user.role_admin():
+        abort(403)
+    warning = False
+    host_list = request.host.rsplit(':')
+    if len(host_list) == 1:
+        host = ':'.join(host_list)
+    else:
+        host = ':'.join(host_list[0:-1])
+    if host.startswith('127.') or host.lower() == 'localhost' or host.startswith('[::ffff:7f') or host == "[::1]":
+        warning = _('Please access Calibre-Web from non localhost to get valid api_endpoint for kobo device')
+
+    # Generate auth token if none is existing for this user
+    auth_token = ub.session.query(ub.RemoteAuthToken).filter(
+        ub.RemoteAuthToken.user_id == user_id
+    ).filter(ub.RemoteAuthToken.token_type==1).first()
+
+    if not auth_token:
+        auth_token = ub.RemoteAuthToken()
+        auth_token.user_id = user_id
+        auth_token.expiration = datetime.max
+        auth_token.auth_token = (hexlify(urandom(16))).decode("utf-8")
+        auth_token.token_type = 1
+
+        ub.session.add(auth_token)
+        ub.session_commit()
+
+    books = calibre_db.session.query(db.Books).join(db.Data).all()
+
+    for book in books:
+        formats = [data.format for data in book.data]
+        if 'KEPUB' not in formats and config.config_kepubifypath and 'EPUB' in formats:
+            helper.convert_book_format(book.id, config.config_calibre_dir, 'EPUB', 'KEPUB', current_user.name)
+
+    return render_title_template(
+        "generate_kobo_auth_url.html",
+        title=_("Kobo Setup"),
+        auth_token=auth_token.auth_token,
+        warning=warning
+    )
+
+
+@kobo_auth.route("/deleteauthtoken/<int:user_id>", methods=["POST"])
+@user_login_required
+def delete_auth_token(user_id):
+    if current_user.id != user_id and not current_user.role_admin():
+        abort(403)
+    # Invalidate any previously generated Kobo Auth token for this user
+    ub.session.query(ub.RemoteAuthToken).filter(ub.RemoteAuthToken.user_id == user_id)\
+        .filter(ub.RemoteAuthToken.token_type==1).delete()
+
+    return ub.session_commit()


 def disable_failed_auth_redirect_for_blueprint(bp):
@@ -96,6 +145,13 @@ def get_auth_token():
        return None


+def register_url_value_preprocessor(kobo):
+    @kobo.url_value_preprocessor
+    # pylint: disable=unused-variable
+    def pop_auth_token(__, values):
+        g.auth_token = values.pop("auth_token")
+
+
 def requires_kobo_auth(f):
    @wraps(f)
    def inner(*args, **kwargs):
@@ -109,60 +165,8 @@ def requires_kobo_auth(f):
            )
            if user is not None:
                login_user(user)
+                [limiter.limiter.clear(limit.limit, *limit.request_args) for limit in limiter.current_limits]
                return f(*args, **kwargs)
-            log.debug("Received Kobo request without a recognizable auth token.")
-            return abort(401)
+        log.debug("Received Kobo request without a recognizable auth token.")
+        return abort(401)
    return inner
-
-
-kobo_auth = Blueprint("kobo_auth", __name__, url_prefix="/kobo_auth")
-
-
-@kobo_auth.route("/generate_auth_token/<int:user_id>")
-@login_required
-def generate_auth_token(user_id):
-    host_list = request.host.rsplit(':')
-    if len(host_list) == 1:
-        host = ':'.join(host_list)
-    else:
-        host = ':'.join(host_list[0:-1])
-    if host.startswith('127.') or host.lower() == 'localhost' or host.startswith('[::ffff:7f'):
-        warning = _('PLease access calibre-web from non localhost to get valid api_endpoint for kobo device')
-        return render_title_template(
-            "generate_kobo_auth_url.html",
-            title=_(u"Kobo Setup"),
-            warning = warning
-        )
-    else:
-        # Invalidate any prevously generated Kobo Auth token for this user.
-        auth_token = ub.session.query(ub.RemoteAuthToken).filter(
-            ub.RemoteAuthToken.user_id == user_id
-        ).filter(ub.RemoteAuthToken.token_type==1).first()
-
-        if not auth_token:
-            auth_token = ub.RemoteAuthToken()
-            auth_token.user_id = user_id
-            auth_token.expiration = datetime.max
-            auth_token.auth_token = (hexlify(urandom(16))).decode("utf-8")
-            auth_token.token_type = 1
-
-            ub.session.add(auth_token)
-            ub.session_commit()
-        return render_title_template(
-            "generate_kobo_auth_url.html",
-            title=_(u"Kobo Setup"),
-            kobo_auth_url=url_for(
-                "kobo.TopLevelEndpoint", auth_token=auth_token.auth_token, _external=True
-            ),
-            warning = False
-        )
-
-
-@kobo_auth.route("/deleteauthtoken/<int:user_id>")
-@login_required
-def delete_auth_token(user_id):
-    # Invalidate any prevously generated Kobo Auth token for this user.
-    ub.session.query(ub.RemoteAuthToken).filter(ub.RemoteAuthToken.user_id == user_id)\
-        .filter(ub.RemoteAuthToken.token_type==1).delete()
-
-    return ub.session_commit()
@@ -0,0 +1,90 @@
+# -*- coding: utf-8 -*-
+
+#  This file is part of the Calibre-Web (https://github.com/janeczku/calibre-web)
+#    Copyright (C) 2021 OzzieIsaacs
+#
+#  This program is free software: you can redistribute it and/or modify
+#  it under the terms of the GNU General Public License as published by
+#  the Free Software Foundation, either version 3 of the License, or
+#  (at your option) any later version.
+#
+#  This program is distributed in the hope that it will be useful,
+#  but WITHOUT ANY WARRANTY; without even the implied warranty of
+#  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+#  GNU General Public License for more details.
+#
+#  You should have received a copy of the GNU General Public License
+#  along with this program. If not, see <http://www.gnu.org/licenses/>.
+
+
+from .cw_login import current_user
+from . import ub
+from datetime import datetime, timezone
+from sqlalchemy.sql.expression import or_, and_, true
+# from sqlalchemy import exc
+
+
+# Add the current book id to kobo_synced_books table for current user, if entry is already present,
+# do nothing (safety precaution)
+def add_synced_books(book_id):
+    is_present = ub.session.query(ub.KoboSyncedBooks).filter(ub.KoboSyncedBooks.book_id == book_id)\
+        .filter(ub.KoboSyncedBooks.user_id == current_user.id).count()
+    if not is_present:
+        synced_book = ub.KoboSyncedBooks()
+        synced_book.user_id = current_user.id
+        synced_book.book_id = book_id
+        ub.session.add(synced_book)
+        ub.session_commit()
+
+
+# Select all entries of current book in kobo_synced_books table, which are from current user and delete them
+def remove_synced_book(book_id, all=False, session=None):
+    if not all:
+        user = ub.KoboSyncedBooks.user_id == current_user.id
+    else:
+        user = true()
+    if not session:
+        ub.session.query(ub.KoboSyncedBooks).filter(ub.KoboSyncedBooks.book_id == book_id).filter(user).delete()
+        ub.session_commit()
+    else:
+        session.query(ub.KoboSyncedBooks).filter(ub.KoboSyncedBooks.book_id == book_id).filter(user).delete()
+        ub.session_commit(_session=session)
+
+
+# If state == none, it will toggle the archive state of the passed book_id. 
+# state = true archives it, state = false unarchives it
+def change_archived_books(book_id, state=None, message=None):
+    archived_book = ub.session.query(ub.ArchivedBook).filter(and_(ub.ArchivedBook.user_id == int(current_user.id),
+                                                                  ub.ArchivedBook.book_id == book_id)).first()
+    if not archived_book: # and (state == True or state == None):
+        archived_book = ub.ArchivedBook(user_id=current_user.id, book_id=book_id)
+
+    archived_book.is_archived = state if state != None else not archived_book.is_archived
+    archived_book.last_modified = datetime.now(timezone.utc)        # toDo. Check utc timestamp
+
+    ub.session.merge(archived_book)
+    ub.session_commit(message)
+    return archived_book.is_archived
+
+
+# select all books which are synced by the current user and do not belong to a synced shelf and set them to archive
+# select all shelves from current user which are synced and do not belong to the "only sync" shelves
+def update_on_sync_shelfs(user_id):
+    books_to_archive = (ub.session.query(ub.KoboSyncedBooks)
+                        .join(ub.BookShelf, ub.KoboSyncedBooks.book_id == ub.BookShelf.book_id, isouter=True)
+                        .join(ub.Shelf, ub.Shelf.user_id == user_id, isouter=True)
+                        .filter(or_(ub.Shelf.kobo_sync == 0, ub.Shelf.kobo_sync==None))
+                        .filter(ub.KoboSyncedBooks.user_id == user_id).all())
+    for b in books_to_archive:
+        change_archived_books(b.book_id, True)
+        ub.session.query(ub.KoboSyncedBooks) \
+            .filter(ub.KoboSyncedBooks.book_id == b.book_id) \
+            .filter(ub.KoboSyncedBooks.user_id == user_id).delete()
+        ub.session_commit()
+
+    # Search all shelf which are currently not synced
+    shelves_to_archive = ub.session.query(ub.Shelf).filter(ub.Shelf.user_id == user_id).filter(
+        ub.Shelf.kobo_sync == 0).all()
+    for a in shelves_to_archive:
+        ub.session.add(ub.ShelfArchive(uuid=a.uuid, user_id=user_id))
+        ub.session_commit()
@@ -16,7 +16,6 @@
 #   You should have received a copy of the GNU General Public License
 #   along with this program. If not, see <http://www.gnu.org/licenses/>.

-from __future__ import division, print_function, unicode_literals
 import os
 import sys
 import inspect
@@ -30,7 +29,7 @@ from .constants import CONFIG_DIR as _CONFIG_DIR
 ACCESS_FORMATTER_GEVENT  = Formatter("%(message)s")
 ACCESS_FORMATTER_TORNADO = Formatter("[%(asctime)s] %(message)s")

-FORMATTER           = Formatter("[%(asctime)s] %(levelname)5s {%(name)s:%(lineno)d} %(message)s")
+FORMATTER           = Formatter("[%(asctime)s] %(levelname)5s {%(filename)s:%(lineno)d} %(message)s")
 DEFAULT_LOG_LEVEL   = logging.INFO
 DEFAULT_LOG_FILE    = os.path.join(_CONFIG_DIR, "calibre-web.log")
 DEFAULT_ACCESS_LOG  = os.path.join(_CONFIG_DIR, "access.log")
@@ -43,35 +42,25 @@ logging.addLevelName(logging.CRITICAL, "CRIT")

 class _Logger(logging.Logger):

-    def debug_or_exception(self, message, *args, **kwargs):
-        if sys.version_info > (3, 7):
-            if is_debug_enabled():
-                self.exception(message, stacklevel=2, *args, **kwargs)
-            else:
-                self.error(message, stacklevel=2, *args, **kwargs)
-        elif sys.version_info > (3, 0):
-            if is_debug_enabled():
-                self.exception(message, stack_info=True, *args, **kwargs)
-            else:
-                self.error(message, *args, **kwargs)
+    def error_or_exception(self, message, stacklevel=1, *args, **kwargs):
+        is_debug = self.getEffectiveLevel() <= logging.DEBUG
+        if not is_debug:
+            self.exception(message, stacklevel=stacklevel, *args, **kwargs)
        else:
-            if is_debug_enabled():
-                self.exception(message, *args, **kwargs)
-            else:
-                self.error(message, *args, **kwargs)
-
+            self.error(message, stacklevel=stacklevel, *args, **kwargs)

    def debug_no_auth(self, message, *args, **kwargs):
+        message = message.strip("\r\n")
        if message.startswith("send: AUTH"):
-            self.debug(message[:16], stacklevel=2, *args, **kwargs)
+            self.debug(message[:16], *args, **kwargs)
        else:
-            self.debug(message, stacklevel=2, *args, **kwargs)
-
+            self.debug(message, *args, **kwargs)


 def get(name=None):
    return logging.getLogger(name)

+
 def create():
    parent_frame = inspect.stack(0)[1]
    if hasattr(parent_frame, 'frame'):
@@ -81,9 +70,11 @@ def create():
    parent_module = inspect.getmodule(parent_frame)
    return get(parent_module.__name__)

+
 def is_debug_enabled():
    return logging.root.level <= logging.DEBUG

+
 def is_info_enabled(logger):
    return logging.getLogger(logger).level <= logging.INFO

@@ -120,10 +111,10 @@ def get_accesslogfile(log_file):


 def setup(log_file, log_level=None):
-    '''
+    """
    Configure the logging output.
    May be called multiple times.
-    '''
+    """
    log_level = log_level or DEFAULT_LOG_LEVEL
    logging.setLoggerClass(_Logger)
    logging.getLogger(__package__).setLevel(log_level)
@@ -133,7 +124,7 @@ def setup(log_file, log_level=None):
        # avoid spamming the log with debug messages from libraries
        r.setLevel(log_level)

-    # Otherwise name get's destroyed on windows
+    # Otherwise, name gets destroyed on Windows
    if log_file != LOG_TO_STDERR and log_file != LOG_TO_STDOUT:
        log_file = _absolute_log_file(log_file, DEFAULT_LOG_FILE)

@@ -153,11 +144,11 @@ def setup(log_file, log_level=None):
            file_handler.baseFilename = log_file
    else:
        try:
-            file_handler = RotatingFileHandler(log_file, maxBytes=50000, backupCount=2, encoding='utf-8')
-        except IOError:
+            file_handler = RotatingFileHandler(log_file, maxBytes=100000, backupCount=2, encoding='utf-8')
+        except (IOError, PermissionError):
            if log_file == DEFAULT_LOG_FILE:
                raise
-            file_handler = RotatingFileHandler(DEFAULT_LOG_FILE, maxBytes=50000, backupCount=2, encoding='utf-8')
+            file_handler = RotatingFileHandler(DEFAULT_LOG_FILE, maxBytes=100000, backupCount=2, encoding='utf-8')
            log_file = ""
    file_handler.setFormatter(FORMATTER)

@@ -165,13 +156,14 @@ def setup(log_file, log_level=None):
        r.removeHandler(h)
        h.close()
    r.addHandler(file_handler)
+    logging.captureWarnings(True)
    return "" if log_file == DEFAULT_LOG_FILE else log_file


 def create_access_log(log_file, log_name, formatter):
-    '''
+    """
    One-time configuration for the web server's access log.
-    '''
+    """
    log_file = _absolute_log_file(log_file, DEFAULT_ACCESS_LOG)
    logging.debug("access log: %s", log_file)

@@ -180,7 +172,7 @@ def create_access_log(log_file, log_name, formatter):
    access_log.setLevel(logging.INFO)
    try:
        file_handler = RotatingFileHandler(log_file, maxBytes=50000, backupCount=2, encoding='utf-8')
-    except IOError:
+    except (IOError, PermissionError):
        if log_file == DEFAULT_ACCESS_LOG:
            raise
        file_handler = RotatingFileHandler(DEFAULT_ACCESS_LOG, maxBytes=50000, backupCount=2, encoding='utf-8')
@@ -188,8 +180,7 @@ def create_access_log(log_file, log_name, formatter):

    file_handler.setFormatter(formatter)
    access_log.addHandler(file_handler)
-    return access_log, \
-           "" if _absolute_log_file(log_file, DEFAULT_ACCESS_LOG) == DEFAULT_ACCESS_LOG else log_file
+    return access_log, "" if _absolute_log_file(log_file, DEFAULT_ACCESS_LOG) == DEFAULT_ACCESS_LOG else log_file


 # Enable logging of smtp lib debug output
@@ -0,0 +1,86 @@
+# -*- coding: utf-8 -*-
+
+#  This file is part of the Calibre-Web (https://github.com/janeczku/calibre-web)
+#    Copyright (C) 2012-2022 OzzieIsaacs
+#
+#  This program is free software: you can redistribute it and/or modify
+#  it under the terms of the GNU General Public License as published by
+#  the Free Software Foundation, either version 3 of the License, or
+#  (at your option) any later version.
+#
+#  This program is distributed in the hope that it will be useful,
+#  but WITHOUT ANY WARRANTY; without even the implied warranty of
+#  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+#  GNU General Public License for more details.
+#
+#  You should have received a copy of the GNU General Public License
+#  along with this program. If not, see <http://www.gnu.org/licenses/>.
+
+import sys
+
+from . import create_app, limiter
+from .jinjia import jinjia
+from flask import request
+
+
+def request_username():
+    return request.authorization.username if request.authorization else ""
+
+
+def main():
+    app = create_app()
+
+    from .web import web
+    from .basic import basic
+    from .opds import opds
+    from .admin import admi
+    from .gdrive import gdrive
+    from .editbooks import editbook
+    from .about import about
+    from .search import search
+    from .search_metadata import meta
+    from .shelf import shelf
+    from .tasks_status import tasks
+    from .error_handler import init_errorhandler
+    from .remotelogin import remotelogin
+    try:
+        from .kobo import kobo, get_kobo_activated
+        from .kobo_auth import kobo_auth
+        from flask_limiter.util import get_remote_address
+        kobo_available = get_kobo_activated()
+    except (ImportError, AttributeError):  # Catch also error for not installed flask-WTF (missing csrf decorator)
+        kobo_available = False
+        kobo = kobo_auth = get_remote_address = None
+
+    try:
+        from .oauth_bb import oauth
+        oauth_available = True
+    except ImportError:
+        oauth_available = False
+        oauth = None
+
+    from . import web_server
+    init_errorhandler()
+
+    app.register_blueprint(search)
+    app.register_blueprint(tasks)
+    app.register_blueprint(web)
+    app.register_blueprint(basic)
+    limiter.limit("3/minute", key_func=request_username)(opds)
+    app.register_blueprint(opds)
+    app.register_blueprint(jinjia)
+    app.register_blueprint(about)
+    app.register_blueprint(shelf)
+    app.register_blueprint(admi)
+    app.register_blueprint(remotelogin)
+    app.register_blueprint(meta)
+    app.register_blueprint(gdrive)
+    app.register_blueprint(editbook)
+    if kobo_available:
+        limiter.limit("3/minute", key_func=get_remote_address)(kobo)
+        app.register_blueprint(kobo)
+        app.register_blueprint(kobo_auth)
+    if oauth_available:
+        app.register_blueprint(oauth)
+    success = web_server.start()
+    sys.exit(0 if success else 1)
@@ -0,0 +1,140 @@
+# -*- coding: utf-8 -*-
+
+#  This file is part of the Calibre-Web (https://github.com/janeczku/calibre-web)
+#    Copyright (C) 2022 quarz12
+#
+#  This program is free software: you can redistribute it and/or modify
+#  it under the terms of the GNU General Public License as published by
+#  the Free Software Foundation, either version 3 of the License, or
+#  (at your option) any later version.
+#
+#  This program is distributed in the hope that it will be useful,
+#  but WITHOUT ANY WARRANTY; without even the implied warranty of
+#  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+#  GNU General Public License for more details.
+#
+#  You should have received a copy of the GNU General Public License
+#  along with this program. If not, see <http://www.gnu.org/licenses/>.
+
+import concurrent.futures
+import requests
+from bs4 import BeautifulSoup as BS  # requirement
+from typing import List, Optional
+
+try:
+    import cchardet #optional for better speed
+except ImportError:
+    pass
+
+from cps.services.Metadata import MetaRecord, MetaSourceInfo, Metadata
+import cps.logger as logger
+
+#from time import time
+from operator import itemgetter
+log = logger.create()
+
+
+class Amazon(Metadata):
+    __name__ = "Amazon"
+    __id__ = "amazon"
+    headers = {'upgrade-insecure-requests': '1',
+               'user-agent': 'Mozilla/5.0 (X11; Linux x86_64; rv:130.0) Gecko/20100101 Firefox/130.0',
+               'accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/png,image/svg+xml,*/*;q=0.8',
+               'Sec-Fetch-Site': 'same-origin',
+               'Sec-Fetch-Mode': 'navigate',
+               'Sec-Fetch-User': '?1',
+               'Sec-Fetch-Dest': 'document',
+               'Upgrade-Insecure-Requests': '1',
+               'Alt-Used' : 'www.amazon.com',
+               'Priority' : 'u=0, i',
+               'accept-encoding': 'gzip, deflate, br, zstd',
+               'accept-language': 'en-US,en;q=0.9'}
+    session = requests.Session()
+    session.headers=headers
+
+    def search(
+        self, query: str, generic_cover: str = "", locale: str = "en"
+    ) -> Optional[List[MetaRecord]]:
+        def inner(link, index) -> [dict, int]:
+            with self.session as session:
+                try:
+                    r = session.get(f"https://www.amazon.com/{link}")
+                    r.raise_for_status()
+                except Exception as ex:
+                    log.warning(ex)
+                    return []
+                long_soup = BS(r.text, "lxml")  #~4sec :/
+                soup2 = long_soup.find("div", attrs={"cel_widget_id": "dpx-ppd_csm_instrumentation_wrapper"})
+                if soup2 is None:
+                    return []
+                try:
+                    match = MetaRecord(
+                        title = "",
+                        authors = "",
+                        source=MetaSourceInfo(
+                            id=self.__id__,
+                            description="Amazon Books",
+                            link="https://amazon.com/"
+                        ),
+                        url = f"https://www.amazon.com{link}",
+                        #the more searches the slower, these are too hard to find in reasonable time or might not even exist
+                        publisher= "",  # very unreliable
+                        publishedDate= "",  # very unreliable
+                        id = None,  # ?
+                        tags = []  # dont exist on amazon
+                    )
+
+                    try:
+                        match.description = "\n".join(
+                            soup2.find("div", attrs={"data-feature-name": "bookDescription"}).stripped_strings)\
+                                                .replace("\xa0"," ")[:-9].strip().strip("\n")
+                    except (AttributeError, TypeError):
+                        return []  # if there is no description it is not a book and therefore should be ignored
+                    try:
+                        match.title = soup2.find("span", attrs={"id": "productTitle"}).text
+                    except (AttributeError, TypeError):
+                        match.title = ""
+                    try:
+                        match.authors = [next(
+                            filter(lambda i: i != " " and i != "\n" and not i.startswith("{"),
+                                   x.findAll(string=True))).strip()
+                                        for x in soup2.findAll("span", attrs={"class": "author"})]
+                    except (AttributeError, TypeError, StopIteration):
+                        match.authors = ""
+                    try:
+                        match.rating = int(
+                            soup2.find("span", class_="a-icon-alt").text.split(" ")[0].split(".")[
+                                0])  # first number in string
+                    except (AttributeError, ValueError):
+                        match.rating = 0
+                    try:
+                        match.cover = soup2.find("img", attrs={"class": "a-dynamic-image"})["src"]
+                    except (AttributeError, TypeError):
+                        match.cover = ""
+                    return match, index
+                except Exception as e:
+                    log.error_or_exception(e)
+                    return []
+
+        val = list()
+        if self.active:
+            try:
+                results = self.session.get(
+                    f"https://www.amazon.com/s?k={query.replace(' ', '+')}&i=digital-text&sprefix={query.replace(' ', '+')}"
+                    f"%2Cdigital-text&ref=nb_sb_noss",
+                    headers=self.headers)
+                results.raise_for_status()
+            except requests.exceptions.HTTPError as e:
+                log.error_or_exception(e)
+                return []
+            except Exception as e:
+                log.warning(e)
+                return []
+            soup = BS(results.text, 'html.parser')
+            links_list = [next(filter(lambda i: "digital-text" in i["href"], x.findAll("a")))["href"] for x in
+                          soup.findAll("div", attrs={"data-component-type": "s-search-result"})]
+            with concurrent.futures.ThreadPoolExecutor(max_workers=5) as executor:
+                fut = {executor.submit(inner, link, index) for index, link in enumerate(links_list[:3])}
+                val = list(map(lambda x : x.result(), concurrent.futures.as_completed(fut)))
+        result = list(filter(lambda x: x, val))
+        return [x[0] for x in sorted(result, key=itemgetter(1))] #sort by amazons listing order for best relevance
@@ -0,0 +1,92 @@
+# -*- coding: utf-8 -*-
+
+#  This file is part of the Calibre-Web (https://github.com/janeczku/calibre-web)
+#    Copyright (C) 2021 OzzieIsaacs
+#
+#  This program is free software: you can redistribute it and/or modify
+#  it under the terms of the GNU General Public License as published by
+#  the Free Software Foundation, either version 3 of the License, or
+#  (at your option) any later version.
+#
+#  This program is distributed in the hope that it will be useful,
+#  but WITHOUT ANY WARRANTY; without even the implied warranty of
+#  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+#  GNU General Public License for more details.
+#
+#  You should have received a copy of the GNU General Public License
+#  along with this program. If not, see <http://www.gnu.org/licenses/>.
+
+# ComicVine api document: https://comicvine.gamespot.com/api/documentation
+from typing import Dict, List, Optional
+from urllib.parse import quote
+
+import requests
+from cps import logger
+from cps.services.Metadata import MetaRecord, MetaSourceInfo, Metadata
+
+log = logger.create()
+
+
+class ComicVine(Metadata):
+    __name__ = "ComicVine"
+    __id__ = "comicvine"
+    DESCRIPTION = "ComicVine Books"
+    META_URL = "https://comicvine.gamespot.com/"
+    API_KEY = "57558043c53943d5d1e96a9ad425b0eb85532ee6"
+    BASE_URL = (
+        f"https://comicvine.gamespot.com/api/search?api_key={API_KEY}"
+        f"&resources=issue&query="
+    )
+    QUERY_PARAMS = "&sort=name:desc&format=json"
+    HEADERS = {"User-Agent": "Not Evil Browser"}
+
+    def search(
+        self, query: str, generic_cover: str = "", locale: str = "en"
+    ) -> Optional[List[MetaRecord]]:
+        val = list()
+        if self.active:
+            title_tokens = list(self.get_title_tokens(query, strip_joiners=False))
+            if title_tokens:
+                tokens = [quote(t.encode("utf-8")) for t in title_tokens]
+                query = "%20".join(tokens)
+            try:
+                result = requests.get(
+                    f"{ComicVine.BASE_URL}{query}{ComicVine.QUERY_PARAMS}",
+                    headers=ComicVine.HEADERS,
+                )
+                result.raise_for_status()
+            except Exception as e:
+                log.warning(e)
+                return []
+            for result in result.json()["results"]:
+                match = self._parse_search_result(
+                    result=result, generic_cover=generic_cover, locale=locale
+                )
+                val.append(match)
+        return val
+
+    def _parse_search_result(
+        self, result: Dict, generic_cover: str, locale: str
+    ) -> MetaRecord:
+        series = result["volume"].get("name", "")
+        series_index = result.get("issue_number", 0)
+        issue_name = result.get("name", "")
+        match = MetaRecord(
+            id=result["id"],
+            title=f"{series}#{series_index} - {issue_name}",
+            authors=result.get("authors", []),
+            url=result.get("site_detail_url", ""),
+            source=MetaSourceInfo(
+                id=self.__id__,
+                description=ComicVine.DESCRIPTION,
+                link=ComicVine.META_URL,
+            ),
+            series=series,
+        )
+        match.cover = result["image"].get("original_url", generic_cover)
+        match.description = result.get("description", "")
+        match.publishedDate = result.get("store_date", result.get("date_added"))
+        match.series_index = series_index
+        match.tags = ["Comics", series]
+        match.identifiers = {"comicvine": match.id}
+        return match
@@ -0,0 +1,260 @@
+# -*- coding: utf-8 -*-
+
+#  This file is part of the Calibre-Web (https://github.com/janeczku/calibre-web)
+#    Copyright (C) 2022 xlivevil
+#
+#  This program is free software: you can redistribute it and/or modify
+#  it under the terms of the GNU General Public License as published by
+#  the Free Software Foundation, either version 3 of the License, or
+#  (at your option) any later version.
+#
+#  This program is distributed in the hope that it will be useful,
+#  but WITHOUT ANY WARRANTY; without even the implied warranty of
+#  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+#  GNU General Public License for more details.
+#
+#  You should have received a copy of the GNU General Public License
+#  along with this program. If not, see <http://www.gnu.org/licenses/>.
+import re
+from concurrent import futures
+from typing import List, Optional
+
+import requests
+from html2text import HTML2Text
+from lxml import etree
+
+from cps import logger
+from cps.services.Metadata import Metadata, MetaRecord, MetaSourceInfo
+
+log = logger.create()
+
+
+def html2text(html: str) -> str:
+
+    h2t = HTML2Text()
+    h2t.body_width = 0
+    h2t.single_line_break = True
+    h2t.emphasis_mark = "*"
+    return h2t.handle(html)
+
+
+class Douban(Metadata):
+    __name__ = "豆瓣"
+    __id__ = "douban"
+    DESCRIPTION = "豆瓣"
+    META_URL = "https://book.douban.com/"
+    SEARCH_JSON_URL = "https://www.douban.com/j/search"
+    SEARCH_URL = "https://www.douban.com/search"
+
+    ID_PATTERN = re.compile(r"sid: (?P<id>\d+),")
+    AUTHORS_PATTERN = re.compile(r"作者|译者")
+    PUBLISHER_PATTERN = re.compile(r"出版社")
+    SUBTITLE_PATTERN = re.compile(r"副标题")
+    PUBLISHED_DATE_PATTERN = re.compile(r"出版年")
+    SERIES_PATTERN = re.compile(r"丛书")
+    IDENTIFIERS_PATTERN = re.compile(r"ISBN|统一书号")
+    CRITERIA_PATTERN = re.compile("criteria = '(.+)'")
+
+    TITTLE_XPATH = "//span[@property='v:itemreviewed']"
+    COVER_XPATH = "//a[@class='nbg']"
+    INFO_XPATH = "//*[@id='info']//span[@class='pl']"
+    TAGS_XPATH = "//a[contains(@class, 'tag')]"
+    DESCRIPTION_XPATH = "//div[@id='link-report']//div[@class='intro']"
+    RATING_XPATH = "//div[@class='rating_self clearfix']/strong"
+
+    session = requests.Session()
+    session.headers = {
+        'user-agent':
+        'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.102 Safari/537.36 Edg/98.0.1108.56',
+    }
+
+    def search(self,
+               query: str,
+               generic_cover: str = "",
+               locale: str = "en") -> List[MetaRecord]:
+        val = []
+        if self.active:
+            log.debug(f"start searching {query} on douban")
+            if title_tokens := list(
+                    self.get_title_tokens(query, strip_joiners=False)):
+                query = "+".join(title_tokens)
+
+            book_id_list = self._get_book_id_list_from_html(query)
+
+            if not book_id_list:
+                log.debug("No search results in Douban")
+                return []
+
+            with futures.ThreadPoolExecutor(
+                    max_workers=5, thread_name_prefix='douban') as executor:
+
+                fut = [
+                    executor.submit(self._parse_single_book, book_id,
+                                    generic_cover) for book_id in book_id_list
+                ]
+
+                val = [
+                    future.result() for future in futures.as_completed(fut)
+                    if future.result()
+                ]
+
+        return val
+
+    def _get_book_id_list_from_html(self, query: str) -> List[str]:
+        try:
+            r = self.session.get(self.SEARCH_URL,
+                                 params={
+                                     "cat": 1001,
+                                     "q": query
+                                 })
+            r.raise_for_status()
+
+        except Exception as e:
+            log.warning(e)
+            return []
+
+        html = etree.HTML(r.content.decode("utf8"))
+        result_list = html.xpath(self.COVER_XPATH)
+
+        return [
+            self.ID_PATTERN.search(item.get("onclick")).group("id")
+            for item in result_list[:10]
+            if self.ID_PATTERN.search(item.get("onclick"))
+        ]
+
+    def _get_book_id_list_from_json(self, query: str) -> List[str]:
+        try:
+            r = self.session.get(self.SEARCH_JSON_URL,
+                                 params={
+                                     "cat": 1001,
+                                     "q": query
+                                 })
+            r.raise_for_status()
+
+        except Exception as e:
+            log.warning(e)
+            return []
+
+        results = r.json()
+        if results["total"] == 0:
+            return []
+
+        return [
+            self.ID_PATTERN.search(item).group("id")
+            for item in results["items"][:10] if self.ID_PATTERN.search(item)
+        ]
+
+    def _parse_single_book(self,
+                           id: str,
+                           generic_cover: str = "") -> Optional[MetaRecord]:
+        url = f"https://book.douban.com/subject/{id}/"
+        log.debug(f"start parsing {url}")
+
+        try:
+            r = self.session.get(url)
+            r.raise_for_status()
+        except Exception as e:
+            log.warning(e)
+            return []
+
+        match = MetaRecord(
+            id=id,
+            title="",
+            authors=[],
+            url=url,
+            source=MetaSourceInfo(
+                id=self.__id__,
+                description=self.DESCRIPTION,
+                link=self.META_URL,
+            ),
+        )
+
+        decode_content = r.content.decode("utf8")
+        html = etree.HTML(decode_content)
+
+        match.title = html.xpath(self.TITTLE_XPATH)[0].text
+        match.cover = html.xpath(
+            self.COVER_XPATH)[0].attrib["href"] or generic_cover
+        try:
+            rating_num = float(html.xpath(self.RATING_XPATH)[0].text.strip())
+        except Exception:
+            rating_num = 0
+        match.rating = int(-1 * rating_num // 2 * -1) if rating_num else 0
+
+        tag_elements = html.xpath(self.TAGS_XPATH)
+        if len(tag_elements):
+            match.tags = [tag_element.text for tag_element in tag_elements]
+        else:
+            match.tags = self._get_tags(decode_content)
+
+        description_element = html.xpath(self.DESCRIPTION_XPATH)
+        if len(description_element):
+            match.description = html2text(
+                etree.tostring(description_element[-1]).decode("utf8"))
+
+        info = html.xpath(self.INFO_XPATH)
+
+        for element in info:
+            text = element.text
+            if self.AUTHORS_PATTERN.search(text):
+                next_element = element.getnext()
+                while next_element is not None and next_element.tag != "br":
+                    match.authors.append(next_element.text)
+                    next_element = next_element.getnext()
+            elif self.PUBLISHER_PATTERN.search(text):
+                if publisher := element.tail.strip():
+                    match.publisher = publisher
+                else:
+                    match.publisher = element.getnext().text
+            elif self.SUBTITLE_PATTERN.search(text):
+                match.title = f'{match.title}:{element.tail.strip()}'
+            elif self.PUBLISHED_DATE_PATTERN.search(text):
+                match.publishedDate = self._clean_date(element.tail.strip())
+            elif self.SERIES_PATTERN.search(text):
+                match.series = element.getnext().text
+            elif i_type := self.IDENTIFIERS_PATTERN.search(text):
+                match.identifiers[i_type.group()] = element.tail.strip()
+
+        return match
+
+    @staticmethod
+    def _clean_date(date: str) -> str:
+        """
+        Clean up the date string to be in the format YYYY-MM-DD
+
+        Examples of possible patterns:
+            '2014-7-16', '1988年4月', '1995-04', '2021-8', '2020-12-1', '1996年',
+            '1972', '2004/11/01', '1959年3月北京第1版第1印'
+        """
+        year = date[:4]
+        moon = "01"
+        day = "01"
+
+        if len(date) > 5:
+            digit = []
+            ls = []
+            for i in range(5, len(date)):
+                if date[i].isdigit():
+                    digit.append(date[i])
+                elif digit:
+                    ls.append("".join(digit) if len(digit) ==
+                              2 else f"0{digit[0]}")
+                    digit = []
+            if digit:
+                ls.append("".join(digit) if len(digit) ==
+                          2 else f"0{digit[0]}")
+
+            moon = ls[0]
+            if len(ls) > 1:
+                day = ls[1]
+
+        return f"{year}-{moon}-{day}"
+
+    def _get_tags(self, text: str) -> List[str]:
+        tags = []
+        if criteria := self.CRITERIA_PATTERN.search(text):
+            tags.extend(
+                item.replace('7:', '') for item in criteria.group().split('|')
+                if item.startswith('7:'))
+
+        return tags
@@ -0,0 +1,130 @@
+# -*- coding: utf-8 -*-
+
+#  This file is part of the Calibre-Web (https://github.com/janeczku/calibre-web)
+#    Copyright (C) 2021 OzzieIsaacs
+#
+#  This program is free software: you can redistribute it and/or modify
+#  it under the terms of the GNU General Public License as published by
+#  the Free Software Foundation, either version 3 of the License, or
+#  (at your option) any later version.
+#
+#  This program is distributed in the hope that it will be useful,
+#  but WITHOUT ANY WARRANTY; without even the implied warranty of
+#  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+#  GNU General Public License for more details.
+#
+#  You should have received a copy of the GNU General Public License
+#  along with this program. If not, see <http://www.gnu.org/licenses/>.
+
+# Google Books api document: https://developers.google.com/books/docs/v1/using
+from typing import Dict, List, Optional
+from urllib.parse import quote
+from datetime import datetime
+
+import requests
+
+from cps import logger, config
+from cps.isoLanguages import get_lang3, get_language_name
+from cps.services.Metadata import MetaRecord, MetaSourceInfo, Metadata
+
+log = logger.create()
+
+
+class Google(Metadata):
+    __name__ = "Google Books"
+    __id__ = "google"
+    DESCRIPTION = "Google Books"
+    META_URL = "https://books.google.com/"
+    BOOK_URL = "https://books.google.com/books?id="
+    SEARCH_URL = "https://www.googleapis.com/books/v1/volumes?q="
+    ISBN_TYPE = "ISBN_13"
+    API_KEY = "&key=" + config.config_googlebooks_api_key 
+
+    def search(
+        self, query: str, generic_cover: str = "", locale: str = "en"
+    ) -> Optional[List[MetaRecord]]:
+        val = list()    
+        if self.active:
+
+            title_tokens = list(self.get_title_tokens(query, strip_joiners=False))
+            if title_tokens:
+                tokens = [quote(t.encode("utf-8")) for t in title_tokens]
+                query = "+".join(tokens)
+            try:
+                results = requests.get(Google.SEARCH_URL + query + Google.API_KEY)
+                results.raise_for_status()
+            except Exception as e:
+                log.warning(e)
+                return []
+            for result in results.json().get("items", []):
+                val.append(
+                    self._parse_search_result(
+                        result=result, generic_cover=generic_cover, locale=locale
+                    )
+                )
+        return val
+
+    def _parse_search_result(
+        self, result: Dict, generic_cover: str, locale: str
+    ) -> MetaRecord:
+        match = MetaRecord(
+            id=result["id"],
+            title=result["volumeInfo"]["title"],
+            authors=result["volumeInfo"].get("authors", []),
+            url=Google.BOOK_URL + result["id"],
+            source=MetaSourceInfo(
+                id=self.__id__,
+                description=Google.DESCRIPTION,
+                link=Google.META_URL,
+            ),
+        )
+
+        match.cover = self._parse_cover(result=result, generic_cover=generic_cover)
+        match.description = result["volumeInfo"].get("description", "")
+        match.languages = self._parse_languages(result=result, locale=locale)
+        match.publisher = result["volumeInfo"].get("publisher", "")
+        try:
+            datetime.strptime(result["volumeInfo"].get("publishedDate", ""), "%Y-%m-%d")
+            match.publishedDate = result["volumeInfo"].get("publishedDate", "")
+        except ValueError:
+            match.publishedDate = ""
+        match.rating = result["volumeInfo"].get("averageRating", 0)
+        match.series, match.series_index = "", 1
+        match.tags = result["volumeInfo"].get("categories", [])
+
+        match.identifiers = {"google": match.id}
+        match = self._parse_isbn(result=result, match=match)
+        return match
+
+    @staticmethod
+    def _parse_isbn(result: Dict, match: MetaRecord) -> MetaRecord:
+        identifiers = result["volumeInfo"].get("industryIdentifiers", [])
+        for identifier in identifiers:
+            if identifier.get("type") == Google.ISBN_TYPE:
+                match.identifiers["isbn"] = identifier.get("identifier")
+                break
+        return match
+
+    @staticmethod
+    def _parse_cover(result: Dict, generic_cover: str) -> str:
+        if result["volumeInfo"].get("imageLinks"):
+            cover_url = result["volumeInfo"]["imageLinks"]["thumbnail"]
+            
+            # strip curl in cover
+            cover_url = cover_url.replace("&edge=curl", "")
+            
+            # request 800x900 cover image (higher resolution)
+            cover_url += "&fife=w800-h900"
+            
+            return cover_url.replace("http://", "https://")
+        return generic_cover
+
+    @staticmethod
+    def _parse_languages(result: Dict, locale: str) -> List[str]:
+        language_iso2 = result["volumeInfo"].get("language", "")
+        languages = (
+            [get_language_name(locale, get_lang3(language_iso2))]
+            if language_iso2
+            else []
+        )
+        return languages
@@ -0,0 +1,359 @@
+# -*- coding: utf-8 -*-
+#  This file is part of the Calibre-Web (https://github.com/janeczku/calibre-web)
+#    Copyright (C) 2021 OzzieIsaacs
+#
+#  This program is free software: you can redistribute it and/or modify
+#  it under the terms of the GNU General Public License as published by
+#  the Free Software Foundation, either version 3 of the License, or
+#  (at your option) any later version.
+#
+#  This program is distributed in the hope that it will be useful,
+#  but WITHOUT ANY WARRANTY; without even the implied warranty of
+#  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+#  GNU General Public License for more details.
+#
+#  You should have received a copy of the GNU General Public License
+#  along with this program. If not, see <http://www.gnu.org/licenses/>.
+import datetime
+import json
+import re
+from multiprocessing.pool import ThreadPool
+from typing import List, Optional, Tuple, Union
+from urllib.parse import quote
+
+import requests
+from dateutil import parser
+from html2text import HTML2Text
+from lxml.html import HtmlElement, fromstring, tostring
+from markdown2 import Markdown
+
+from cps import logger
+from cps.isoLanguages import get_language_name
+from cps.services.Metadata import MetaRecord, MetaSourceInfo, Metadata
+
+log = logger.create()
+
+SYMBOLS_TO_TRANSLATE = (
+    "öÖüÜóÓőŐúÚéÉáÁűŰíÍąĄćĆęĘłŁńŃóÓśŚźŹżŻ",
+    "oOuUoOoOuUeEaAuUiIaAcCeElLnNoOsSzZzZ",
+)
+SYMBOL_TRANSLATION_MAP = dict(
+    [(ord(a), ord(b)) for (a, b) in zip(*SYMBOLS_TO_TRANSLATE)]
+)
+
+
+def get_int_or_float(value: str) -> Union[int, float]:
+    number_as_float = float(value)
+    number_as_int = int(number_as_float)
+    return number_as_int if number_as_float == number_as_int else number_as_float
+
+
+def strip_accents(s: Optional[str]) -> Optional[str]:
+    return s.translate(SYMBOL_TRANSLATION_MAP) if s is not None else s
+
+
+def sanitize_comments_html(html: str) -> str:
+    text = html2text(html)
+    md = Markdown()
+    html = md.convert(text)
+    return html
+
+
+def html2text(html: str) -> str:
+    # replace <u> tags with <span> as <u> becomes emphasis in html2text
+    if isinstance(html, bytes):
+        html = html.decode("utf-8")
+    html = re.sub(
+        r"<\s*(?P<solidus>/?)\s*[uU]\b(?P<rest>[^>]*)>",
+        r"<\g<solidus>span\g<rest>>",
+        html,
+    )
+    h2t = HTML2Text()
+    h2t.body_width = 0
+    h2t.single_line_break = True
+    h2t.emphasis_mark = "*"
+    return h2t.handle(html)
+
+
+class LubimyCzytac(Metadata):
+    __name__ = "LubimyCzytac.pl"
+    __id__ = "lubimyczytac"
+
+    BASE_URL = "https://lubimyczytac.pl"
+
+    BOOK_SEARCH_RESULT_XPATH = (
+        "*//div[@class='listSearch']//div[@class='authorAllBooks__single']"
+    )
+    SINGLE_BOOK_RESULT_XPATH = ".//div[contains(@class,'authorAllBooks__singleText')]"
+    TITLE_PATH = "/div/a[contains(@class,'authorAllBooks__singleTextTitle')]"
+    TITLE_TEXT_PATH = f"{TITLE_PATH}//text()"
+    URL_PATH = f"{TITLE_PATH}/@href"
+    AUTHORS_PATH = "/div/a[contains(@href,'autor')]//text()"
+
+    SIBLINGS = "/following-sibling::dd"
+
+    CONTAINER = "//section[@class='container book']"
+    PUBLISHER = f"{CONTAINER}//dt[contains(text(),'Wydawnictwo:')]{SIBLINGS}/a/text()"
+    LANGUAGES = f"{CONTAINER}//dt[contains(text(),'Język:')]{SIBLINGS}/text()"
+    DESCRIPTION = f"{CONTAINER}//div[@class='collapse-content']"
+    SERIES = f"{CONTAINER}//span/a[contains(@href,'/cykl/')]/text()"
+    TRANSLATOR = f"{CONTAINER}//dt[contains(text(),'Tłumacz:')]{SIBLINGS}/a/text()"
+
+    DETAILS = "//div[@id='book-details']"
+    PUBLISH_DATE = "//dt[contains(@title,'Data pierwszego wydania"
+    FIRST_PUBLISH_DATE = f"{DETAILS}{PUBLISH_DATE} oryginalnego')]{SIBLINGS}[1]/text()"
+    FIRST_PUBLISH_DATE_PL = f"{DETAILS}{PUBLISH_DATE} polskiego')]{SIBLINGS}[1]/text()"
+    TAGS = "//a[contains(@href,'/ksiazki/t/')]/text()"  # "//nav[@aria-label='breadcrumbs']//a[contains(@href,'/ksiazki/k/')]/span/text()"
+
+
+    RATING = "//meta[@property='books:rating:value']/@content"
+    COVER = "//meta[@property='og:image']/@content"
+    ISBN = "//meta[@property='books:isbn']/@content"
+    META_TITLE = "//meta[@property='og:description']/@content"
+
+    SUMMARY = "//script[@type='application/ld+json']//text()"
+
+    def search(
+        self, query: str, generic_cover: str = "", locale: str = "en"
+    ) -> Optional[List[MetaRecord]]:
+        if self.active:
+            try:
+                result = requests.get(self._prepare_query(title=query))
+                result.raise_for_status()
+            except Exception as e:
+                log.warning(e)
+                return None
+            root = fromstring(result.text)
+            lc_parser = LubimyCzytacParser(root=root, metadata=self)
+            matches = lc_parser.parse_search_results()
+            if matches:
+                with ThreadPool(processes=10) as pool:
+                    final_matches = pool.starmap(
+                        lc_parser.parse_single_book,
+                        [(match, generic_cover, locale) for match in matches],
+                    )
+                return final_matches
+            return matches
+
+    def _prepare_query(self, title: str) -> str:
+        query = ""
+        characters_to_remove = r"\?()\/"
+        pattern = "[" + characters_to_remove + "]"
+        title = re.sub(pattern, "", title)
+        title = title.replace("_", " ")
+        if '"' in title or ",," in title:
+            title = title.split('"')[0].split(",,")[0]
+
+        if "/" in title:
+            title_tokens = [
+                token for token in title.lower().split(" ") if len(token) > 1
+            ]
+        else:
+            title_tokens = list(self.get_title_tokens(title, strip_joiners=False))
+        if title_tokens:
+            tokens = [quote(t.encode("utf-8")) for t in title_tokens]
+            query = query + "%20".join(tokens)
+        if not query:
+            return ""
+        return f"{LubimyCzytac.BASE_URL}/szukaj/ksiazki?phrase={query}"
+
+
+class LubimyCzytacParser:
+    PAGES_TEMPLATE = "<p id='strony'>Książka ma {0} stron(y).</p>"
+    TRANSLATOR_TEMPLATE = "<p id='translator'>Tłumacz: {0}</p>"
+    PUBLISH_DATE_TEMPLATE = "<p id='pierwsze_wydanie'>Data pierwszego wydania: {0}</p>"
+    PUBLISH_DATE_PL_TEMPLATE = (
+        "<p id='pierwsze_wydanie'>Data pierwszego wydania w Polsce: {0}</p>"
+    )
+
+    def __init__(self, root: HtmlElement, metadata: Metadata) -> None:
+        self.root = root
+        self.metadata = metadata
+
+    def parse_search_results(self) -> List[MetaRecord]:
+        matches = []
+        results = self.root.xpath(LubimyCzytac.BOOK_SEARCH_RESULT_XPATH)
+        for result in results:
+            title = self._parse_xpath_node(
+                root=result,
+                xpath=f"{LubimyCzytac.SINGLE_BOOK_RESULT_XPATH}"
+                f"{LubimyCzytac.TITLE_TEXT_PATH}",
+            )
+
+            book_url = self._parse_xpath_node(
+                root=result,
+                xpath=f"{LubimyCzytac.SINGLE_BOOK_RESULT_XPATH}"
+                f"{LubimyCzytac.URL_PATH}",
+            )
+            authors = self._parse_xpath_node(
+                root=result,
+                xpath=f"{LubimyCzytac.SINGLE_BOOK_RESULT_XPATH}"
+                f"{LubimyCzytac.AUTHORS_PATH}",
+                take_first=False,
+            )
+            if not all([title, book_url, authors]):
+                continue
+            matches.append(
+                MetaRecord(
+                    id=book_url.replace(f"/ksiazka/", "").split("/")[0],
+                    title=title,
+                    authors=[strip_accents(author) for author in authors],
+                    url=LubimyCzytac.BASE_URL + book_url,
+                    source=MetaSourceInfo(
+                        id=self.metadata.__id__,
+                        description=self.metadata.__name__,
+                        link=LubimyCzytac.BASE_URL,
+                    ),
+                )
+            )
+        return matches
+
+    def parse_single_book(
+        self, match: MetaRecord, generic_cover: str, locale: str
+    ) -> MetaRecord:
+        try:
+            response = requests.get(match.url)
+            response.raise_for_status()
+        except Exception as e:
+            log.warning(e)
+            return None
+        self.root = fromstring(response.text)
+        match.cover = self._parse_cover(generic_cover=generic_cover)
+        match.description = self._parse_description()
+        match.languages = self._parse_languages(locale=locale)
+        match.publisher = self._parse_publisher()
+        match.publishedDate = self._parse_from_summary(attribute_name="datePublished")
+        match.rating = self._parse_rating()
+        match.series, match.series_index = self._parse_series()
+        match.tags = self._parse_tags()
+        match.identifiers = {
+            "isbn": self._parse_isbn(),
+            "lubimyczytac": match.id,
+        }
+        return match
+
+    def _parse_xpath_node(
+        self,
+        xpath: str,
+        root: HtmlElement = None,
+        take_first: bool = True,
+        strip_element: bool = True,
+    ) -> Optional[Union[str, List[str]]]:
+        root = root if root is not None else self.root
+        node = root.xpath(xpath)
+        if not node:
+            return None
+        return (
+            (node[0].strip() if strip_element else node[0])
+            if take_first
+            else [x.strip() for x in node]
+        )
+
+    def _parse_cover(self, generic_cover) -> Optional[str]:
+        return (
+            self._parse_xpath_node(xpath=LubimyCzytac.COVER, take_first=True)
+            or generic_cover
+        )
+
+    def _parse_publisher(self) -> Optional[str]:
+        return self._parse_xpath_node(xpath=LubimyCzytac.PUBLISHER, take_first=True)
+
+    def _parse_languages(self, locale: str) -> List[str]:
+        languages = list()
+        lang = self._parse_xpath_node(xpath=LubimyCzytac.LANGUAGES, take_first=True)
+        if lang:
+            if "polski" in lang:
+                languages.append("pol")
+            if "angielski" in lang:
+                languages.append("eng")
+        return [get_language_name(locale, language) for language in languages]
+
+    def _parse_series(self) -> Tuple[Optional[str], Optional[Union[float, int]]]:
+        series_index = 0
+        series = self._parse_xpath_node(xpath=LubimyCzytac.SERIES, take_first=True)
+        if series:
+            if "tom " in series:
+                series_name, series_info = series.split(" (tom ", 1)
+                series_info = series_info.replace(" ", "").replace(")", "")
+                # Check if book is not a bundle, i.e. chapter 1-3
+                if "-" in series_info:
+                    series_info = series_info.split("-", 1)[0]
+                if series_info.replace(".", "").isdigit() is True:
+                    series_index = get_int_or_float(series_info)
+                return series_name, series_index
+        return None, None
+
+    def _parse_tags(self) -> List[str]:
+        tags = self._parse_xpath_node(xpath=LubimyCzytac.TAGS, take_first=False)
+        if tags:
+            return [
+                strip_accents(w.replace(", itd.", " itd."))
+                for w in tags
+                if isinstance(w, str)
+            ]
+        return None
+
+    def _parse_from_summary(self, attribute_name: str) -> Optional[str]:
+        value = None
+        summary_text = self._parse_xpath_node(xpath=LubimyCzytac.SUMMARY)
+        if summary_text:
+            data = json.loads(summary_text)
+            value = data.get(attribute_name)
+        return value.strip() if value is not None else value
+
+    def _parse_rating(self) -> Optional[str]:
+        rating = self._parse_xpath_node(xpath=LubimyCzytac.RATING)
+        return round(float(rating.replace(",", ".")) / 2) if rating else rating
+
+    def _parse_date(self, xpath="first_publish") -> Optional[datetime.datetime]:
+        options = {
+            "first_publish": LubimyCzytac.FIRST_PUBLISH_DATE,
+            "first_publish_pl": LubimyCzytac.FIRST_PUBLISH_DATE_PL,
+        }
+        date = self._parse_xpath_node(xpath=options.get(xpath))
+        return parser.parse(date) if date else None
+
+    def _parse_isbn(self) -> Optional[str]:
+        return self._parse_xpath_node(xpath=LubimyCzytac.ISBN)
+
+    def _parse_description(self) -> str:
+        description = ""
+        description_node = self._parse_xpath_node(
+            xpath=LubimyCzytac.DESCRIPTION, strip_element=False
+        )
+        if description_node is not None:
+            for source in self.root.xpath('//p[@class="source"]'):
+                source.getparent().remove(source)
+            description = tostring(description_node, method="html")
+            description = sanitize_comments_html(description)
+
+        else:
+            description_node = self._parse_xpath_node(xpath=LubimyCzytac.META_TITLE)
+            if description_node is not None:
+                description = description_node
+                description = sanitize_comments_html(description)
+        description = self._add_extra_info_to_description(description=description)
+        return description
+
+    def _add_extra_info_to_description(self, description: str) -> str:
+        pages = self._parse_from_summary(attribute_name="numberOfPages")
+        if pages:
+            description += LubimyCzytacParser.PAGES_TEMPLATE.format(pages)
+
+        first_publish_date = self._parse_date()
+        if first_publish_date:
+            description += LubimyCzytacParser.PUBLISH_DATE_TEMPLATE.format(
+                first_publish_date.strftime("%d.%m.%Y")
+            )
+
+        first_publish_date_pl = self._parse_date(xpath="first_publish_pl")
+        if first_publish_date_pl:
+            description += LubimyCzytacParser.PUBLISH_DATE_PL_TEMPLATE.format(
+                first_publish_date_pl.strftime("%d.%m.%Y")
+            )
+        translator = self._parse_xpath_node(xpath=LubimyCzytac.TRANSLATOR)
+        if translator:
+            description += LubimyCzytacParser.TRANSLATOR_TEMPLATE.format(translator)
+
+
+        return description
@@ -0,0 +1,83 @@
+# -*- coding: utf-8 -*-
+
+#  This file is part of the Calibre-Web (https://github.com/janeczku/calibre-web)
+#    Copyright (C) 2021 OzzieIsaacs
+#
+#  This program is free software: you can redistribute it and/or modify
+#  it under the terms of the GNU General Public License as published by
+#  the Free Software Foundation, either version 3 of the License, or
+#  (at your option) any later version.
+#
+#  This program is distributed in the hope that it will be useful,
+#  but WITHOUT ANY WARRANTY; without even the implied warranty of
+#  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+#  GNU General Public License for more details.
+#
+#  You should have received a copy of the GNU General Public License
+#  along with this program. If not, see <http://www.gnu.org/licenses/>.
+import itertools
+from typing import Dict, List, Optional
+from urllib.parse import quote, unquote
+
+try:
+    from fake_useragent.errors import FakeUserAgentError
+except (ImportError):
+    FakeUserAgentError = BaseException
+try:
+    from scholarly import scholarly
+except FakeUserAgentError:
+    raise ImportError("No module named 'scholarly'")
+
+from cps import logger
+from cps.services.Metadata import MetaRecord, MetaSourceInfo, Metadata
+
+log = logger.create()
+
+
+class scholar(Metadata):
+    __name__ = "Google Scholar"
+    __id__ = "googlescholar"
+    META_URL = "https://scholar.google.com/"
+
+    def search(
+        self, query: str, generic_cover: str = "", locale: str = "en"
+    ) -> Optional[List[MetaRecord]]:
+        val = list()
+        if self.active:
+            title_tokens = list(self.get_title_tokens(query, strip_joiners=False))
+            if title_tokens:
+                tokens = [quote(t.encode("utf-8")) for t in title_tokens]
+                query = " ".join(tokens)
+            try:
+                scholarly.set_timeout(20)
+                scholarly.set_retries(2)
+                scholar_gen = itertools.islice(scholarly.search_pubs(query), 10)
+            except Exception as e:
+                log.warning(e)
+                return list()
+            for result in scholar_gen:
+                match = self._parse_search_result(
+                    result=result, generic_cover="", locale=locale
+                )
+                val.append(match)
+        return val
+
+    def _parse_search_result(
+        self, result: Dict, generic_cover: str, locale: str
+    ) -> MetaRecord:
+        match = MetaRecord(
+            id=result.get("pub_url", result.get("eprint_url", "")),
+            title=result["bib"].get("title"),
+            authors=result["bib"].get("author", []),
+            url=result.get("pub_url", result.get("eprint_url", "")),
+            source=MetaSourceInfo(
+                id=self.__id__, description=self.__name__, link=scholar.META_URL
+            ),
+        )
+
+        match.cover = result.get("image", {}).get("original_url", generic_cover)
+        match.description = unquote(result["bib"].get("abstract", ""))
+        match.publisher = result["bib"].get("venue", "")
+        match.publishedDate = result["bib"].get("pub_year") + "-01-01"
+        match.identifiers = {"scholar": match.id}
+        return match
@@ -16,152 +16,141 @@
 #  You should have received a copy of the GNU General Public License
 #  along with this program. If not, see <http://www.gnu.org/licenses/>

-from __future__ import division, print_function, unicode_literals
 from flask import session

-
 try:
-    from flask_dance.consumer.backend.sqla import SQLAlchemyBackend, first, _get_real_user
+    from flask_dance.consumer.storage.sqla import SQLAlchemyStorage as SQLAlchemyBackend
+    from flask_dance.consumer.storage.sqla import first, _get_real_user
    from sqlalchemy.orm.exc import NoResultFound
-    backend_resultcode = False       # prevent storing values with this resultcode
+    backend_resultcode = True  # prevent storing values with this resultcode
 except ImportError:
-    # fails on flask-dance >1.3, due to renaming
-    try:
-        from flask_dance.consumer.storage.sqla import SQLAlchemyStorage as SQLAlchemyBackend
-        from flask_dance.consumer.storage.sqla import first, _get_real_user
-        from sqlalchemy.orm.exc import NoResultFound
-        backend_resultcode = True  # prevent storing values with this resultcode
-    except ImportError:
-        pass
+    pass

-try:
-    class OAuthBackend(SQLAlchemyBackend):
-        """
-        Stores and retrieves OAuth tokens using a relational database through
-        the `SQLAlchemy`_ ORM.

-        .. _SQLAlchemy: https://www.sqlalchemy.org/
-        """
-        def __init__(self, model, session, provider_id,
-                     user=None, user_id=None, user_required=None, anon_user=None,
-                     cache=None):
-            self.provider_id = provider_id
-            super(OAuthBackend, self).__init__(model, session, user, user_id, user_required, anon_user, cache)
+class OAuthBackend(SQLAlchemyBackend):
+    """
+    Stores and retrieves OAuth tokens using a relational database through
+    the `SQLAlchemy`_ ORM.

-        def get(self, blueprint, user=None, user_id=None):
-            if self.provider_id + '_oauth_token' in session and session[self.provider_id + '_oauth_token'] != '':
-                return session[self.provider_id + '_oauth_token']
-            # check cache
-            cache_key = self.make_cache_key(blueprint=blueprint, user=user, user_id=user_id)
-            token = self.cache.get(cache_key)
-            if token:
-                return token
-
-            # if not cached, make database queries
-            query = (
-                self.session.query(self.model)
-                .filter_by(provider=self.provider_id)
-            )
-            uid = first([user_id, self.user_id, blueprint.config.get("user_id")])
-            u = first(_get_real_user(ref, self.anon_user)
-                      for ref in (user, self.user, blueprint.config.get("user")))
-
-            use_provider_user_id = False
-            if self.provider_id + '_oauth_user_id' in session and session[self.provider_id + '_oauth_user_id'] != '':
-                query = query.filter_by(provider_user_id=session[self.provider_id + '_oauth_user_id'])
-                use_provider_user_id = True
-
-            if self.user_required and not u and not uid and not use_provider_user_id:
-                # raise ValueError("Cannot get OAuth token without an associated user")
-                return None
-            # check for user ID
-            if hasattr(self.model, "user_id") and uid:
-                query = query.filter_by(user_id=uid)
-            # check for user (relationship property)
-            elif hasattr(self.model, "user") and u:
-                query = query.filter_by(user=u)
-            # if we have the property, but not value, filter by None
-            elif hasattr(self.model, "user_id"):
-                query = query.filter_by(user_id=None)
-            # run query
-            try:
-                token = query.one().token
-            except NoResultFound:
-                token = None
-
-            # cache the result
-            self.cache.set(cache_key, token)
+    _SQLAlchemy: https://www.sqlalchemy.org/
+    """
+    def __init__(self, model, session, provider_id,
+                 user=None, user_id=None, user_required=None, anon_user=None,
+                 cache=None):
+        self.provider_id = provider_id
+        super(OAuthBackend, self).__init__(model, session, user, user_id, user_required, anon_user, cache)

+    def get(self, blueprint, user=None, user_id=None):
+        if self.provider_id + '_oauth_token' in session and session[self.provider_id + '_oauth_token'] != '':
+            return session[self.provider_id + '_oauth_token']
+        # check cache
+        cache_key = self.make_cache_key(blueprint=blueprint, user=user, user_id=user_id)
+        token = self.cache.get(cache_key)
+        if token:
            return token

-        def set(self, blueprint, token, user=None, user_id=None):
-            uid = first([user_id, self.user_id, blueprint.config.get("user_id")])
-            u = first(_get_real_user(ref, self.anon_user)
-                      for ref in (user, self.user, blueprint.config.get("user")))
+        # if not cached, make database queries
+        query = (
+            self.session.query(self.model)
+            .filter_by(provider=self.provider_id)
+        )
+        uid = first([user_id, self.user_id, blueprint.config.get("user_id")])
+        u = first(_get_real_user(ref, self.anon_user)
+                  for ref in (user, self.user, blueprint.config.get("user")))

-            if self.user_required and not u and not uid:
-                raise ValueError("Cannot set OAuth token without an associated user")
+        use_provider_user_id = False
+        if self.provider_id + '_oauth_user_id' in session and session[self.provider_id + '_oauth_user_id'] != '':
+            query = query.filter_by(provider_user_id=session[self.provider_id + '_oauth_user_id'])
+            use_provider_user_id = True

-            # if there was an existing model, delete it
-            existing_query = (
-                self.session.query(self.model)
-                .filter_by(provider=self.provider_id)
-            )
-            # check for user ID
-            has_user_id = hasattr(self.model, "user_id")
-            if has_user_id and uid:
-                existing_query = existing_query.filter_by(user_id=uid)
-            # check for user (relationship property)
-            has_user = hasattr(self.model, "user")
-            if has_user and u:
-                existing_query = existing_query.filter_by(user=u)
-            # queue up delete query -- won't be run until commit()
-            existing_query.delete()
-            # create a new model for this token
-            kwargs = {
-                "provider": self.provider_id,
-                "token": token,
-            }
-            if has_user_id and uid:
-                kwargs["user_id"] = uid
-            if has_user and u:
-                kwargs["user"] = u
-            self.session.add(self.model(**kwargs))
-            # commit to delete and add simultaneously
-            self.session.commit()
-            # invalidate cache
-            self.cache.delete(self.make_cache_key(
-                blueprint=blueprint, user=user, user_id=user_id
-            ))
+        if self.user_required and not u and not uid and not use_provider_user_id:
+            # raise ValueError("Cannot get OAuth token without an associated user")
+            return None
+        # check for user ID
+        if hasattr(self.model, "user_id") and uid:
+            query = query.filter_by(user_id=uid)
+        # check for user (relationship property)
+        elif hasattr(self.model, "user") and u:
+            query = query.filter_by(user=u)
+        # if we have the property, but not value, filter by None
+        elif hasattr(self.model, "user_id"):
+            query = query.filter_by(user_id=None)
+        # run query
+        try:
+            token = query.one().token
+        except NoResultFound:
+            token = None

-        def delete(self, blueprint, user=None, user_id=None):
-            query = (
-                self.session.query(self.model)
-                .filter_by(provider=self.provider_id)
-            )
-            uid = first([user_id, self.user_id, blueprint.config.get("user_id")])
-            u = first(_get_real_user(ref, self.anon_user)
-                      for ref in (user, self.user, blueprint.config.get("user")))
+        # cache the result
+        self.cache.set(cache_key, token)

-            if self.user_required and not u and not uid:
-                raise ValueError("Cannot delete OAuth token without an associated user")
+        return token

-            # check for user ID
-            if hasattr(self.model, "user_id") and uid:
-                query = query.filter_by(user_id=uid)
-            # check for user (relationship property)
-            elif hasattr(self.model, "user") and u:
-                query = query.filter_by(user=u)
-            # if we have the property, but not value, filter by None
-            elif hasattr(self.model, "user_id"):
-                query = query.filter_by(user_id=None)
-            # run query
-            query.delete()
-            self.session.commit()
-            # invalidate cache
-            self.cache.delete(self.make_cache_key(
-                blueprint=blueprint, user=user, user_id=user_id,
-            ))
+    def set(self, blueprint, token, user=None, user_id=None):
+        uid = first([user_id, self.user_id, blueprint.config.get("user_id")])
+        u = first(_get_real_user(ref, self.anon_user)
+                  for ref in (user, self.user, blueprint.config.get("user")))

-except Exception:
-    pass
+        if self.user_required and not u and not uid:
+            raise ValueError("Cannot set OAuth token without an associated user")
+
+        # if there was an existing model, delete it
+        existing_query = (
+            self.session.query(self.model)
+            .filter_by(provider=self.provider_id)
+        )
+        # check for user ID
+        has_user_id = hasattr(self.model, "user_id")
+        if has_user_id and uid:
+            existing_query = existing_query.filter_by(user_id=uid)
+        # check for user (relationship property)
+        has_user = hasattr(self.model, "user")
+        if has_user and u:
+            existing_query = existing_query.filter_by(user=u)
+        # queue up delete query -- won't be run until commit()
+        existing_query.delete()
+        # create a new model for this token
+        kwargs = {
+            "provider": self.provider_id,
+            "token": token,
+        }
+        if has_user_id and uid:
+            kwargs["user_id"] = uid
+        if has_user and u:
+            kwargs["user"] = u
+        self.session.add(self.model(**kwargs))
+        # commit to delete and add simultaneously
+        self.session.commit()
+        # invalidate cache
+        self.cache.delete(self.make_cache_key(
+            blueprint=blueprint, user=user, user_id=user_id
+        ))
+
+    def delete(self, blueprint, user=None, user_id=None):
+        query = (
+            self.session.query(self.model)
+            .filter_by(provider=self.provider_id)
+        )
+        uid = first([user_id, self.user_id, blueprint.config.get("user_id")])
+        u = first(_get_real_user(ref, self.anon_user)
+                  for ref in (user, self.user, blueprint.config.get("user")))
+
+        if self.user_required and not u and not uid:
+            raise ValueError("Cannot delete OAuth token without an associated user")
+
+        # check for user ID
+        if hasattr(self.model, "user_id") and uid:
+            query = query.filter_by(user_id=uid)
+        # check for user (relationship property)
+        elif hasattr(self.model, "user") and u:
+            query = query.filter_by(user=u)
+        # if we have the property, but not value, filter by None
+        elif hasattr(self.model, "user_id"):
+            query = query.filter_by(user_id=None)
+        # run query
+        query.delete()
+        self.session.commit()
+        # invalidate cache
+        self.cache.delete(self.make_cache_key(
+            blueprint=blueprint, user=user, user_id=user_id,
+        ))
@@ -20,7 +20,6 @@
 #  You should have received a copy of the GNU General Public License
 #  along with this program. If not, see <http://www.gnu.org/licenses/>

-from __future__ import division, print_function, unicode_literals
 import json
 from functools import wraps

@@ -30,15 +29,21 @@ from flask_babel import gettext as _
 from flask_dance.consumer import oauth_authorized, oauth_error
 from flask_dance.contrib.github import make_github_blueprint, github
 from flask_dance.contrib.google import make_google_blueprint, google
-from flask_login import login_user, current_user, login_required
+from oauthlib.oauth2 import TokenExpiredError, InvalidGrantError
+from .cw_login import login_user, current_user
 from sqlalchemy.orm.exc import NoResultFound
+from .usermanagement import user_login_required

 from . import constants, logger, config, app, ub

-from .oauth import OAuthBackend, backend_resultcode
+try:
+    from .oauth import OAuthBackend, backend_resultcode
+except NameError:
+    pass


 oauth_check = {}
+oauthblueprints = []
 oauth = Blueprint('oauth', __name__)
 log = logger.create()

@@ -70,7 +75,7 @@ def register_user_with_oauth(user=None):
    if len(all_oauth.keys()) == 0:
        return
    if user is None:
-        flash(_(u"Register with %(provider)s", provider=", ".join(list(all_oauth.values()))), category="success")
+        flash(_("Register with %(provider)s", provider=", ".join(list(all_oauth.values()))), category="success")
    else:
        for oauth_key in all_oauth.keys():
            # Find this OAuth token in the database, or create it
@@ -84,7 +89,7 @@ def register_user_with_oauth(user=None):
            except NoResultFound:
                # no found, return error
                return
-            ub.session_commit("User {} with OAuth for provider {} registered".format(user.nickname, oauth_key))
+            ub.session_commit("User {} with OAuth for provider {} registered".format(user.name, oauth_key))


 def logout_oauth_user():
@@ -93,8 +98,124 @@ def logout_oauth_user():
            session.pop(str(oauth_key) + '_oauth_user_id')


-if ub.oauth_support:
-    oauthblueprints = []
+def oauth_update_token(provider_id, token, provider_user_id):
+    session[provider_id + "_oauth_user_id"] = provider_user_id
+    session[provider_id + "_oauth_token"] = token
+
+    # Find this OAuth token in the database, or create it
+    query = ub.session.query(ub.OAuth).filter_by(
+        provider=provider_id,
+        provider_user_id=provider_user_id,
+    )
+    try:
+        oauth_entry = query.one()
+        # update token
+        oauth_entry.token = token
+    except NoResultFound:
+        oauth_entry = ub.OAuth(
+            provider=provider_id,
+            provider_user_id=provider_user_id,
+            token=token,
+        )
+    ub.session.add(oauth_entry)
+    ub.session_commit()
+
+    # Disable Flask-Dance's default behavior for saving the OAuth token
+    # Value differrs depending on flask-dance version
+    return backend_resultcode
+
+
+def bind_oauth_or_register(provider_id, provider_user_id, redirect_url, provider_name):
+    query = ub.session.query(ub.OAuth).filter_by(
+        provider=provider_id,
+        provider_user_id=provider_user_id,
+    )
+    try:
+        oauth_entry = query.first()
+        # already bind with user, just login
+        if oauth_entry.user:
+            # If a user is already logged in and it's a different account, reject the link
+            # to prevent account takeover via shared OAuth identities
+            if current_user and current_user.is_authenticated and oauth_entry.user_id != current_user.id:
+                flash(_("This %(oauth)s account is already linked to a different user",
+                        oauth=provider_name), category="error")
+                log.warning("User %s tried to link OAuth account already bound to user %s",
+                            current_user.id, oauth_entry.user_id)
+                return redirect(url_for('web.profile'))
+            login_user(oauth_entry.user)
+            log.debug("You are now logged in as: '%s'", oauth_entry.user.name)
+            flash(_("Success! You are now logged in as: %(nickname)s", nickname=oauth_entry.user.name),
+                  category="success")
+            return redirect(url_for('web.index'))
+        else:
+            # bind to current user
+            if current_user and current_user.is_authenticated:
+                oauth_entry.user = current_user
+                try:
+                    ub.session.add(oauth_entry)
+                    ub.session.commit()
+                    flash(_("Link to %(oauth)s Succeeded", oauth=provider_name), category="success")
+                    log.info("Link to {} Succeeded".format(provider_name))
+                    return redirect(url_for('web.profile'))
+                except Exception as ex:
+                    log.error_or_exception(ex)
+                    ub.session.rollback()
+            else:
+                flash(_("Login failed, No User Linked With OAuth Account"), category="error")
+            log.info('Login failed, No User Linked With OAuth Account')
+            return redirect(url_for('web.login'))
+            # return redirect(url_for('web.login'))
+            # if config.config_public_reg:
+            #   return redirect(url_for('web.register'))
+            # else:
+            #    flash(_("Public registration is not enabled"), category="error")
+            #    return redirect(url_for(redirect_url))
+    except (NoResultFound, AttributeError):
+        return redirect(url_for(redirect_url))
+
+
+def get_oauth_status():
+    status = []
+    query = ub.session.query(ub.OAuth).filter_by(
+        user_id=current_user.id,
+    )
+    try:
+        oauths = query.all()
+        for oauth_entry in oauths:
+            status.append(int(oauth_entry.provider))
+        return status
+    except NoResultFound:
+        return None
+
+
+def unlink_oauth(provider):
+    if request.host_url + 'me' != request.referrer:
+        pass
+    query = ub.session.query(ub.OAuth).filter_by(
+        provider=provider,
+        user_id=current_user.id,
+    )
+    try:
+        oauth_entry = query.one()
+        if current_user and current_user.is_authenticated:
+            oauth_entry.user = current_user
+            try:
+                ub.session.delete(oauth_entry)
+                ub.session.commit()
+                logout_oauth_user()
+                flash(_("Unlink to %(oauth)s Succeeded", oauth=oauth_check[provider]), category="success")
+                log.info("Unlink to {} Succeeded".format(oauth_check[provider]))
+            except Exception as ex:
+                log.error_or_exception(ex)
+                ub.session.rollback()
+                flash(_("Unlink to %(oauth)s Failed", oauth=oauth_check[provider]), category="error")
+    except NoResultFound:
+        log.warning("oauth %s for user %d not found", provider, current_user.id)
+        flash(_("Not Linked to %(oauth)s", oauth=provider), category="error")
+    return redirect(url_for('web.profile'))
+
+
+def generate_oauth_blueprints():
    if not ub.session.query(ub.OAuthProvider).count():
        for provider in ("github", "google"):
            oauthProvider = ub.OAuthProvider()
@@ -138,17 +259,23 @@ if ub.oauth_support:
        app.register_blueprint(blueprint, url_prefix="/login")
        if element['active']:
            register_oauth_blueprint(element['id'], element['provider_name'])
+    return oauthblueprints


+if ub.oauth_support:
+    oauthblueprints = generate_oauth_blueprints()
+
    @oauth_authorized.connect_via(oauthblueprints[0]['blueprint'])
    def github_logged_in(blueprint, token):
        if not token:
-            flash(_(u"Failed to log in with GitHub."), category="error")
+            flash(_("Failed to log in with GitHub."), category="error")
+            log.error("Failed to log in with GitHub")
            return False

        resp = blueprint.session.get("/user")
        if not resp.ok:
-            flash(_(u"Failed to fetch user info from GitHub."), category="error")
+            flash(_("Failed to fetch user info from GitHub."), category="error")
+            log.error("Failed to fetch user info from GitHub")
            return False

        github_info = resp.json()
@@ -159,12 +286,14 @@ if ub.oauth_support:
    @oauth_authorized.connect_via(oauthblueprints[1]['blueprint'])
    def google_logged_in(blueprint, token):
        if not token:
-            flash(_(u"Failed to log in with Google."), category="error")
+            flash(_("Failed to log in with Google."), category="error")
+            log.error("Failed to log in with Google")
            return False

        resp = blueprint.session.get("/oauth2/v2/userinfo")
        if not resp.ok:
-            flash(_(u"Failed to fetch user info from Google."), category="error")
+            flash(_("Failed to fetch user info from Google."), category="error")
+            log.error("Failed to fetch user info from Google")
            return False

        google_info = resp.json()
@@ -172,119 +301,13 @@ if ub.oauth_support:
        return oauth_update_token(str(oauthblueprints[1]['id']), token, google_user_id)


-    def oauth_update_token(provider_id, token, provider_user_id):
-        session[provider_id + "_oauth_user_id"] = provider_user_id
-        session[provider_id + "_oauth_token"] = token
-
-        # Find this OAuth token in the database, or create it
-        query = ub.session.query(ub.OAuth).filter_by(
-            provider=provider_id,
-            provider_user_id=provider_user_id,
-        )
-        try:
-            oauth_entry = query.one()
-            # update token
-            oauth_entry.token = token
-        except NoResultFound:
-            oauth_entry = ub.OAuth(
-                provider=provider_id,
-                provider_user_id=provider_user_id,
-                token=token,
-            )
-        ub.session.add(oauth_entry)
-        ub.session_commit()
-
-        # Disable Flask-Dance's default behavior for saving the OAuth token
-        # Value differrs depending on flask-dance version
-        return backend_resultcode
-
-
-    def bind_oauth_or_register(provider_id, provider_user_id, redirect_url, provider_name):
-        query = ub.session.query(ub.OAuth).filter_by(
-            provider=provider_id,
-            provider_user_id=provider_user_id,
-        )
-        try:
-            oauth_entry = query.first()
-            # already bind with user, just login
-            if oauth_entry.user:
-                login_user(oauth_entry.user)
-                log.debug(u"You are now logged in as: '%s'", oauth_entry.user.nickname)
-                flash(_(u"you are now logged in as: '%(nickname)s'", nickname= oauth_entry.user.nickname),
-                      category="success")
-                return redirect(url_for('web.index'))
-            else:
-                # bind to current user
-                if current_user and current_user.is_authenticated:
-                    oauth_entry.user = current_user
-                    try:
-                        ub.session.add(oauth_entry)
-                        ub.session.commit()
-                        flash(_(u"Link to %(oauth)s Succeeded", oauth=provider_name), category="success")
-                        return redirect(url_for('web.profile'))
-                    except Exception as e:
-                        log.debug_or_exception(e)
-                        ub.session.rollback()
-                else:
-                    flash(_(u"Login failed, No User Linked With OAuth Account"), category="error")
-                log.info('Login failed, No User Linked With OAuth Account')
-                return redirect(url_for('web.login'))
-                # return redirect(url_for('web.login'))
-                # if config.config_public_reg:
-                #   return redirect(url_for('web.register'))
-                # else:
-                #    flash(_(u"Public registration is not enabled"), category="error")
-                #    return redirect(url_for(redirect_url))
-        except (NoResultFound, AttributeError):
-            return redirect(url_for(redirect_url))
-
-
-    def get_oauth_status():
-        status = []
-        query = ub.session.query(ub.OAuth).filter_by(
-            user_id=current_user.id,
-        )
-        try:
-            oauths = query.all()
-            for oauth_entry in oauths:
-                status.append(int(oauth_entry.provider))
-            return status
-        except NoResultFound:
-            return None
-
-
-    def unlink_oauth(provider):
-        if request.host_url + 'me' != request.referrer:
-            pass
-        query = ub.session.query(ub.OAuth).filter_by(
-            provider=provider,
-            user_id=current_user.id,
-        )
-        try:
-            oauth_entry = query.one()
-            if current_user and current_user.is_authenticated:
-                oauth_entry.user = current_user
-                try:
-                    ub.session.delete(oauth_entry)
-                    ub.session.commit()
-                    logout_oauth_user()
-                    flash(_(u"Unlink to %(oauth)s Succeeded", oauth=oauth_check[provider]), category="success")
-                except Exception as e:
-                    log.debug_or_exception(e)
-                    ub.session.rollback()
-                    flash(_(u"Unlink to %(oauth)s Failed", oauth=oauth_check[provider]), category="error")
-        except NoResultFound:
-            log.warning("oauth %s for user %d not found", provider, current_user.id)
-            flash(_(u"Not Linked to %(oauth)s", oauth=provider), category="error")
-        return redirect(url_for('web.profile'))
-

    # notify on OAuth provider error
    @oauth_error.connect_via(oauthblueprints[0]['blueprint'])
    def github_error(blueprint, error, error_description=None, error_uri=None):
        msg = (
-            u"OAuth error from {name}! "
-            u"error={error} description={description} uri={uri}"
+            "OAuth error from {name}! "
+            "error={error} description={description} uri={uri}"
        ).format(
            name=blueprint.name,
            error=error,
@@ -293,44 +316,11 @@ if ub.oauth_support:
        )  # ToDo: Translate
        flash(msg, category="error")

-
-    @oauth.route('/link/github')
-    @oauth_required
-    def github_login():
-        if not github.authorized:
-            return redirect(url_for('github.login'))
-        account_info = github.get('/user')
-        if account_info.ok:
-            account_info_json = account_info.json()
-            return bind_oauth_or_register(oauthblueprints[0]['id'], account_info_json['id'], 'github.login', 'github')
-        flash(_(u"GitHub Oauth error, please retry later."), category="error")
-        return redirect(url_for('web.login'))
-
-
-    @oauth.route('/unlink/github', methods=["GET"])
-    @login_required
-    def github_login_unlink():
-        return unlink_oauth(oauthblueprints[0]['id'])
-
-
-    @oauth.route('/link/google')
-    @oauth_required
-    def google_login():
-        if not google.authorized:
-            return redirect(url_for("google.login"))
-        resp = google.get("/oauth2/v2/userinfo")
-        if resp.ok:
-            account_info_json = resp.json()
-            return bind_oauth_or_register(oauthblueprints[1]['id'], account_info_json['id'], 'google.login', 'google')
-        flash(_(u"Google Oauth error, please retry later."), category="error")
-        return redirect(url_for('web.login'))
-
-
    @oauth_error.connect_via(oauthblueprints[1]['blueprint'])
    def google_error(blueprint, error, error_description=None, error_uri=None):
        msg = (
-            u"OAuth error from {name}! "
-            u"error={error} description={description} uri={uri}"
+            "OAuth error from {name}! "
+            "error={error} description={description} uri={uri}"
        ).format(
            name=blueprint.name,
            error=error,
@@ -340,7 +330,49 @@ if ub.oauth_support:
        flash(msg, category="error")


-    @oauth.route('/unlink/google', methods=["GET"])
-    @login_required
-    def google_login_unlink():
-        return unlink_oauth(oauthblueprints[1]['id'])
+@oauth.route('/link/github')
+@oauth_required
+def github_login():
+    if not github.authorized:
+        return redirect(url_for('github.login'))
+    try:
+        account_info = github.get('/user')
+        if account_info.ok:
+            account_info_json = account_info.json()
+            return bind_oauth_or_register(oauthblueprints[0]['id'], account_info_json['id'], 'github.login', 'github')
+        flash(_("GitHub Oauth error, please retry later."), category="error")
+        log.error("GitHub Oauth error, please retry later")
+    except (InvalidGrantError, TokenExpiredError) as e:
+        flash(_("GitHub Oauth error: {}").format(e), category="error")
+        log.error(e)
+    return redirect(url_for('web.login'))
+
+
+@oauth.route('/unlink/github', methods=["GET"])
+@user_login_required
+def github_login_unlink():
+    return unlink_oauth(oauthblueprints[0]['id'])
+
+
+@oauth.route('/link/google')
+@oauth_required
+def google_login():
+    if not google.authorized:
+        return redirect(url_for("google.login"))
+    try:
+        resp = google.get("/oauth2/v2/userinfo")
+        if resp.ok:
+            account_info_json = resp.json()
+            return bind_oauth_or_register(oauthblueprints[1]['id'], account_info_json['id'], 'google.login', 'google')
+        flash(_("Google Oauth error, please retry later."), category="error")
+        log.error("Google Oauth error, please retry later")
+    except (InvalidGrantError, TokenExpiredError) as e:
+        flash(_("Google Oauth error: {}").format(e), category="error")
+        log.error(e)
+    return redirect(url_for('web.login'))
+
+
+@oauth.route('/unlink/google', methods=["GET"])
+@user_login_required
+def google_login_unlink():
+    return unlink_oauth(oauthblueprints[1]['id'])
@@ -20,57 +20,29 @@
 #  You should have received a copy of the GNU General Public License
 #  along with this program. If not, see <http://www.gnu.org/licenses/>.

-from __future__ import division, print_function, unicode_literals
-import sys
 import datetime
-from functools import wraps
+from urllib.parse import unquote_plus

-from flask import Blueprint, request, render_template, Response, g, make_response, abort
-from flask_login import current_user
-from sqlalchemy.sql.expression import func, text, or_, and_
-from werkzeug.security import check_password_hash
+from flask import Blueprint, request, render_template, make_response, abort, g, jsonify
+from flask_babel import get_locale
+from flask_babel import gettext as _

-from . import constants, logger, config, db, calibre_db, ub, services, get_locale, isoLanguages
+
+from sqlalchemy.sql.expression import func, text, or_, and_, true
+from sqlalchemy.exc import InvalidRequestError, OperationalError
+
+from . import logger, config, db, calibre_db, ub, isoLanguages, constants
+from .usermanagement import requires_basic_auth_if_no_ano, auth
 from .helper import get_download_link, get_book_cover
 from .pagination import Pagination
 from .web import render_read_books
-from .usermanagement import load_user_from_request
-from flask_babel import gettext as _
-from babel import Locale as LC
-from babel.core import UnknownLocaleError
+

 opds = Blueprint('opds', __name__)

 log = logger.create()


-def requires_basic_auth_if_no_ano(f):
-    @wraps(f)
-    def decorated(*args, **kwargs):
-        auth = request.authorization
-        if config.config_anonbrowse != 1:
-            if not auth or auth.type != 'basic' or not check_auth(auth.username, auth.password):
-                return authenticate()
-        return f(*args, **kwargs)
-    if config.config_login_type == constants.LOGIN_LDAP and services.ldap and config.config_anonbrowse != 1:
-        return services.ldap.basic_auth_required(f)
-    return decorated
-
-
-class FeedObject:
-    def __init__(self, rating_id, rating_name):
-        self.rating_id = rating_id
-        self.rating_name = rating_name
-
-    @property
-    def id(self):
-        return self.rating_id
-
-    @property
-    def name(self):
-        return self.rating_name
-
-
@opds.route("/opds/")
@opds.route("/opds")
@requires_basic_auth_if_no_ano
@@ -84,97 +56,142 @@ def feed_osd():
    return render_xml_template('osd.xml', lang='en-EN')


-@opds.route("/opds/search", defaults={'query': ""})
-@opds.route("/opds/search/<query>")
+# @opds.route("/opds/search", defaults={'query': ""})
+@opds.route("/opds/search/<path:query>")
@requires_basic_auth_if_no_ano
 def feed_cc_search(query):
-    return feed_search(query.strip())
+    # Handle strange query from Libera Reader with + instead of spaces
+    plus_query = unquote_plus(request.environ['RAW_URI'].split('/opds/search/')[1]).strip()
+    return feed_search(plus_query)


@opds.route("/opds/search", methods=["GET"])
@requires_basic_auth_if_no_ano
 def feed_normal_search():
-    return feed_search(request.args.get("query").strip())
+    return feed_search(request.args.get("query", "").strip())
+
+
+@opds.route("/opds/books")
+@requires_basic_auth_if_no_ano
+def feed_booksindex():
+    return render_element_index(db.Books.sort, None, 'opds.feed_letter_books')
+
+
+@opds.route("/opds/books/letter/<book_id>")
+@requires_basic_auth_if_no_ano
+def feed_letter_books(book_id):
+    off = request.args.get("offset") or 0
+    letter = true() if book_id == "00" else func.upper(db.Books.sort).startswith(book_id)
+    entries, __, pagination = calibre_db.fill_indexpage((int(off) / (int(config.config_books_per_page)) + 1), 0,
+                                                        db.Books,
+                                                        letter,
+                                                        [db.Books.sort],
+                                                        True, config.config_read_column)
+    cc = calibre_db.get_cc_columns(config, filter_config_custom_read=True)
+    return render_xml_template('feed.xml', entries=entries, pagination=pagination, cc=cc)


@opds.route("/opds/new")
@requires_basic_auth_if_no_ano
 def feed_new():
+    if not auth.current_user().check_visibility(constants.SIDEBAR_RECENT):
+        abort(404)
    off = request.args.get("offset") or 0
    entries, __, pagination = calibre_db.fill_indexpage((int(off) / (int(config.config_books_per_page)) + 1), 0,
-                                                        db.Books, True, [db.Books.timestamp.desc()])
-    return render_xml_template('feed.xml', entries=entries, pagination=pagination)
+                                                        db.Books, True, [db.Books.timestamp.desc()],
+                                                        True, config.config_read_column)
+    cc = calibre_db.get_cc_columns(config, filter_config_custom_read=True)
+    return render_xml_template('feed.xml', entries=entries, pagination=pagination, cc=cc)


@opds.route("/opds/discover")
@requires_basic_auth_if_no_ano
 def feed_discover():
-    entries = calibre_db.session.query(db.Books).filter(calibre_db.common_filters()).order_by(func.random())\
-        .limit(config.config_books_per_page)
+    if not auth.current_user().check_visibility(constants.SIDEBAR_RANDOM):
+        abort(404)
+    query = calibre_db.generate_linked_query(config.config_read_column, db.Books)
+    entries = query.filter(calibre_db.common_filters()).order_by(func.random()).limit(config.config_books_per_page)
    pagination = Pagination(1, config.config_books_per_page, int(config.config_books_per_page))
-    return render_xml_template('feed.xml', entries=entries, pagination=pagination)
+    cc = calibre_db.get_cc_columns(config, filter_config_custom_read=True)
+    return render_xml_template('feed.xml', entries=entries, pagination=pagination, cc=cc)


@opds.route("/opds/rated")
@requires_basic_auth_if_no_ano
 def feed_best_rated():
+    if not auth.current_user().check_visibility(constants.SIDEBAR_BEST_RATED):
+        abort(404)
    off = request.args.get("offset") or 0
    entries, __, pagination = calibre_db.fill_indexpage((int(off) / (int(config.config_books_per_page)) + 1), 0,
                                                        db.Books, db.Books.ratings.any(db.Ratings.rating > 9),
-                                                        [db.Books.timestamp.desc()])
-    return render_xml_template('feed.xml', entries=entries, pagination=pagination)
+                                                        [db.Books.timestamp.desc()],
+                                                        True, config.config_read_column)
+    cc = calibre_db.get_cc_columns(config, filter_config_custom_read=True)
+    return render_xml_template('feed.xml', entries=entries, pagination=pagination, cc=cc)


@opds.route("/opds/hot")
@requires_basic_auth_if_no_ano
 def feed_hot():
+    if not auth.current_user().check_visibility(constants.SIDEBAR_HOT):
+        abort(404)
    off = request.args.get("offset") or 0
    all_books = ub.session.query(ub.Downloads, func.count(ub.Downloads.book_id)).order_by(
        func.count(ub.Downloads.book_id).desc()).group_by(ub.Downloads.book_id)
    hot_books = all_books.offset(off).limit(config.config_books_per_page)
    entries = list()
    for book in hot_books:
-        downloadBook = calibre_db.get_book(book.Downloads.book_id)
-        if downloadBook:
-            entries.append(
-                calibre_db.get_filtered_book(book.Downloads.book_id)
-            )
+        query = calibre_db.generate_linked_query(config.config_read_column, db.Books)
+        download_book = query.filter(calibre_db.common_filters()).filter(
+            book.Downloads.book_id == db.Books.id).first()
+        if download_book:
+            entries.append(download_book)
        else:
            ub.delete_download(book.Downloads.book_id)
-    numBooks = entries.__len__()
+    num_books = entries.__len__()
    pagination = Pagination((int(off) / (int(config.config_books_per_page)) + 1),
-                            config.config_books_per_page, numBooks)
-    return render_xml_template('feed.xml', entries=entries, pagination=pagination)
+                            config.config_books_per_page, num_books)
+    cc = calibre_db.get_cc_columns(config, filter_config_custom_read=True)
+    return render_xml_template('feed.xml', entries=entries, pagination=pagination, cc=cc)


@opds.route("/opds/author")
@requires_basic_auth_if_no_ano
 def feed_authorindex():
+    if not auth.current_user().check_visibility(constants.SIDEBAR_AUTHOR):
+        abort(404)
+    return render_element_index(db.Authors.sort, db.books_authors_link, 'opds.feed_letter_author')
+
+
+@opds.route("/opds/author/letter/<book_id>")
+@requires_basic_auth_if_no_ano
+def feed_letter_author(book_id):
+    if not auth.current_user().check_visibility(constants.SIDEBAR_AUTHOR):
+        abort(404)
    off = request.args.get("offset") or 0
+    letter = true() if book_id == "00" else func.upper(db.Authors.sort).startswith(book_id)
    entries = calibre_db.session.query(db.Authors).join(db.books_authors_link).join(db.Books)\
-        .filter(calibre_db.common_filters())\
+        .filter(calibre_db.common_filters()).filter(letter)\
        .group_by(text('books_authors_link.author'))\
-        .order_by(db.Authors.sort).limit(config.config_books_per_page)\
-        .offset(off)
+        .order_by(db.Authors.sort)
    pagination = Pagination((int(off) / (int(config.config_books_per_page)) + 1), config.config_books_per_page,
-                            len(calibre_db.session.query(db.Authors).all()))
-    return render_xml_template('feed.xml', listelements=entries, folder='opds.feed_author', pagination=pagination)
+                            entries.count())
+    entries = entries.limit(config.config_books_per_page).offset(off).all()
+    cc = calibre_db.get_cc_columns(config, filter_config_custom_read=True)
+    return render_xml_template('feed.xml', listelements=entries, folder='opds.feed_author', pagination=pagination, cc=cc)


@opds.route("/opds/author/<int:book_id>")
@requires_basic_auth_if_no_ano
 def feed_author(book_id):
-    off = request.args.get("offset") or 0
-    entries, __, pagination = calibre_db.fill_indexpage((int(off) / (int(config.config_books_per_page)) + 1), 0,
-                                                        db.Books,
-                                                        db.Books.authors.any(db.Authors.id == book_id),
-                                                        [db.Books.timestamp.desc()])
-    return render_xml_template('feed.xml', entries=entries, pagination=pagination)
+    return render_xml_dataset(db.Authors, book_id)


@opds.route("/opds/publisher")
@requires_basic_auth_if_no_ano
 def feed_publisherindex():
+    if not auth.current_user().check_visibility(constants.SIDEBAR_PUBLISHER):
+        abort(404)
    off = request.args.get("offset") or 0
    entries = calibre_db.session.query(db.Publishers)\
        .join(db.books_publishers_link)\
@@ -184,62 +201,76 @@ def feed_publisherindex():
        .limit(config.config_books_per_page).offset(off)
    pagination = Pagination((int(off) / (int(config.config_books_per_page)) + 1), config.config_books_per_page,
                            len(calibre_db.session.query(db.Publishers).all()))
-    return render_xml_template('feed.xml', listelements=entries, folder='opds.feed_publisher', pagination=pagination)
+    cc = calibre_db.get_cc_columns(config, filter_config_custom_read=True)
+    return render_xml_template('feed.xml', listelements=entries, folder='opds.feed_publisher', pagination=pagination, cc=cc)


@opds.route("/opds/publisher/<int:book_id>")
@requires_basic_auth_if_no_ano
 def feed_publisher(book_id):
-    off = request.args.get("offset") or 0
-    entries, __, pagination = calibre_db.fill_indexpage((int(off) / (int(config.config_books_per_page)) + 1), 0,
-                                                        db.Books,
-                                                        db.Books.publishers.any(db.Publishers.id == book_id),
-                                                        [db.Books.timestamp.desc()])
-    return render_xml_template('feed.xml', entries=entries, pagination=pagination)
+    return render_xml_dataset(db.Publishers, book_id)


@opds.route("/opds/category")
@requires_basic_auth_if_no_ano
 def feed_categoryindex():
+    if not auth.current_user().check_visibility(constants.SIDEBAR_CATEGORY):
+        abort(404)
+    return render_element_index(db.Tags.name, db.books_tags_link, 'opds.feed_letter_category')
+
+
+@opds.route("/opds/category/letter/<book_id>")
+@requires_basic_auth_if_no_ano
+def feed_letter_category(book_id):
+    if not auth.current_user().check_visibility(constants.SIDEBAR_CATEGORY):
+        abort(404)
    off = request.args.get("offset") or 0
+    letter = true() if book_id == "00" else func.upper(db.Tags.name).startswith(book_id)
    entries = calibre_db.session.query(db.Tags)\
        .join(db.books_tags_link)\
        .join(db.Books)\
-        .filter(calibre_db.common_filters())\
+        .filter(calibre_db.common_filters()).filter(letter)\
        .group_by(text('books_tags_link.tag'))\
-        .order_by(db.Tags.name)\
-        .offset(off)\
-        .limit(config.config_books_per_page)
+        .order_by(db.Tags.name)
    pagination = Pagination((int(off) / (int(config.config_books_per_page)) + 1), config.config_books_per_page,
-                            len(calibre_db.session.query(db.Tags).all()))
-    return render_xml_template('feed.xml', listelements=entries, folder='opds.feed_category', pagination=pagination)
+                            entries.count())
+    entries = entries.offset(off).limit(config.config_books_per_page).all()
+    cc = calibre_db.get_cc_columns(config, filter_config_custom_read=True)
+    return render_xml_template('feed.xml', listelements=entries, folder='opds.feed_category', pagination=pagination, cc=cc)


@opds.route("/opds/category/<int:book_id>")
@requires_basic_auth_if_no_ano
 def feed_category(book_id):
-    off = request.args.get("offset") or 0
-    entries, __, pagination = calibre_db.fill_indexpage((int(off) / (int(config.config_books_per_page)) + 1), 0,
-                                                        db.Books,
-                                                        db.Books.tags.any(db.Tags.id == book_id),
-                                                        [db.Books.timestamp.desc()])
-    return render_xml_template('feed.xml', entries=entries, pagination=pagination)
+    return render_xml_dataset(db.Tags, book_id)


@opds.route("/opds/series")
@requires_basic_auth_if_no_ano
 def feed_seriesindex():
+    if not auth.current_user().check_visibility(constants.SIDEBAR_SERIES):
+        abort(404)
+    return render_element_index(db.Series.sort, db.books_series_link, 'opds.feed_letter_series')
+
+
+@opds.route("/opds/series/letter/<book_id>")
+@requires_basic_auth_if_no_ano
+def feed_letter_series(book_id):
+    if not auth.current_user().check_visibility(constants.SIDEBAR_SERIES):
+        abort(404)
    off = request.args.get("offset") or 0
+    letter = true() if book_id == "00" else func.upper(db.Series.sort).startswith(book_id)
    entries = calibre_db.session.query(db.Series)\
        .join(db.books_series_link)\
        .join(db.Books)\
-        .filter(calibre_db.common_filters())\
+        .filter(calibre_db.common_filters()).filter(letter)\
        .group_by(text('books_series_link.series'))\
-        .order_by(db.Series.sort)\
-        .offset(off).all()
+        .order_by(db.Series.sort)
    pagination = Pagination((int(off) / (int(config.config_books_per_page)) + 1), config.config_books_per_page,
-                            len(calibre_db.session.query(db.Series).all()))
-    return render_xml_template('feed.xml', listelements=entries, folder='opds.feed_series', pagination=pagination)
+                            entries.count())
+    entries = entries.offset(off).limit(config.config_books_per_page).all()
+    cc = calibre_db.get_cc_columns(config, filter_config_custom_read=True)
+    return render_xml_template('feed.xml', listelements=entries, folder='opds.feed_series', pagination=pagination, cc=cc)


@opds.route("/opds/series/<int:book_id>")
@@ -249,16 +280,20 @@ def feed_series(book_id):
    entries, __, pagination = calibre_db.fill_indexpage((int(off) / (int(config.config_books_per_page)) + 1), 0,
                                                        db.Books,
                                                        db.Books.series.any(db.Series.id == book_id),
-                                                        [db.Books.series_index])
-    return render_xml_template('feed.xml', entries=entries, pagination=pagination)
+                                                        [db.Books.series_index],
+                                                        True, config.config_read_column)
+    cc = calibre_db.get_cc_columns(config, filter_config_custom_read=True)
+    return render_xml_template('feed.xml', entries=entries, pagination=pagination, cc=cc)


@opds.route("/opds/ratings")
@requires_basic_auth_if_no_ano
 def feed_ratingindex():
+    if not auth.current_user().check_visibility(constants.SIDEBAR_RATING):
+        abort(404)
    off = request.args.get("offset") or 0
    entries = calibre_db.session.query(db.Ratings, func.count('books_ratings_link.book').label('count'),
-                               (db.Ratings.rating / 2).label('name')) \
+                                       (db.Ratings.rating / 2).label('name')) \
        .join(db.books_ratings_link)\
        .join(db.Books)\
        .filter(calibre_db.common_filters()) \
@@ -269,24 +304,22 @@ def feed_ratingindex():
                            len(entries))
    element = list()
    for entry in entries:
-        element.append(FeedObject(entry[0].id, "{} Stars".format(entry.name)))
-    return render_xml_template('feed.xml', listelements=element, folder='opds.feed_ratings', pagination=pagination)
+        element.append(FeedObject(entry[0].id, _("{} Stars").format(entry.name)))
+    cc = calibre_db.get_cc_columns(config, filter_config_custom_read=True)
+    return render_xml_template('feed.xml', listelements=element, folder='opds.feed_ratings', pagination=pagination, cc=cc)


@opds.route("/opds/ratings/<book_id>")
@requires_basic_auth_if_no_ano
 def feed_ratings(book_id):
-    off = request.args.get("offset") or 0
-    entries, __, pagination = calibre_db.fill_indexpage((int(off) / (int(config.config_books_per_page)) + 1), 0,
-                                                        db.Books,
-                                                        db.Books.ratings.any(db.Ratings.id == book_id),
-                                                        [db.Books.timestamp.desc()])
-    return render_xml_template('feed.xml', entries=entries, pagination=pagination)
+    return render_xml_dataset(db.Ratings, book_id)


@opds.route("/opds/formats")
@requires_basic_auth_if_no_ano
 def feed_formatindex():
+    if not auth.current_user().check_visibility(constants.SIDEBAR_FORMAT):
+        abort(404)
    off = request.args.get("offset") or 0
    entries = calibre_db.session.query(db.Data).join(db.Books)\
        .filter(calibre_db.common_filters()) \
@@ -294,11 +327,11 @@ def feed_formatindex():
        .order_by(db.Data.format).all()
    pagination = Pagination((int(off) / (int(config.config_books_per_page)) + 1), config.config_books_per_page,
                            len(entries))
-
    element = list()
    for entry in entries:
        element.append(FeedObject(entry.format, entry.format))
-    return render_xml_template('feed.xml', listelements=element, folder='opds.feed_format', pagination=pagination)
+    cc = calibre_db.get_cc_columns(config, filter_config_custom_read=True)
+    return render_xml_template('feed.xml', listelements=element, folder='opds.feed_format', pagination=pagination, cc=cc)


@opds.route("/opds/formats/<book_id>")
@@ -308,31 +341,29 @@ def feed_format(book_id):
    entries, __, pagination = calibre_db.fill_indexpage((int(off) / (int(config.config_books_per_page)) + 1), 0,
                                                        db.Books,
                                                        db.Books.data.any(db.Data.format == book_id.upper()),
-                                                        [db.Books.timestamp.desc()])
-    return render_xml_template('feed.xml', entries=entries, pagination=pagination)
+                                                        [db.Books.timestamp.desc()],
+                                                        True, config.config_read_column)
+    cc = calibre_db.get_cc_columns(config, filter_config_custom_read=True)
+    return render_xml_template('feed.xml', entries=entries, pagination=pagination, cc=cc)


@opds.route("/opds/language")
@opds.route("/opds/language/")
@requires_basic_auth_if_no_ano
 def feed_languagesindex():
+    if not auth.current_user().check_visibility(constants.SIDEBAR_LANGUAGE):
+        abort(404)
    off = request.args.get("offset") or 0
-    if current_user.filter_language() == u"all":
+    if auth.current_user().filter_language() == "all":
        languages = calibre_db.speaking_language()
    else:
-        try:
-            cur_l = LC.parse(current_user.filter_language())
-        except UnknownLocaleError:
-            cur_l = None
        languages = calibre_db.session.query(db.Languages).filter(
-            db.Languages.lang_code == current_user.filter_language()).all()
-        if cur_l:
-            languages[0].name = cur_l.get_language_name(get_locale())
-        else:
-            languages[0].name = _(isoLanguages.get(part3=languages[0].lang_code).name)
+            db.Languages.lang_code == auth.current_user().filter_language()).all()
+        languages[0].name = isoLanguages.get_language_name(get_locale(), languages[0].lang_code)
    pagination = Pagination((int(off) / (int(config.config_books_per_page)) + 1), config.config_books_per_page,
                            len(languages))
-    return render_xml_template('feed.xml', listelements=languages, folder='opds.feed_languages', pagination=pagination)
+    cc = calibre_db.get_cc_columns(config, filter_config_custom_read=True)
+    return render_xml_template('feed.xml', listelements=languages, folder='opds.feed_languages', pagination=pagination, cc=cc)


@opds.route("/opds/language/<int:book_id>")
@@ -342,59 +373,74 @@ def feed_languages(book_id):
    entries, __, pagination = calibre_db.fill_indexpage((int(off) / (int(config.config_books_per_page)) + 1), 0,
                                                        db.Books,
                                                        db.Books.languages.any(db.Languages.id == book_id),
-                                                        [db.Books.timestamp.desc()])
-    return render_xml_template('feed.xml', entries=entries, pagination=pagination)
+                                                        [db.Books.timestamp.desc()],
+                                                        True, config.config_read_column)
+    cc = calibre_db.get_cc_columns(config, filter_config_custom_read=True)
+    return render_xml_template('feed.xml', entries=entries, pagination=pagination, cc=cc)


@opds.route("/opds/shelfindex")
@requires_basic_auth_if_no_ano
 def feed_shelfindex():
+    if not (auth.current_user().is_authenticated or g.allow_anonymous):
+        abort(404)
    off = request.args.get("offset") or 0
-    shelf = g.shelves_access
+    shelf = ub.session.query(ub.Shelf).filter(
+        or_(ub.Shelf.is_public == 1, ub.Shelf.user_id == auth.current_user().id)).order_by(ub.Shelf.name).all()
    number = len(shelf)
    pagination = Pagination((int(off) / (int(config.config_books_per_page)) + 1), config.config_books_per_page,
                            number)
-    return render_xml_template('feed.xml', listelements=shelf, folder='opds.feed_shelf', pagination=pagination)
+    cc = calibre_db.get_cc_columns(config, filter_config_custom_read=True)
+    return render_xml_template('feed.xml', listelements=shelf, folder='opds.feed_shelf', pagination=pagination, cc=cc)


@opds.route("/opds/shelf/<int:book_id>")
@requires_basic_auth_if_no_ano
 def feed_shelf(book_id):
+    if not (auth.current_user().is_authenticated or g.allow_anonymous):
+        abort(404)
    off = request.args.get("offset") or 0
-    if current_user.is_anonymous:
+    if auth.current_user().is_anonymous:
        shelf = ub.session.query(ub.Shelf).filter(ub.Shelf.is_public == 1,
                                                  ub.Shelf.id == book_id).first()
    else:
-        shelf = ub.session.query(ub.Shelf).filter(or_(and_(ub.Shelf.user_id == int(current_user.id),
+        shelf = ub.session.query(ub.Shelf).filter(or_(and_(ub.Shelf.user_id == int(auth.current_user().id),
                                                           ub.Shelf.id == book_id),
                                                      and_(ub.Shelf.is_public == 1,
                                                           ub.Shelf.id == book_id))).first()
    result = list()
+    pagination = list()
    # user is allowed to access shelf
    if shelf:
-        books_in_shelf = ub.session.query(ub.BookShelf).filter(ub.BookShelf.shelf == book_id).order_by(
-            ub.BookShelf.order.asc()).all()
-        for book in books_in_shelf:
-            cur_book = calibre_db.get_book(book.book_id)
-            result.append(cur_book)
-    pagination = Pagination((int(off) / (int(config.config_books_per_page)) + 1), config.config_books_per_page,
-                            len(result))
-    return render_xml_template('feed.xml', entries=result, pagination=pagination)
+        result, __, pagination = calibre_db.fill_indexpage((int(off) / (int(config.config_books_per_page)) + 1),
+                                                           config.config_books_per_page,
+                                                           db.Books,
+                                                           ub.BookShelf.shelf == shelf.id,
+                                                           [ub.BookShelf.order.asc()],
+                                                           True, config.config_read_column,
+                                                           ub.BookShelf, ub.BookShelf.book_id == db.Books.id)
+        # delete shelf entries where book is not existent anymore, can happen if book is deleted outside calibre-web
+        wrong_entries = calibre_db.session.query(ub.BookShelf) \
+            .join(db.Books, ub.BookShelf.book_id == db.Books.id, isouter=True) \
+            .filter(db.Books.id == None).all()
+        for entry in wrong_entries:
+            log.info('Not existing book {} in {} deleted'.format(entry.book_id, shelf))
+            try:
+                ub.session.query(ub.BookShelf).filter(ub.BookShelf.book_id == entry.book_id).delete()
+                ub.session.commit()
+            except (OperationalError, InvalidRequestError) as e:
+                ub.session.rollback()
+                log.error_or_exception("Settings Database error: {}".format(e))
+    cc = calibre_db.get_cc_columns(config, filter_config_custom_read=True)
+    return render_xml_template('feed.xml', entries=result, pagination=pagination, cc=cc)


@opds.route("/opds/download/<book_id>/<book_format>/")
@requires_basic_auth_if_no_ano
 def opds_download_link(book_id, book_format):
-    # I gave up with this: With enabled ldap login, the user doesn't get logged in, therefore it's always guest
-    # workaround, loading the user from the request and checking it's download rights here
-    # in case of anonymous browsing user is None
-    user = load_user_from_request(request) or current_user
-    if not user.role_download():
-        return abort(403)
-    if "Kobo" in request.headers.get('User-Agent'):
-        client = "kobo"
-    else:
-        client = ""
+    if not auth.current_user().role_download():
+        return abort(401)
+    client = "kobo" if "Kobo" in request.headers.get('User-Agent') else ""
    return get_download_link(book_id, book_format.lower(), client)


@@ -412,41 +458,15 @@ def get_metadata_calibre_companion(uuid, library):
        return ""


-def feed_search(term):
-    if term:
-        entries, __, ___ = calibre_db.get_search_results(term)
-        entriescount = len(entries) if len(entries) > 0 else 1
-        pagination = Pagination(1, entriescount, entriescount)
-        return render_xml_template('feed.xml', searchterm=term, entries=entries, pagination=pagination)
-    else:
-        return render_xml_template('feed.xml', searchterm="")
-
-
-def check_auth(username, password):
-    if sys.version_info.major == 3:
-        try:
-            username = username.encode('windows-1252')
-        except UnicodeEncodeError:
-            username = username.encode('utf-8')
-    user = ub.session.query(ub.User).filter(func.lower(ub.User.nickname) ==
-                                            username.decode('utf-8').lower()).first()
-    return bool(user and check_password_hash(str(user.password), password))
-
-
-def authenticate():
-    return Response(
-        'Could not verify your access level for that URL.\n'
-        'You have to login with proper credentials', 401,
-        {'WWW-Authenticate': 'Basic realm="Login Required"'})
-
-
-def render_xml_template(*args, **kwargs):
-    # ToDo: return time in current timezone similar to %z
-    currtime = datetime.datetime.now().strftime("%Y-%m-%dT%H:%M:%S+00:00")
-    xml = render_template(current_time=currtime, instance=config.config_calibre_web_title, *args, **kwargs)
-    response = make_response(xml)
-    response.headers["Content-Type"] = "application/atom+xml; charset=utf-8"
-    return response
+@opds.route("/opds/stats")
+@requires_basic_auth_if_no_ano
+def get_database_stats():
+    stat = dict()
+    stat['books'] = calibre_db.session.query(db.Books).count()
+    stat['authors'] = calibre_db.session.query(db.Authors).count()
+    stat['categories'] = calibre_db.session.query(db.Tags).count()
+    stat['series'] = calibre_db.session.query(db.Series).count()
+    return make_response(jsonify(stat))


@opds.route("/opds/thumb_240_240/<book_id>")
@@ -461,14 +481,92 @@ def feed_get_cover(book_id):
@opds.route("/opds/readbooks")
@requires_basic_auth_if_no_ano
 def feed_read_books():
+    if not (auth.current_user().check_visibility(constants.SIDEBAR_READ_AND_UNREAD) and not auth.current_user().is_anonymous):
+        return abort(403)
    off = request.args.get("offset") or 0
    result, pagination = render_read_books(int(off) / (int(config.config_books_per_page)) + 1, True, True)
-    return render_xml_template('feed.xml', entries=result, pagination=pagination)
+    cc = calibre_db.get_cc_columns(config, filter_config_custom_read=True)
+    return render_xml_template('feed.xml', entries=result, pagination=pagination, cc=cc)


@opds.route("/opds/unreadbooks")
@requires_basic_auth_if_no_ano
 def feed_unread_books():
+    if not (auth.current_user().check_visibility(constants.SIDEBAR_READ_AND_UNREAD) and not auth.current_user().is_anonymous):
+        return abort(403)
    off = request.args.get("offset") or 0
    result, pagination = render_read_books(int(off) / (int(config.config_books_per_page)) + 1, False, True)
-    return render_xml_template('feed.xml', entries=result, pagination=pagination)
+    cc = calibre_db.get_cc_columns(config, filter_config_custom_read=True)
+    return render_xml_template('feed.xml', entries=result, pagination=pagination, cc=cc)
+
+
+class FeedObject:
+    def __init__(self, rating_id, rating_name):
+        self.rating_id = rating_id
+        self.rating_name = rating_name
+
+    @property
+    def id(self):
+        return self.rating_id
+
+    @property
+    def name(self):
+        return self.rating_name
+
+
+def feed_search(term):
+    if term:
+        entries, __, ___ = calibre_db.get_search_results(term, config=config)
+        entries_count = len(entries) if len(entries) > 0 else 1
+        pagination = Pagination(1, entries_count, entries_count)
+        cc = calibre_db.get_cc_columns(config, filter_config_custom_read=True)
+        return render_xml_template('feed.xml', searchterm=term, entries=entries, pagination=pagination, cc=cc)
+    else:
+        return render_xml_template('feed.xml', searchterm="")
+
+
+
+def render_xml_template(*args, **kwargs):
+    # ToDo: return time in current timezone similar to %z
+    currtime = datetime.datetime.now().strftime("%Y-%m-%dT%H:%M:%S+00:00")
+    xml = render_template(current_time=currtime, instance=config.config_calibre_web_title, constants=constants.sidebar_settings, *args, **kwargs)
+    response = make_response(xml)
+    response.headers["Content-Type"] = "application/atom+xml; charset=utf-8"
+    return response
+
+
+def render_xml_dataset(data_table, book_id):
+    off = request.args.get("offset") or 0
+    entries, __, pagination = calibre_db.fill_indexpage((int(off) / (int(config.config_books_per_page)) + 1), 0,
+                                                        db.Books,
+                                                        getattr(db.Books, data_table.__tablename__).any(data_table.id == book_id),
+                                                        [db.Books.timestamp.desc()],
+                                                        True, config.config_read_column)
+    cc = calibre_db.get_cc_columns(config, filter_config_custom_read=True)
+    return render_xml_template('feed.xml', entries=entries, pagination=pagination, cc=cc)
+
+
+def render_element_index(database_column, linked_table, folder):
+    shift = 0
+    off = int(request.args.get("offset") or 0)
+    entries = calibre_db.session.query(func.upper(func.substr(database_column, 1, 1)).label('id'), None, None)
+    # query = calibre_db.generate_linked_query(config.config_read_column, db.Books)
+    if linked_table is not None:
+        entries = entries.join(linked_table).join(db.Books)
+    entries = entries.filter(calibre_db.common_filters()).group_by(func.upper(func.substr(database_column, 1, 1))).all()
+    elements = []
+    if off == 0 and entries:
+        elements.append({'id': "00", 'name': _("All")})
+        shift = 1
+    for entry in entries[
+                 off + shift - 1:
+                 int(off + int(config.config_books_per_page) - shift)]:
+        elements.append({'id': entry.id, 'name': entry.id})
+    pagination = Pagination((int(off) / (int(config.config_books_per_page)) + 1), config.config_books_per_page,
+                            len(entries) + 1)
+    cc = calibre_db.get_cc_columns(config, filter_config_custom_read=True)
+    return render_xml_template('feed.xml',
+                               letterelements=elements,
+                               folder=folder,
+                               pagination=pagination,
+                               cc=cc)
@@ -20,7 +20,6 @@
 #  You should have received a copy of the GNU General Public License
 #  along with this program. If not, see <http://www.gnu.org/licenses/>.

-from __future__ import division, print_function, unicode_literals
 from math import ceil


@@ -58,10 +57,10 @@ class Pagination(object):
    def has_next(self):
        return self.page < self.pages

-    # right_edge: last right_edges count of all pages are shown as number, means, if 10 pages are paginated -> 9,10 shwn
-    # left_edge: first left_edges count of all pages are shown as number                                    -> 1,2 shwn
-    # left_current: left_current count below current page are shown as number, means if current page 5      -> 3,4 shwn
-    # left_current: right_current count above current page are shown as number, means if current page 5     -> 6,7 shwn
+    # right_edge: last right_edges count of all pages are shown as number, means, if 10 pages are paginated -> 9,10 shown
+    # left_edge: first left_edges count of all pages are shown as number                                    -> 1,2 shown
+    # left_current: left_current count below current page are shown as number, means if current page 5      -> 3,4 shown
+    # left_current: right_current count above current page are shown as number, means if current page 5     -> 6,7 shown
    def iter_pages(self, left_edge=2, left_current=2,
                   right_current=4, right_edge=2):
        last = 0
@@ -25,15 +25,11 @@
 # THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
 # IN ANY WAY OUT OF THE USE OF THIS SOFTWARE AND DOCUMENTATION, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

-# http://flask.pocoo.org/snippets/62/
+# https://web.archive.org/web/20120517003641/http://flask.pocoo.org/snippets/62/

-from __future__ import division, print_function, unicode_literals
-try:
-    from urllib.parse import urlparse, urljoin
-except ImportError:
-    from urlparse import urlparse, urljoin
+from urllib.parse import urlparse, urljoin

-from flask import request, url_for, redirect
+from flask import request, url_for, current_app


 def is_safe_url(target):
@@ -42,16 +38,15 @@ def is_safe_url(target):
    return test_url.scheme in ('http', 'https') and ref_url.netloc == test_url.netloc


-def get_redirect_target():
-    for target in request.values.get('next'), request.referrer:
-        if not target:
-            continue
-        if is_safe_url(target):
-            return target
+def remove_prefix(text, prefix):
+    if text.startswith(prefix):
+        return text[len(prefix):]
+    return ""


-def redirect_back(endpoint, **values):
-    target = request.form['next']
-    if not target or not is_safe_url(target):
+def get_redirect_location(next, endpoint, **values):
+    target = next or url_for(endpoint, **values)
+    adapter = current_app.url_map.bind(urlparse(request.host_url).netloc)
+    if not len(adapter.allowed_methods(remove_prefix(target, request.environ.get('HTTP_X_SCRIPT_NAME',"")))):
        target = url_for(endpoint, **values)
-    return redirect(target)
+    return target
@@ -22,19 +22,17 @@

 import json
 from datetime import datetime
+from functools import wraps

 from flask import Blueprint, request, make_response, abort, url_for, flash, redirect
-from flask_login import login_required, current_user, login_user
+from .cw_login import login_user, current_user
 from flask_babel import gettext as _
 from sqlalchemy.sql.expression import true

 from . import config, logger, ub
 from .render_template import render_title_template
+from .usermanagement import user_login_required

-try:
-    from functools import wraps
-except ImportError:
-    pass  # We're not using Python 3

 remotelogin = Blueprint('remotelogin', __name__)
 log = logger.create()
@@ -61,21 +59,21 @@ def remote_login():
    ub.session.add(auth_token)
    ub.session_commit()
    verify_url = url_for('remotelogin.verify_token', token=auth_token.auth_token, _external=true)
-    log.debug(u"Remot Login request with token: %s", auth_token.auth_token)
-    return render_title_template('remote_login.html', title=_(u"login"), token=auth_token.auth_token,
+    log.debug("Remot Login request with token: %s", auth_token.auth_token)
+    return render_title_template('remote_login.html', title=_("Login"), token=auth_token.auth_token,
                                 verify_url=verify_url, page="remotelogin")


@remotelogin.route('/verify/<token>')
@remote_login_required
-@login_required
+@user_login_required
 def verify_token(token):
    auth_token = ub.session.query(ub.RemoteAuthToken).filter(ub.RemoteAuthToken.auth_token == token).first()

    # Token not found
    if auth_token is None:
-        flash(_(u"Token not found"), category="error")
-        log.error(u"Remote Login token not found")
+        flash(_("Token not found"), category="error")
+        log.error("Remote Login token not found")
        return redirect(url_for('web.index'))

    # Token expired
@@ -83,8 +81,8 @@ def verify_token(token):
        ub.session.delete(auth_token)
        ub.session_commit()

-        flash(_(u"Token has expired"), category="error")
-        log.error(u"Remote Login token expired")
+        flash(_("Token has expired"), category="error")
+        log.error("Remote Login token expired")
        return redirect(url_for('web.index'))

    # Update token with user information
@@ -92,8 +90,8 @@ def verify_token(token):
    auth_token.verified = True
    ub.session_commit()

-    flash(_(u"Success! Please return to your device"), category="success")
-    log.debug(u"Remote Login token for userid %s verified", auth_token.user_id)
+    flash(_("Success! Please return to your device"), category="success")
+    log.debug("Remote Login token for userid %s verified", auth_token.user_id)
    return redirect(url_for('web.index'))


@@ -108,7 +106,7 @@ def token_verified():
    # Token not found
    if auth_token is None:
        data['status'] = 'error'
-        data['message'] = _(u"Token not found")
+        data['message'] = _("Token not found")

    # Token expired
    elif datetime.now() > auth_token.expiration:
@@ -116,7 +114,7 @@ def token_verified():
        ub.session_commit()

        data['status'] = 'error'
-        data['message'] = _(u"Token has expired")
+        data['message'] = _("Token has expired")

    elif not auth_token.verified:
        data['status'] = 'not_verified'
@@ -126,11 +124,11 @@ def token_verified():
        login_user(user)

        ub.session.delete(auth_token)
-        ub.session_commit("User {} logged in via remotelogin, token deleted".format(user.nickname))
+        ub.session_commit("User {} logged in via remotelogin, token deleted".format(user.name))

        data['status'] = 'success'
-        log.debug(u"Remote Login for userid %s succeded", user.id)
-        flash(_(u"you are now logged in as: '%(nickname)s'", nickname=user.nickname), category="success")
+        log.debug("Remote Login for userid %s succeeded", user.id)
+        flash(_("Success! You are now logged in as: %(nickname)s", nickname=user.name), category="success")

    response = make_response(json.dumps(data, ensure_ascii=False))
    response.headers["Content-Type"] = "application/json; charset=utf-8"
@@ -16,13 +16,13 @@
 #  You should have received a copy of the GNU General Public License
 #  along with this program. If not, see <http://www.gnu.org/licenses/>.

-from flask import render_template
+from flask import render_template, g, abort, request
 from flask_babel import gettext as _
-from flask import g
 from werkzeug.local import LocalProxy
-from flask_login import current_user
+from .cw_login import current_user
+from sqlalchemy.sql.expression import or_

-from . import config, constants, ub, logger, db, calibre_db
+from . import config, constants, logger, ub
 from .ub import User


@@ -30,87 +30,89 @@ log = logger.create()

 def get_sidebar_config(kwargs=None):
    kwargs = kwargs or []
+    simple = bool([e for e in ['kindle', 'tolino', "kobo", "bookeen"]
+                   if (e in request.headers.get('User-Agent', "").lower())])
    if 'content' in kwargs:
        content = kwargs['content']
        content = isinstance(content, (User, LocalProxy)) and not content.role_anonymous()
    else:
        content = 'conf' in kwargs
    sidebar = list()
-    sidebar.append({"glyph": "glyphicon-book", "text": _('Recently Added'), "link": 'web.index', "id": "new",
+    sidebar.append({"glyph": "glyphicon-book", "text": _('Books'), "link": 'web.index', "id": "new",
                    "visibility": constants.SIDEBAR_RECENT, 'public': True, "page": "root",
                    "show_text": _('Show recent books'), "config_show":False})
    sidebar.append({"glyph": "glyphicon-fire", "text": _('Hot Books'), "link": 'web.books_list', "id": "hot",
                    "visibility": constants.SIDEBAR_HOT, 'public': True, "page": "hot",
                    "show_text": _('Show Hot Books'), "config_show": True})
-    sidebar.append({"glyph": "glyphicon-download", "text": _('Downloaded Books'), "link": 'web.books_list',
-                    "id": "download", "visibility": constants.SIDEBAR_DOWNLOAD, 'public': (not g.user.is_anonymous),
-                    "page": "download", "show_text": _('Show Downloaded Books'),
-                    "config_show": content})
+    if current_user.role_admin():
+        sidebar.append({"glyph": "glyphicon-download", "text": _('Downloaded Books'), "link": 'web.download_list',
+                        "id": "download", "visibility": constants.SIDEBAR_DOWNLOAD, 'public': (not current_user.is_anonymous),
+                        "page": "download", "show_text": _('Show Downloaded Books'), "no_param":True,
+                        "config_show": content})
+    else:
+        sidebar.append({"glyph": "glyphicon-download", "text": _('Downloaded Books'), "link": 'web.books_list',
+                        "id": "download", "visibility": constants.SIDEBAR_DOWNLOAD, 'public': (not current_user.is_anonymous),
+                        "page": "download", "show_text": _('Show Downloaded Books'),
+                        "config_show": content})
    sidebar.append(
        {"glyph": "glyphicon-star", "text": _('Top Rated Books'), "link": 'web.books_list', "id": "rated",
         "visibility": constants.SIDEBAR_BEST_RATED, 'public': True, "page": "rated",
         "show_text": _('Show Top Rated Books'), "config_show": True})
    sidebar.append({"glyph": "glyphicon-eye-open", "text": _('Read Books'), "link": 'web.books_list', "id": "read",
-                    "visibility": constants.SIDEBAR_READ_AND_UNREAD, 'public': (not g.user.is_anonymous),
-                    "page": "read", "show_text": _('Show read and unread'), "config_show": content})
+                    "visibility": constants.SIDEBAR_READ_AND_UNREAD, 'public': (not current_user.is_anonymous),
+                    "page": "read", "show_text": _('Show Read and Unread'), "config_show": content})
    sidebar.append(
        {"glyph": "glyphicon-eye-close", "text": _('Unread Books'), "link": 'web.books_list', "id": "unread",
-         "visibility": constants.SIDEBAR_READ_AND_UNREAD, 'public': (not g.user.is_anonymous), "page": "unread",
+         "visibility": constants.SIDEBAR_READ_AND_UNREAD, 'public': (not current_user.is_anonymous), "page": "unread",
         "show_text": _('Show unread'), "config_show": False})
    sidebar.append({"glyph": "glyphicon-random", "text": _('Discover'), "link": 'web.books_list', "id": "rand",
                    "visibility": constants.SIDEBAR_RANDOM, 'public': True, "page": "discover",
-                    "show_text": _('Show random books'), "config_show": True})
+                    "show_text": _('Show Random Books'), "config_show": True})
    sidebar.append({"glyph": "glyphicon-inbox", "text": _('Categories'), "link": 'web.category_list', "id": "cat",
-                    "visibility": constants.SIDEBAR_CATEGORY, 'public': True, "page": "category",
-                    "show_text": _('Show category selection'), "config_show": True})
+                    "visibility": constants.SIDEBAR_CATEGORY, 'public': True, "page": "category", "no_param":True,
+                    "show_text": _('Show Category Section'), "config_show": True})
    sidebar.append({"glyph": "glyphicon-bookmark", "text": _('Series'), "link": 'web.series_list', "id": "serie",
-                    "visibility": constants.SIDEBAR_SERIES, 'public': True, "page": "series",
-                    "show_text": _('Show series selection'), "config_show": True})
+                    "visibility": constants.SIDEBAR_SERIES, 'public': True, "page": "series", "no_param":True,
+                    "show_text": _('Show Series Section'), "config_show": True})
    sidebar.append({"glyph": "glyphicon-user", "text": _('Authors'), "link": 'web.author_list', "id": "author",
-                    "visibility": constants.SIDEBAR_AUTHOR, 'public': True, "page": "author",
-                    "show_text": _('Show author selection'), "config_show": True})
+                    "visibility": constants.SIDEBAR_AUTHOR, 'public': True, "page": "author", "no_param":True,
+                    "show_text": _('Show Author Section'), "config_show": True})
    sidebar.append(
        {"glyph": "glyphicon-text-size", "text": _('Publishers'), "link": 'web.publisher_list', "id": "publisher",
-         "visibility": constants.SIDEBAR_PUBLISHER, 'public': True, "page": "publisher",
-         "show_text": _('Show publisher selection'), "config_show":True})
+         "visibility": constants.SIDEBAR_PUBLISHER, 'public': True, "page": "publisher", "no_param":True,
+         "show_text": _('Show Publisher Section'), "config_show":True})
    sidebar.append({"glyph": "glyphicon-flag", "text": _('Languages'), "link": 'web.language_overview', "id": "lang",
-                    "visibility": constants.SIDEBAR_LANGUAGE, 'public': (g.user.filter_language() == 'all'),
-                    "page": "language",
-                    "show_text": _('Show language selection'), "config_show": True})
+                    "visibility": constants.SIDEBAR_LANGUAGE, 'public': (current_user.filter_language() == 'all'),
+                    "page": "language", "no_param":True,
+                    "show_text": _('Show Language Section'), "config_show": True})
    sidebar.append({"glyph": "glyphicon-star-empty", "text": _('Ratings'), "link": 'web.ratings_list', "id": "rate",
-                    "visibility": constants.SIDEBAR_RATING, 'public': True,
-                    "page": "rating", "show_text": _('Show ratings selection'), "config_show": True})
+                    "visibility": constants.SIDEBAR_RATING, 'public': True, "no_param":True,
+                    "page": "rating", "show_text": _('Show Ratings Section'), "config_show": True})
    sidebar.append({"glyph": "glyphicon-file", "text": _('File formats'), "link": 'web.formats_list', "id": "format",
-                    "visibility": constants.SIDEBAR_FORMAT, 'public': True,
-                    "page": "format", "show_text": _('Show file formats selection'), "config_show": True})
+                    "visibility": constants.SIDEBAR_FORMAT, 'public': True, "no_param":True,
+                    "page": "format", "show_text": _('Show File Formats Section'), "config_show": True})
    sidebar.append(
-        {"glyph": "glyphicon-trash", "text": _('Archived Books'), "link": 'web.books_list', "id": "archived",
-         "visibility": constants.SIDEBAR_ARCHIVED, 'public': (not g.user.is_anonymous), "page": "archived",
-         "show_text": _('Show archived books'), "config_show": content})
-    sidebar.append(
-        {"glyph": "glyphicon-th-list", "text": _('Books List'), "link": 'web.books_table', "id": "list",
-         "visibility": constants.SIDEBAR_LIST, 'public': (not g.user.is_anonymous), "page": "list",
-         "show_text": _('Show Books List'), "config_show": content})
+        {"glyph": "glyphicon-folder-open", "text": _('Archived Books'), "link": 'web.books_list', "id": "archived",
+         "visibility": constants.SIDEBAR_ARCHIVED, 'public': (not current_user.is_anonymous), "page": "archived",
+         "show_text": _('Show Archived Books'), "config_show": content})
+    if not simple:
+        sidebar.append(
+            {"glyph": "glyphicon-th-list", "text": _('Books List'), "link": 'web.books_table', "id": "list",
+             "visibility": constants.SIDEBAR_LIST, 'public': (not current_user.is_anonymous),
+             "show_text": _('Show Books List'), "config_show": content, "no_param":True})
+    g.shelves_access = ub.session.query(ub.Shelf).filter(
+        or_(ub.Shelf.is_public == 1, ub.Shelf.user_id == current_user.id)).order_by(ub.Shelf.name).all()

-    return sidebar
+    return sidebar, simple

-def get_readbooks_ids():
-    if not config.config_read_column:
-        readBooks = ub.session.query(ub.ReadBook).filter(ub.ReadBook.user_id == int(current_user.id))\
-            .filter(ub.ReadBook.read_status == ub.ReadBook.STATUS_FINISHED).all()
-        return frozenset([x.book_id for x in readBooks])
-    else:
-        try:
-            readBooks = calibre_db.session.query(db.cc_classes[config.config_read_column])\
-                .filter(db.cc_classes[config.config_read_column].value == True).all()
-            return frozenset([x.book for x in readBooks])
-        except (KeyError, AttributeError):
-            log.error("Custom Column No.%d is not existing in calibre database", config.config_read_column)
-            return []

 # Returns the template for rendering and includes the instance name
 def render_title_template(*args, **kwargs):
-    sidebar = get_sidebar_config(kwargs)
-    return render_template(instance=config.config_calibre_web_title, sidebar=sidebar,
-                           accept=constants.EXTENSIONS_UPLOAD, read_book_ids=get_readbooks_ids(),
-                           *args, **kwargs)
+    sidebar, simple = get_sidebar_config(kwargs)
+    try:
+        return render_template(instance=config.config_calibre_web_title, sidebar=sidebar, simple=simple,
+                               accept=config.config_upload_formats.split(','),
+                               *args, **kwargs)
+    except PermissionError:
+        log.error("No permission to access {} file.".format(args[0]))
+        abort(403)
@@ -36,16 +36,14 @@
 #
 # Inspired by http://flask.pocoo.org/snippets/35/

-from __future__ import division, print_function, unicode_literals
-

 class ReverseProxied(object):
    """Wrap the application in this middleware and configure the
    front-end server to add these headers, to let you quietly bind
    this to a URL other than / and to an HTTP scheme that is
-    different than what is used locally.
+    different from what is used locally.

-    Code courtesy of: http://flask.pocoo.org/snippets/35/
+    Code courtesy of: https://flask.pocoo.org/snippets/35/

    In nginx:
    location /myprefix {
@@ -63,11 +61,13 @@ class ReverseProxied(object):

    def __call__(self, environ, start_response):
        self.proxied = False
+        self.script_name = "/"
        script_name = environ.get('HTTP_X_SCRIPT_NAME', '')
        if script_name:
            self.proxied = True
            environ['SCRIPT_NAME'] = script_name
            path_info = environ.get('PATH_INFO', '')
+            self.script_name = script_name
            if path_info and path_info.startswith(script_name):
                environ['PATH_INFO'] = path_info[len(script_name):]

@@ -0,0 +1,110 @@
+# -*- coding: utf-8 -*-
+
+#   This file is part of the Calibre-Web (https://github.com/janeczku/calibre-web)
+#     Copyright (C) 2020 mmonkey
+#
+#   This program is free software: you can redistribute it and/or modify
+#   it under the terms of the GNU General Public License as published by
+#   the Free Software Foundation, either version 3 of the License, or
+#   (at your option) any later version.
+#
+#   This program is distributed in the hope that it will be useful,
+#   but WITHOUT ANY WARRANTY; without even the implied warranty of
+#   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+#   GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public License
+#   along with this program. If not, see <http://www.gnu.org/licenses/>.
+
+import datetime
+
+from . import config, constants
+from .services.background_scheduler import BackgroundScheduler, CronTrigger, use_APScheduler
+from .tasks.database import TaskReconnectDatabase
+from .tasks.clean import TaskClean
+from .tasks.thumbnail import TaskGenerateCoverThumbnails, TaskGenerateSeriesThumbnails, TaskClearCoverThumbnailCache
+from .services.worker import WorkerThread
+from .tasks.metadata_backup import TaskBackupMetadata
+
+def get_scheduled_tasks(reconnect=True):
+    tasks = list()
+    # Reconnect Calibre database (metadata.db) based on config.schedule_reconnect
+    if reconnect:
+        tasks.append([lambda: TaskReconnectDatabase(), 'reconnect', False])
+
+    # Delete temp folder
+    tasks.append([lambda: TaskClean(), 'delete temp', True])
+
+    # Generate metadata.opf file for each changed book
+    if config.schedule_metadata_backup:
+        tasks.append([lambda: TaskBackupMetadata("en"), 'backup metadata', False])
+
+    # Generate all missing book cover thumbnails
+    if config.schedule_generate_book_covers:
+        tasks.append([lambda: TaskClearCoverThumbnailCache(0), 'delete superfluous book covers', True])
+        tasks.append([lambda: TaskGenerateCoverThumbnails(), 'generate book covers', False])
+
+    # Generate all missing series thumbnails
+    if config.schedule_generate_series_covers:
+        tasks.append([lambda: TaskGenerateSeriesThumbnails(), 'generate book covers', False])
+
+    return tasks
+
+
+def end_scheduled_tasks():
+    worker = WorkerThread.get_instance()
+    for __, __, __, task, __ in worker.tasks:
+        if task.scheduled and task.is_cancellable:
+            worker.end_task(task.id)
+
+
+def register_scheduled_tasks(reconnect=True):
+    scheduler = BackgroundScheduler()
+
+    if scheduler:
+        # Remove all existing jobs
+        scheduler.remove_all_jobs()
+
+        start = config.schedule_start_time
+        duration = config.schedule_duration
+
+        # Register scheduled tasks
+        timezone_info = datetime.datetime.now(datetime.timezone.utc).astimezone().tzinfo
+        scheduler.schedule_tasks(tasks=get_scheduled_tasks(reconnect), trigger=CronTrigger(hour=start,
+                                                                                           timezone=timezone_info))
+        end_time = calclulate_end_time(start, duration)
+        scheduler.schedule(func=end_scheduled_tasks, trigger=CronTrigger(hour=end_time.hour, minute=end_time.minute,
+                                                                         timezone=timezone_info),
+                           name="end scheduled task")
+
+        # Kick-off tasks, if they should currently be running
+        if should_task_be_running(start, duration):
+            scheduler.schedule_tasks_immediately(tasks=get_scheduled_tasks(reconnect))
+
+
+def register_startup_tasks():
+    scheduler = BackgroundScheduler()
+
+    if scheduler:
+        start = config.schedule_start_time
+        duration = config.schedule_duration
+
+        # Run scheduled tasks immediately for development and testing
+        # Ignore tasks that should currently be running, as these will be added when registering scheduled tasks
+        if constants.APP_MODE in ['development', 'test'] and not should_task_be_running(start, duration):
+            scheduler.schedule_tasks_immediately(tasks=get_scheduled_tasks(False))
+        else:
+            scheduler.schedule_tasks_immediately(tasks=[[lambda: TaskClean(), 'delete temp', True]])
+
+
+def should_task_be_running(start, duration):
+    now = datetime.datetime.now()
+    start_time = datetime.datetime.now().replace(hour=start, minute=0, second=0, microsecond=0)
+    end_time = start_time + datetime.timedelta(hours=duration // 60, minutes=duration % 60)
+    return start_time < now < end_time
+
+
+def calclulate_end_time(start, duration):
+    start_time = datetime.datetime.now().replace(hour=start, minute=0)
+    return start_time + datetime.timedelta(hours=duration // 60, minutes=duration % 60)
+
@@ -0,0 +1,444 @@
+#  This file is part of the Calibre-Web (https://github.com/janeczku/calibre-web)
+#    Copyright (C) 2022 OzzieIsaacs
+#
+#  This program is free software: you can redistribute it and/or modify
+#  it under the terms of the GNU General Public License as published by
+#  the Free Software Foundation, either version 3 of the License, or
+#  (at your option) any later version.
+#
+#  This program is distributed in the hope that it will be useful,
+#  but WITHOUT ANY WARRANTY; without even the implied warranty of
+#  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+#  GNU General Public License for more details.
+#
+#  You should have received a copy of the GNU General Public License
+#  along with this program. If not, see <http://www.gnu.org/licenses/>.
+
+import json
+from datetime import datetime
+
+from flask import Blueprint, request, redirect, url_for, flash
+from flask import session as flask_session
+from .cw_login import current_user
+from flask_babel import format_date
+from flask_babel import gettext as _
+from sqlalchemy.sql.expression import func, not_, and_, or_, text, true
+from sqlalchemy.sql.functions import coalesce
+
+from . import logger, db, calibre_db, config, ub
+from .string_helper import strip_whitespaces
+from .usermanagement import login_required_if_no_ano
+from .render_template import render_title_template
+from .pagination import Pagination
+
+
+search = Blueprint('search', __name__)
+
+log = logger.create()
+
+
+@search.route("/search", methods=["GET"])
+@login_required_if_no_ano
+def simple_search():
+    term = request.args.get("query")
+    if term:
+        return redirect(url_for('web.books_list', data="search", sort_param='stored', query=term.strip()))
+    else:
+        return render_title_template('search.html',
+                                     searchterm="",
+                                     result_count=0,
+                                     title=_("Search"),
+                                     page="search")
+
+
+@search.route("/advsearch", methods=['POST'])
+@login_required_if_no_ano
+def advanced_search():
+    values = dict(request.form)
+    params = ['include_tag', 'exclude_tag', 'include_serie', 'exclude_serie', 'include_shelf', 'exclude_shelf',
+              'include_language', 'exclude_language', 'include_extension', 'exclude_extension']
+    for param in params:
+        values[param] = list(request.form.getlist(param))
+    flask_session['query'] = json.dumps(values)
+    return redirect(url_for('web.books_list', data="advsearch", sort_param='stored', query=""))
+
+
+@search.route("/advsearch", methods=['GET'])
+@login_required_if_no_ano
+def advanced_search_form():
+    # Build custom columns names
+    cc = calibre_db.get_cc_columns(config, filter_config_custom_read=True)
+    return render_prepare_search_form(cc)
+
+
+def adv_search_custom_columns(cc, term, q):
+    for c in cc:
+        if c.datatype == "datetime":
+            custom_start = term.get('custom_column_' + str(c.id) + '_start')
+            custom_end = term.get('custom_column_' + str(c.id) + '_end')
+            if custom_start:
+                q = q.filter(getattr(db.Books, 'custom_column_' + str(c.id)).any(
+                    func.datetime(db.cc_classes[c.id].value) >= func.datetime(custom_start)))
+            if custom_end:
+                q = q.filter(getattr(db.Books, 'custom_column_' + str(c.id)).any(
+                    func.datetime(db.cc_classes[c.id].value) <= func.datetime(custom_end)))
+        elif c.datatype in ["int", "float"]:
+            custom_low = term.get('custom_column_' + str(c.id) + '_low')
+            custom_high = term.get('custom_column_' + str(c.id) + '_high')
+            if custom_low:
+                q = q.filter(getattr(db.Books, 'custom_column_' + str(c.id)).any(
+                    db.cc_classes[c.id].value >= custom_low))
+            if custom_high:
+                q = q.filter(getattr(db.Books, 'custom_column_' + str(c.id)).any(
+                    db.cc_classes[c.id].value <= custom_high))
+        else:
+            custom_query = term.get('custom_column_' + str(c.id))
+            if c.datatype == 'bool':
+                if custom_query != "Any":
+                    if custom_query == "":
+                        q = q.filter(~getattr(db.Books, 'custom_column_' + str(c.id)).
+                                     any(db.cc_classes[c.id].value >= 0))
+                    else:
+                        q = q.filter(getattr(db.Books, 'custom_column_' + str(c.id)).any(
+                            db.cc_classes[c.id].value == bool(custom_query == "True")))
+            elif custom_query != '' and custom_query is not None:
+                if c.datatype == 'rating':
+                    q = q.filter(getattr(db.Books, 'custom_column_' + str(c.id)).any(
+                        db.cc_classes[c.id].value == int(float(custom_query) * 2)))
+                else:
+                    q = q.filter(getattr(db.Books, 'custom_column_' + str(c.id)).any(
+                        func.lower(db.cc_classes[c.id].value).ilike("%" + custom_query + "%")))
+    return q
+
+
+def adv_search_language(q, include_languages_inputs, exclude_languages_inputs):
+    if current_user.filter_language() != "all":
+        q = q.filter(db.Books.languages.any(db.Languages.lang_code == current_user.filter_language()))
+    else:
+        for language in include_languages_inputs:
+            q = q.filter(db.Books.languages.any(db.Languages.id == language))
+        for language in exclude_languages_inputs:
+            q = q.filter(not_(db.Books.series.any(db.Languages.id == language)))
+    return q
+
+
+def adv_search_ratings(q, rating_high, rating_low):
+    if rating_high:
+        rating_high = int(rating_high) * 2
+        q = q.filter(db.Books.ratings.any(db.Ratings.rating <= rating_high))
+    if rating_low:
+        rating_low = int(rating_low) * 2
+        q = q.filter(db.Books.ratings.any(db.Ratings.rating >= rating_low))
+    return q
+
+
+def adv_search_read_status(read_status):
+    if not config.config_read_column:
+        if read_status == "True":
+            db_filter = and_(ub.ReadBook.user_id == int(current_user.id),
+                             ub.ReadBook.read_status == ub.ReadBook.STATUS_FINISHED)
+        else:
+            db_filter = coalesce(ub.ReadBook.read_status, 0) != ub.ReadBook.STATUS_FINISHED
+    else:
+        try:
+            if read_status == "":
+                db_filter = coalesce(db.cc_classes[config.config_read_column].value, 2) == 2
+            else:
+                db_filter = db.cc_classes[config.config_read_column].value == bool(read_status == "True")
+        except (KeyError, AttributeError, IndexError):
+            log.error("Custom Column No.{} does not exist in calibre database".format(config.config_read_column))
+            flash(_("Custom Column No.%(column)d does not exist in calibre database",
+                    column=config.config_read_column),
+                  category="error")
+            return true()
+    return db_filter
+
+
+def adv_search_extension(q, include_extension_inputs, exclude_extension_inputs):
+    for extension in include_extension_inputs:
+        q = q.filter(db.Books.data.any(db.Data.format == extension))
+    for extension in exclude_extension_inputs:
+        q = q.filter(not_(db.Books.data.any(db.Data.format == extension)))
+    return q
+
+
+def adv_search_tag(q, include_tag_inputs, exclude_tag_inputs):
+    for tag in include_tag_inputs:
+        q = q.filter(db.Books.tags.any(db.Tags.id == tag))
+    for tag in exclude_tag_inputs:
+        q = q.filter(not_(db.Books.tags.any(db.Tags.id == tag)))
+    return q
+
+
+def adv_search_serie(q, include_series_inputs, exclude_series_inputs):
+    for serie in include_series_inputs:
+        q = q.filter(db.Books.series.any(db.Series.id == serie))
+    for serie in exclude_series_inputs:
+        q = q.filter(not_(db.Books.series.any(db.Series.id == serie)))
+    return q
+
+
+def adv_search_shelf(q, include_shelf_inputs, exclude_shelf_inputs):
+    if len(include_shelf_inputs):
+        in_shelf = (
+            calibre_db.session.query(ub.BookShelf.id)
+            .filter(ub.BookShelf.book_id == db.Books.id)
+            .filter(ub.BookShelf.shelf.in_(include_shelf_inputs))
+            .exists()
+        )
+        q = q.filter(in_shelf)
+    if len(exclude_shelf_inputs):
+        ex_shelf = (
+            calibre_db.session.query(ub.BookShelf.id)
+            .filter(ub.BookShelf.book_id == db.Books.id)
+            .filter(ub.BookShelf.shelf.in_(exclude_shelf_inputs))
+            .exists()
+        )
+        q = q.filter(~ex_shelf)
+    return q
+
+def extend_search_term(searchterm,
+                       author_name,
+                       book_title,
+                       publisher,
+                       pub_start,
+                       pub_end,
+                       tags,
+                       rating_high,
+                       rating_low,
+                       read_status,
+                       ):
+    searchterm.extend((author_name.replace('|', ','), book_title, publisher))
+    if pub_start:
+        try:
+            searchterm.extend([_("Published after ") +
+                               format_date(datetime.strptime(pub_start, "%Y-%m-%d"),
+                                           format='medium')])
+        except ValueError:
+            pub_start = ""
+    if pub_end:
+        try:
+            searchterm.extend([_("Published before ") +
+                               format_date(datetime.strptime(pub_end, "%Y-%m-%d"),
+                                           format='medium')])
+        except ValueError:
+            pub_end = ""
+    elements = {'tag': db.Tags, 'serie':db.Series, 'shelf':ub.Shelf}
+    for key, db_element in elements.items():
+        tag_names = calibre_db.session.query(db_element).filter(db_element.id.in_(tags['include_' + key])).all()
+        searchterm.extend(tag.name for tag in tag_names)
+        tag_names = calibre_db.session.query(db_element).filter(db_element.id.in_(tags['exclude_' + key])).all()
+        searchterm.extend(tag.name for tag in tag_names)
+    language_names = calibre_db.session.query(db.Languages). \
+        filter(db.Languages.id.in_(tags['include_language'])).all()
+    if language_names:
+        language_names = calibre_db.speaking_language(language_names)
+    searchterm.extend(language.name for language in language_names)
+    language_names = calibre_db.session.query(db.Languages). \
+        filter(db.Languages.id.in_(tags['exclude_language'])).all()
+    if language_names:
+        language_names = calibre_db.speaking_language(language_names)
+    searchterm.extend(language.name for language in language_names)
+    if rating_high:
+        searchterm.extend([_("Rating <= %(rating)s", rating=rating_high)])
+    if rating_low:
+        searchterm.extend([_("Rating >= %(rating)s", rating=rating_low)])
+    if read_status != "Any":
+        searchterm.extend([_("Read Status = '%(status)s'", status=read_status)])
+    searchterm.extend(ext for ext in tags['include_extension'])
+    searchterm.extend(ext for ext in tags['exclude_extension'])
+    # handle custom columns
+    searchterm = " + ".join(filter(None, searchterm))
+    return searchterm, pub_start, pub_end
+
+
+def render_adv_search_results(term, offset=None, order=None, limit=None):
+    sort = order[0] if order else [db.Books.sort]
+    pagination = None
+
+    cc = calibre_db.get_cc_columns(config, filter_config_custom_read=True)
+    calibre_db.create_functions()
+    query = calibre_db.generate_linked_query(config.config_read_column, db.Books)
+    q = query.outerjoin(db.books_series_link, db.Books.id == db.books_series_link.c.book)\
+        .outerjoin(db.Series)\
+        .filter(calibre_db.common_filters(True))
+
+    # parse multi selects to a complete dict
+    tags = dict()
+    elements = ['tag', 'serie', 'shelf', 'language', 'extension']
+    for element in elements:
+        tags['include_' + element] = term.get('include_' + element)
+        tags['exclude_' + element] = term.get('exclude_' + element)
+
+    author_name = term.get("authors")
+    book_title = term.get("title")
+    publisher = term.get("publisher")
+    pub_start = term.get("publishstart")
+    pub_end = term.get("publishend")
+    rating_low = term.get("ratinghigh")
+    rating_high = term.get("ratinglow")
+    description = term.get("comments")
+    read_status = term.get("read_status")
+    if author_name:
+        author_name = strip_whitespaces(author_name).lower().replace(',', '|')
+    if book_title:
+        book_title = strip_whitespaces(book_title).lower()
+    if publisher:
+        publisher = strip_whitespaces(publisher).lower()
+
+    search_term = []
+    cc_present = False
+    for c in cc:
+        if c.datatype == "datetime":
+            column_start = term.get('custom_column_' + str(c.id) + '_start')
+            column_end = term.get('custom_column_' + str(c.id) + '_end')
+            if column_start:
+                search_term.extend(["{} >= {}".format(c.name,
+                                                       format_date(datetime.strptime(column_start, "%Y-%m-%d").date(),
+                                                                   format='medium')
+                                                       )])
+                cc_present = True
+            if column_end:
+                search_term.extend(["{} <= {}".format(c.name,
+                                                      format_date(datetime.strptime(column_end, "%Y-%m-%d").date(),
+                                                                   format='medium')
+                                                       )])
+                cc_present = True
+        if c.datatype in ["int", "float"]:
+            column_low = term.get('custom_column_' + str(c.id) + '_low')
+            column_high = term.get('custom_column_' + str(c.id) + '_high')
+            if column_low:
+                search_term.extend(["{} >= {}".format(c.name, column_low)])
+                cc_present = True
+            if column_high:
+                search_term.extend(["{} <= {}".format(c.name,column_high)])
+                cc_present = True
+        elif c.datatype == "bool":
+            if term.get('custom_column_' + str(c.id)) != "Any":
+                search_term.extend([("{}: {}".format(c.name, term.get('custom_column_' + str(c.id))))])
+                cc_present = True
+        elif term.get('custom_column_' + str(c.id)):
+            search_term.extend([("{}: {}".format(c.name, term.get('custom_column_' + str(c.id))))])
+            cc_present = True
+
+    if any(tags.values()) or author_name or book_title or publisher or pub_start or pub_end or rating_low \
+       or rating_high or description or cc_present or read_status != "Any":
+        search_term, pub_start, pub_end = extend_search_term(search_term,
+                                                             author_name,
+                                                             book_title,
+                                                             publisher,
+                                                             pub_start,
+                                                             pub_end,
+                                                             tags,
+                                                             rating_high,
+                                                             rating_low,
+                                                             read_status)
+        if author_name:
+            q = q.filter(db.Books.authors.any(func.lower(db.Authors.name).ilike("%" + author_name + "%")))
+        if book_title:
+            q = q.filter(func.lower(db.Books.title).ilike("%" + book_title + "%"))
+        if pub_start:
+            q = q.filter(func.datetime(db.Books.pubdate) > func.datetime(pub_start))
+        if pub_end:
+            q = q.filter(func.datetime(db.Books.pubdate) < func.datetime(pub_end))
+        if read_status != "Any":
+            q = q.filter(adv_search_read_status(read_status))
+        if publisher:
+            q = q.filter(db.Books.publishers.any(func.lower(db.Publishers.name).ilike("%" + publisher + "%")))
+        q = adv_search_tag(q, tags['include_tag'], tags['exclude_tag'])
+        q = adv_search_serie(q, tags['include_serie'], tags['exclude_serie'])
+        q = adv_search_shelf(q, tags['include_shelf'], tags['exclude_shelf'])
+        q = adv_search_extension(q, tags['include_extension'], tags['exclude_extension'])
+        q = adv_search_language(q, tags['include_language'], tags['exclude_language'])
+        q = adv_search_ratings(q, rating_high, rating_low)
+
+        if description:
+            pass
+            q = q.filter(db.Books.comments.any(func.lower(db.Comments.text).ilike("%" + description + "%")))
+
+        # search custom columns
+        try:
+            pass
+            q = adv_search_custom_columns(cc, term, q)
+        except AttributeError as ex:
+            log.debug_or_exception(ex)
+            flash(_("Error on search for custom columns, please restart Calibre-Web"), category="error")
+
+    q = q.order_by(*sort).all()
+    flask_session['query'] = json.dumps(term)
+    ub.store_combo_ids(q)
+    result_count = len(q)
+    if offset is not None and limit is not None:
+        offset = int(offset)
+        limit_all = offset + int(limit)
+        pagination = Pagination((offset / (int(limit)) + 1), limit, result_count)
+    else:
+        offset = 0
+        limit_all = result_count
+    entries = calibre_db.order_authors(q[offset:limit_all], list_return=True, combined=True)
+    return render_title_template('search.html',
+                                 adv_searchterm=search_term,
+                                 pagination=pagination,
+                                 entries=entries,
+                                 result_count=result_count,
+                                 title=_("Advanced Search"), page="advsearch",
+                                 order=order[1])
+
+
+def render_prepare_search_form(cc):
+    # prepare data for search-form
+    tags = calibre_db.session.query(db.Tags)\
+        .join(db.books_tags_link)\
+        .join(db.Books)\
+        .filter(calibre_db.common_filters()) \
+        .group_by(text('books_tags_link.tag'))\
+        .order_by(db.Tags.name).all()
+    series = calibre_db.session.query(db.Series)\
+        .join(db.books_series_link)\
+        .join(db.Books)\
+        .filter(calibre_db.common_filters()) \
+        .group_by(text('books_series_link.series'))\
+        .order_by(db.Series.name)\
+        .filter(calibre_db.common_filters()).all()
+    shelves = ub.session.query(ub.Shelf)\
+        .filter(or_(ub.Shelf.is_public == 1, ub.Shelf.user_id == int(current_user.id)))\
+        .order_by(ub.Shelf.name).all()
+    extensions = calibre_db.session.query(db.Data)\
+        .join(db.Books)\
+        .filter(calibre_db.common_filters()) \
+        .group_by(db.Data.format)\
+        .order_by(db.Data.format).all()
+    if current_user.filter_language() == "all":
+        languages = calibre_db.speaking_language()
+    else:
+        languages = None
+    return render_title_template('search_form.html', tags=tags, languages=languages, extensions=extensions,
+                                 series=series,shelves=shelves, title=_("Advanced Search"), cc=cc, page="advsearch")
+
+
+def render_search_results(term, offset=None, order=None, limit=None):
+    if term:
+        join = db.books_series_link, db.Books.id == db.books_series_link.c.book, db.Series
+        entries, result_count, pagination = calibre_db.get_search_results(term,
+                                                                          config,
+                                                                          offset,
+                                                                          order,
+                                                                          limit,
+                                                                          *join)
+    else:
+        entries = list()
+        order = [None, None]
+        pagination = result_count = None
+
+    return render_title_template('search.html',
+                                 searchterm=term,
+                                 pagination=pagination,
+                                 query=term,
+                                 adv_searchterm=term,
+                                 entries=entries,
+                                 result_count=result_count,
+                                 title=_("Search"),
+                                 page="search",
+                                 order=order[1])
+
+
@@ -0,0 +1,139 @@
+# -*- coding: utf-8 -*-
+
+#  This file is part of the Calibre-Web (https://github.com/janeczku/calibre-web)
+#    Copyright (C) 2021 OzzieIsaacs
+#
+#  This program is free software: you can redistribute it and/or modify
+#  it under the terms of the GNU General Public License as published by
+#  the Free Software Foundation, either version 3 of the License, or
+#  (at your option) any later version.
+#
+#  This program is distributed in the hope that it will be useful,
+#  but WITHOUT ANY WARRANTY; without even the implied warranty of
+#  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+#  GNU General Public License for more details.
+#
+#  You should have received a copy of the GNU General Public License
+#  along with this program. If not, see <http://www.gnu.org/licenses/>.
+
+import concurrent.futures
+import importlib
+import inspect
+import json
+import os
+import sys
+
+from flask import Blueprint, request, url_for, make_response, jsonify
+from .cw_login import current_user
+from flask_babel import get_locale
+from sqlalchemy.exc import InvalidRequestError, OperationalError
+from sqlalchemy.orm.attributes import flag_modified
+
+from cps.services.Metadata import Metadata
+from . import constants, logger, ub, web_server
+from .usermanagement import user_login_required
+
+
+meta = Blueprint("metadata", __name__)
+
+log = logger.create()
+
+try:
+    from dataclasses import asdict
+except ImportError:
+    log.info('*** "dataclasses" is needed for calibre-web to run. Please install it using pip: "pip install dataclasses" ***')
+    print('*** "dataclasses" is needed for calibre-web to run. Please install it using pip: "pip install dataclasses" ***')
+    web_server.stop(True)
+    sys.exit(6)
+
+new_list = list()
+meta_dir = os.path.join(constants.BASE_DIR, "cps", "metadata_provider")
+modules = os.listdir(os.path.join(constants.BASE_DIR, "cps", "metadata_provider"))
+for f in modules:
+    if os.path.isfile(os.path.join(meta_dir, f)) and not f.endswith("__init__.py"):
+        a = os.path.basename(f)[:-3]
+        try:
+            importlib.import_module("cps.metadata_provider." + a)
+            new_list.append(a)
+        except (IndentationError, SyntaxError) as e:
+            log.error("Syntax error for metadata source: {} - {}".format(a, e))
+        except ImportError as e:
+            log.debug("Import error for metadata source: {} - {}".format(a, e))
+
+
+def list_classes(provider_list):
+    classes = list()
+    for element in provider_list:
+        for name, obj in inspect.getmembers(
+            sys.modules["cps.metadata_provider." + element]
+        ):
+            if (
+                inspect.isclass(obj)
+                and name != "Metadata"
+                and issubclass(obj, Metadata)
+            ):
+                classes.append(obj())
+    return classes
+
+
+cl = list_classes(new_list)
+
+
+@meta.route("/metadata/provider")
+@user_login_required
+def metadata_provider():
+    active = current_user.view_settings.get("metadata", {})
+    provider = list()
+    for c in cl:
+        ac = active.get(c.__id__, True)
+        provider.append(
+            {"name": c.__name__, "active": ac, "initial": ac, "id": c.__id__}
+        )
+    return make_response(jsonify(provider))
+
+
+@meta.route("/metadata/provider", methods=["POST"])
+@meta.route("/metadata/provider/<prov_name>", methods=["POST"])
+@user_login_required
+def metadata_change_active_provider(prov_name):
+    new_state = request.get_json()
+    active = current_user.view_settings.get("metadata", {})
+    active[new_state["id"]] = new_state["value"]
+    current_user.view_settings["metadata"] = active
+    try:
+        try:
+            flag_modified(current_user, "view_settings")
+        except AttributeError:
+            pass
+        ub.session.commit()
+    except (InvalidRequestError, OperationalError):
+        log.error("Invalid request received: {}".format(request))
+        return "Invalid request", 400
+    if "initial" in new_state and prov_name:
+        data = []
+        provider = next((c for c in cl if c.__id__ == prov_name), None)
+        if provider is not None:
+            data = provider.search(new_state.get("query", ""))
+        return make_response(jsonify([asdict(x) for x in data]))
+    return ""
+
+
+@meta.route("/metadata/search", methods=["POST"])
+@user_login_required
+def metadata_search():
+    query = request.form.to_dict().get("query")
+    data = list()
+    active = current_user.view_settings.get("metadata", {})
+    locale = get_locale()
+    if query:
+        static_cover = url_for("static", filename="generic_cover.jpg")
+        # ret = cl[0].search(query, static_cover, locale)
+        with concurrent.futures.ThreadPoolExecutor(max_workers=5) as executor:
+            meta = {
+                executor.submit(c.search, query, static_cover, locale): c
+                for c in cl
+                if active.get(c.__id__, True)
+            }
+            for future in concurrent.futures.as_completed(meta):
+                data.extend([asdict(x) for x in (future.result() or []) if x])
+    return  make_response(jsonify(data))
@@ -16,7 +16,6 @@
 #  You should have received a copy of the GNU General Public License
 #  along with this program. If not, see <http://www.gnu.org/licenses/>.

-from __future__ import division, print_function, unicode_literals
 import sys
 import os
 import errno
@@ -25,21 +24,24 @@ import socket

 try:
    from gevent.pywsgi import WSGIServer
+    from .gevent_wsgi import MyWSGIHandler
    from gevent.pool import Pool
+    from gevent.socket import socket as GeventSocket
    from gevent import __version__ as _version
    from greenlet import GreenletExit
    import ssl
    VERSION = 'Gevent ' + _version
    _GEVENT = True
 except ImportError:
-    from tornado.wsgi import WSGIContainer
+    from .tornado_wsgi import MyWSGIContainer
    from tornado.httpserver import HTTPServer
    from tornado.ioloop import IOLoop
+    from tornado import netutil
    from tornado import version as _version
    VERSION = 'Tornado ' + _version
    _GEVENT = False

-from . import logger
+from . import logger, constants


 log = logger.create()
@@ -94,7 +96,13 @@ class WebServer(object):
                log.warning('Cert path: %s', certfile_path)
                log.warning('Key path:  %s', keyfile_path)

-    def _make_gevent_unix_socket(self, socket_file):
+    @staticmethod
+    def _make_gevent_socket_activated():
+        # Reuse an already open socket on fd=SD_LISTEN_FDS_START
+        SD_LISTEN_FDS_START = 3
+        return GeventSocket(fileno=SD_LISTEN_FDS_START)
+
+    def _prepare_unix_socket(self, socket_file):
        # the socket file must not exist prior to bind()
        if os.path.exists(socket_file):
            # avoid nuking regular files and symbolic links (could be a mistype or security issue)
@@ -102,49 +110,122 @@ class WebServer(object):
                raise OSError(errno.EEXIST, os.strerror(errno.EEXIST), socket_file)
            os.remove(socket_file)

-        unix_sock = WSGIServer.get_listener(socket_file, family=socket.AF_UNIX)
        self.unix_socket_file = socket_file

-        # ensure current user and group have r/w permissions, no permissions for other users
-        # this way the socket can be shared in a semi-secure manner
-        # between the user running calibre-web and the user running the fronting webserver
-        os.chmod(socket_file, 0o660)
-
-        return unix_sock
-
-    def _make_gevent_socket(self):
+    def _make_gevent_listener(self):
        if os.name != 'nt':
+            socket_activated = os.environ.get("LISTEN_FDS")
+            if socket_activated:
+                sock = self._make_gevent_socket_activated()
+                sock_info = sock.getsockname()
+                return sock, "systemd-socket:" + _readable_listen_address(sock_info[0], sock_info[1])
            unix_socket_file = os.environ.get("CALIBRE_UNIX_SOCKET")
            if unix_socket_file:
-                return self._make_gevent_unix_socket(unix_socket_file), "unix:" + unix_socket_file
+                self._prepare_unix_socket(unix_socket_file)
+                unix_sock = WSGIServer.get_listener(unix_socket_file, family=socket.AF_UNIX)
+                # ensure current user and group have r/w permissions, no permissions for other users
+                # this way the socket can be shared in a semi-secure manner
+                # between the user running calibre-web and the user running the fronting webserver
+                os.chmod(unix_socket_file, 0o660)
+
+                return unix_sock, "unix:" + unix_socket_file

        if self.listen_address:
-            return (self.listen_address, self.listen_port), None
+            return ((self.listen_address, self.listen_port),
+                    _readable_listen_address(self.listen_address, self.listen_port))

        if os.name == 'nt':
            self.listen_address = '0.0.0.0'
-            return (self.listen_address, self.listen_port), None
+            return ((self.listen_address, self.listen_port),
+                    _readable_listen_address(self.listen_address, self.listen_port))

+        address = ('::', self.listen_port)
        try:
-            address = ('::', self.listen_port)
            sock = WSGIServer.get_listener(address, family=socket.AF_INET6)
        except socket.error as ex:
            log.error('%s', ex)
-            log.warning('Unable to listen on "", trying on IPv4 only...')
+            log.warning('Unable to listen on {}, trying on IPv4 only...'.format(address))
            address = ('', self.listen_port)
            sock = WSGIServer.get_listener(address, family=socket.AF_INET)

        return sock, _readable_listen_address(*address)

+    @staticmethod
+    def _get_args_for_reloading():
+        """Determine how the script was executed, and return the args needed
+        to execute it again in a new process.
+        Code from https://github.com/pyload/pyload. Author GammaC0de, voulter
+        """
+        rv = [sys.executable]
+        py_script = sys.argv[0]
+        args = sys.argv[1:]
+        # Need to look at main module to determine how it was executed.
+        __main__ = sys.modules["__main__"]
+
+        # The value of __package__ indicates how Python was called. It may
+        # not exist if a setuptools script is installed as an egg. It may be
+        # set incorrectly for entry points created with pip on Windows.
+        if getattr(__main__, "__package__", "") in ["", None] or (
+            os.name == "nt"
+            and __main__.__package__ == ""
+            and not os.path.exists(py_script)
+            and os.path.exists("{}.exe".format(py_script))
+        ):
+            # Executed a file, like "python app.py".
+            py_script = os.path.abspath(py_script)
+
+            if os.name == "nt":
+                # Windows entry points have ".exe" extension and should be
+                # called directly.
+                if not os.path.exists(py_script) and os.path.exists("{}.exe".format(py_script)):
+                    py_script += ".exe"
+
+                if (
+                        os.path.splitext(sys.executable)[1] == ".exe"
+                        and os.path.splitext(py_script)[1] == ".exe"
+                ):
+                    rv.pop(0)
+
+            rv.append(py_script)
+        else:
+            # Executed a module, like "python -m module".
+            if sys.argv[0] == "-m":
+                args = sys.argv
+            else:
+                if os.path.isfile(py_script):
+                    # Rewritten by Python from "-m script" to "/path/to/script.py".
+                    py_module = __main__.__package__
+                    name = os.path.splitext(os.path.basename(py_script))[0]
+
+                    if name != "__main__":
+                        py_module += ".{}".format(name)
+                else:
+                    # Incorrectly rewritten by pydevd debugger from "-m script" to "script".
+                    py_module = py_script
+
+                rv.extend(("-m", py_module.lstrip(".")))
+
+        rv.extend(args)
+        if os.name == 'nt':
+            rv = ['"{}"'.format(a) for a in rv]
+        return rv
+
    def _start_gevent(self):
        ssl_args = self.ssl_args or {}

        try:
-            sock, output = self._make_gevent_socket()
-            if output is None:
-                output = _readable_listen_address(self.listen_address, self.listen_port)
+            sock, output = self._make_gevent_listener()
            log.info('Starting Gevent server on %s', output)
-            self.wsgiserver = WSGIServer(sock, self.app, log=self.access_logger, spawn=Pool(), **ssl_args)
+            try:
+                # Also print to stdout so interactive terminals show a clear success message
+                if constants.APP_MODE not in ['development', 'test']:
+                    print(f"Calibre-Web: server started on {output}")
+            except Exception:
+                print(f"Calibre-Web: error {output}")
+                pass
+            self.wsgiserver = WSGIServer(sock, self.app, log=self.access_logger, handler_class=MyWSGIHandler,
+                                         error_log=log,
+                                         spawn=Pool(), **ssl_args)
            if ssl_args:
                wrap_socket = self.wsgiserver.wrap_socket
                def my_wrap_socket(*args, **kwargs):
@@ -165,17 +246,49 @@ class WebServer(object):
        if os.name == 'nt' and sys.version_info > (3, 7):
            import asyncio
            asyncio.set_event_loop_policy(asyncio.WindowsSelectorEventLoopPolicy())
-        log.info('Starting Tornado server on %s', _readable_listen_address(self.listen_address, self.listen_port))
+        try:
+            # Max Buffersize set to 200MB
+            http_server = HTTPServer(MyWSGIContainer(self.app),
+                                     max_buffer_size=209700000,
+                                     ssl_options=self.ssl_args)

-        # Max Buffersize set to 200MB            )
-        http_server = HTTPServer(WSGIContainer(self.app),
-                                 max_buffer_size=209700000,
-                                 ssl_options=self.ssl_args)
-        http_server.listen(self.listen_port, self.listen_address)
-        self.wsgiserver = IOLoop.current()
-        self.wsgiserver.start()
-        # wait for stop signal
-        self.wsgiserver.close(True)
+            unix_socket_file = os.environ.get("CALIBRE_UNIX_SOCKET")
+            if os.environ.get("LISTEN_FDS") and os.name != 'nt':
+                SD_LISTEN_FDS_START = 3
+                sock = socket.socket(fileno=SD_LISTEN_FDS_START)
+                http_server.add_socket(sock)
+                sock.setblocking(0)
+                socket_name =sock.getsockname()
+                output = "systemd-socket:" + _readable_listen_address(socket_name[0], socket_name[1])
+            elif unix_socket_file and os.name != 'nt':
+                self._prepare_unix_socket(unix_socket_file)
+                output = "unix:" + unix_socket_file
+                unix_socket = netutil.bind_unix_socket(self.unix_socket_file)
+                http_server.add_socket(unix_socket)
+                # ensure current user and group have r/w permissions, no permissions for other users
+                # this way the socket can be shared in a semi-secure manner
+                # between the user running calibre-web and the user running the fronting webserver
+                os.chmod(self.unix_socket_file, 0o660)
+            else:
+                output = _readable_listen_address(self.listen_address, self.listen_port)
+                http_server.listen(self.listen_port, self.listen_address)
+            log.info('Starting Tornado server on %s', output)
+            # Also print to stdout so interactive terminals show a clear success message
+            try:
+                if constants.APP_MODE not in ['development', 'test']:
+                    print(f"Calibre-Web: server started on {output}")
+            except Exception:
+                print(f"Calibre-Web: error {output}")
+                pass
+
+            self.wsgiserver = IOLoop.current()
+            self.wsgiserver.start()
+            # wait for stop signal
+            self.wsgiserver.close(True)
+        finally:
+            if self.unix_socket_file:
+                os.remove(self.unix_socket_file)
+                self.unix_socket_file = None

    def start(self):
        try:
@@ -192,19 +305,23 @@ class WebServer(object):
        finally:
            self.wsgiserver = None

+        # prevent irritating log of pending tasks message from asyncio
+        logger.get('asyncio').setLevel(logger.logging.CRITICAL)
+
        if not self.restart:
            log.info("Performing shutdown of Calibre-Web")
-            # prevent irritiating log of pending tasks message from asyncio
-            logger.get('asyncio').setLevel(logger.logging.CRITICAL)
            return True

        log.info("Performing restart of Calibre-Web")
-        arguments = list(sys.argv)
-        arguments.insert(0, sys.executable)
-        if os.name == 'nt':
-            arguments = ["\"%s\"" % a for a in arguments]
-        os.execv(sys.executable, arguments)
-        return True
+        args = self._get_args_for_reloading()
+        os.execv(args[0].lstrip('"').rstrip('"'), args)
+
+    @staticmethod
+    def shutdown_scheduler():
+        from .services.background_scheduler import BackgroundScheduler
+        scheduler = BackgroundScheduler()
+        if scheduler:
+            scheduler.scheduler.shutdown()

    def _killServer(self, __, ___):
        self.stop()
@@ -214,9 +331,14 @@ class WebServer(object):
        updater_thread.stop()

        log.info("webserver stop (restart=%s)", restart)
+        self.shutdown_scheduler()
        self.restart = restart
        if self.wsgiserver:
            if _GEVENT:
                self.wsgiserver.close()
            else:
-                self.wsgiserver.add_callback_from_signal(self.wsgiserver.stop)
+                if restart:
+                    self.wsgiserver.call_later(1.0, self.wsgiserver.stop)
+                else:
+                    self.wsgiserver.asyncio_loop.call_soon_threadsafe(self.wsgiserver.stop)
+
@@ -0,0 +1,111 @@
+# -*- coding: utf-8 -*-
+
+#  This file is part of the Calibre-Web (https://github.com/janeczku/calibre-web)
+#    Copyright (C) 2021 OzzieIsaacs
+#
+#  This program is free software: you can redistribute it and/or modify
+#  it under the terms of the GNU General Public License as published by
+#  the Free Software Foundation, either version 3 of the License, or
+#  (at your option) any later version.
+#
+#  This program is distributed in the hope that it will be useful,
+#  but WITHOUT ANY WARRANTY; without even the implied warranty of
+#  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+#  GNU General Public License for more details.
+#
+#  You should have received a copy of the GNU General Public License
+#  along with this program. If not, see <http://www.gnu.org/licenses/>.
+import abc
+import dataclasses
+import os
+import re
+from typing import Dict, Generator, List, Optional, Union
+
+from cps import constants
+
+
+@dataclasses.dataclass
+class MetaSourceInfo:
+    id: str
+    description: str
+    link: str
+
+
+@dataclasses.dataclass
+class MetaRecord:
+    id: Union[str, int]
+    title: str
+    authors: List[str]
+    url: str
+    source: MetaSourceInfo
+    cover: str = os.path.join(constants.STATIC_DIR, 'generic_cover.jpg')
+    description: Optional[str] = ""
+    series: Optional[str] = None
+    series_index: Optional[Union[int, float]] = 0
+    identifiers: Dict[str, Union[str, int]] = dataclasses.field(default_factory=dict)
+    publisher: Optional[str] = None
+    publishedDate: Optional[str] = None
+    rating: Optional[int] = 0
+    languages: Optional[List[str]] = dataclasses.field(default_factory=list)
+    tags: Optional[List[str]] = dataclasses.field(default_factory=list)
+
+
+class Metadata:
+    __name__ = "Generic"
+    __id__ = "generic"
+
+    def __init__(self):
+        self.active = True
+
+    def set_status(self, state):
+        self.active = state
+
+    @abc.abstractmethod
+    def search(
+        self, query: str, generic_cover: str = "", locale: str = "en"
+    ) -> Optional[List[MetaRecord]]:
+        pass
+
+    @staticmethod
+    def get_title_tokens(
+        title: str, strip_joiners: bool = True
+    ) -> Generator[str, None, None]:
+        """
+        Taken from calibre source code
+        It's a simplified (cut out what is unnecessary) version of
+        https://github.com/kovidgoyal/calibre/blob/99d85b97918625d172227c8ffb7e0c71794966c0/
+        src/calibre/ebooks/metadata/sources/base.py#L363-L367
+        (src/calibre/ebooks/metadata/sources/base.py - lines 363-398)
+        """
+        title_patterns = [
+            (re.compile(pat, re.IGNORECASE), repl)
+            for pat, repl in [
+                # Remove things like: (2010) (Omnibus) etc.
+                (
+                    r"(?i)[({\[](\d{4}|omnibus|anthology|hardcover|"
+                    r"audiobook|audio\scd|paperback|turtleback|"
+                    r"mass\s*market|edition|ed\.)[\])}]",
+                    "",
+                ),
+                # Remove any strings that contain the substring edition inside
+                # parentheses
+                (r"(?i)[({\[].*?(edition|ed.).*?[\]})]", ""),
+                # Remove commas used a separators in numbers
+                (r"(\d+),(\d+)", r"\1\2"),
+                # Remove hyphens only if they have whitespace before them
+                (r"(\s-)", " "),
+                # Replace other special chars with a space
+                (r"""[:,;!@$%^&*(){}.`~"\s\[\]/]《》「」“”""", " "),
+            ]
+        ]
+
+        for pat, repl in title_patterns:
+            title = pat.sub(repl, title)
+
+        tokens = title.split()
+        for token in tokens:
+            token = token.strip().strip('"').strip("'")
+            if token and (
+                not strip_joiners or token.lower() not in ("a", "and", "the", "&")
+            ):
+                yield token
@@ -19,12 +19,8 @@

 import sys
 from base64 import b64decode, b64encode
-from jsonschema import validate, exceptions, __version__
+from jsonschema import validate, exceptions
 from datetime import datetime
-try:
-    from urllib import unquote
-except ImportError:
-    from urllib.parse import unquote

 from flask import json
 from .. import logger
@@ -34,13 +30,10 @@ log = logger.create()


 def b64encode_json(json_data):
-    if sys.version_info < (3, 0):
-        return b64encode(json.dumps(json_data))
-    else:
-        return b64encode(json.dumps(json_data).encode())
+    return b64encode(json.dumps(json_data).encode()).decode("utf-8")


-# Python3 has a timestamp() method we could be calling, however it's not avaiable in python2.
+# Python3 has a timestamp() method we could be calling, however it's not available in python2.
 def to_epoch_timestamp(datetime_object):
    return (datetime_object - datetime(1970, 1, 1)).total_seconds()

@@ -54,7 +47,7 @@ def get_datetime_from_json(json_object, field_name):


 class SyncToken:
-    """ The SyncToken is used to persist state accross requests.
+    """ The SyncToken is used to persist state across requests.
    When serialized over the response headers, the Kobo device will propagate the token onto following
    requests to the service. As an example use-case, the SyncToken is used to detect books that have been added
    to the library since the last time the device synced to the server.
@@ -64,7 +57,7 @@ class SyncToken:
        books_last_modified: Datetime representing the last modified book that the device knows about.
    """

-    SYNC_TOKEN_HEADER = "x-kobo-synctoken"
+    SYNC_TOKEN_HEADER = "x-kobo-synctoken"  # nosec
    VERSION = "1-1-0"
    LAST_MODIFIED_ADDED_VERSION = "1-1-0"
    MIN_VERSION = "1-0-0"
@@ -84,8 +77,8 @@ class SyncToken:
            "books_last_created": {"type": "string"},
            "archive_last_modified": {"type": "string"},
            "reading_state_last_modified": {"type": "string"},
-            "tags_last_modified": {"type": "string"},
-            "books_last_id": {"type": "integer", "optional": True}
+            "tags_last_modified": {"type": "string"}
+            # "books_last_id": {"type": "integer", "optional": True}
        },
    }

@@ -96,21 +89,21 @@ class SyncToken:
        books_last_modified=datetime.min,
        archive_last_modified=datetime.min,
        reading_state_last_modified=datetime.min,
-        tags_last_modified=datetime.min,
-        books_last_id=-1
-    ):
+        tags_last_modified=datetime.min
+        # books_last_id=-1
+    ):  # nosec
        self.raw_kobo_store_token = raw_kobo_store_token
        self.books_last_created = books_last_created
        self.books_last_modified = books_last_modified
        self.archive_last_modified = archive_last_modified
        self.reading_state_last_modified = reading_state_last_modified
        self.tags_last_modified = tags_last_modified
-        self.books_last_id = books_last_id
+        # self.books_last_id = books_last_id

    @staticmethod
    def from_headers(headers):
        sync_token_header = headers.get(SyncToken.SYNC_TOKEN_HEADER, "")
-        if sync_token_header == "":
+        if sync_token_header == "":  # nosec
            return SyncToken()

        # On the first sync from a Kobo device, we may receive the SyncToken
@@ -140,12 +133,9 @@ class SyncToken:
            archive_last_modified = get_datetime_from_json(data_json, "archive_last_modified")
            reading_state_last_modified = get_datetime_from_json(data_json, "reading_state_last_modified")
            tags_last_modified = get_datetime_from_json(data_json, "tags_last_modified")
-            books_last_id = data_json["books_last_id"]
        except TypeError:
            log.error("SyncToken timestamps don't parse to a datetime.")
            return SyncToken(raw_kobo_store_token=raw_kobo_store_token)
-        except KeyError:
-            books_last_id = -1

        return SyncToken(
            raw_kobo_store_token=raw_kobo_store_token,
@@ -154,7 +144,6 @@ class SyncToken:
            archive_last_modified=archive_last_modified,
            reading_state_last_modified=reading_state_last_modified,
            tags_last_modified=tags_last_modified,
-            books_last_id=books_last_id
        )

    def set_kobo_store_header(self, store_headers):
@@ -178,7 +167,14 @@ class SyncToken:
                "archive_last_modified": to_epoch_timestamp(self.archive_last_modified),
                "reading_state_last_modified": to_epoch_timestamp(self.reading_state_last_modified),
                "tags_last_modified": to_epoch_timestamp(self.tags_last_modified),
-                "books_last_id":self.books_last_id
            },
        }
        return b64encode_json(token)
+
+    def __str__(self):
+        return "{},{},{},{},{},{}".format(self.books_last_created,
+                                          self.books_last_modified,
+                                          self.archive_last_modified,
+                                          self.reading_state_last_modified,
+                                          self.tags_last_modified,
+                                          self.raw_kobo_store_token)
@@ -16,15 +16,12 @@
 #  You should have received a copy of the GNU General Public License
 #  along with this program. If not, see <http://www.gnu.org/licenses/>.

-from __future__ import division, print_function, unicode_literals
-
 from .. import logger

-
 log = logger.create()

-
-try: from . import goodreads_support
+try:
+    from . import goodreads_support
 except ImportError as err:
    log.debug("Cannot import goodreads, showing authors-metadata will not work: %s", err)
    goodreads_support = None
@@ -45,3 +42,9 @@ except ImportError as err:
    log.debug("Cannot import SyncToken, syncing books with Kobo Devices will not work: %s", err)
    kobo = None
    SyncToken = None
+
+try:
+    from . import gmail
+except ImportError as err:
+    log.debug("Cannot import gmail, sending books via Gmail Oauth2 Verification will not work: %s", err)
+    gmail = None
@@ -0,0 +1,85 @@
+# -*- coding: utf-8 -*-
+
+#   This file is part of the Calibre-Web (https://github.com/janeczku/calibre-web)
+#     Copyright (C) 2020 mmonkey
+#
+#   This program is free software: you can redistribute it and/or modify
+#   it under the terms of the GNU General Public License as published by
+#   the Free Software Foundation, either version 3 of the License, or
+#   (at your option) any later version.
+#
+#   This program is distributed in the hope that it will be useful,
+#   but WITHOUT ANY WARRANTY; without even the implied warranty of
+#   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+#   GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public License
+#   along with this program. If not, see <http://www.gnu.org/licenses/>.
+
+import atexit
+
+from .. import logger
+from .worker import WorkerThread
+
+try:
+    from apscheduler.schedulers.background import BackgroundScheduler as BScheduler
+    from apscheduler.triggers.cron import CronTrigger
+    from apscheduler.triggers.date import DateTrigger
+    use_APScheduler = True
+except (ImportError, RuntimeError) as e:
+    use_APScheduler = False
+    log = logger.create()
+    log.info('APScheduler not found. Unable to schedule tasks.')
+
+
+class BackgroundScheduler:
+    _instance = None
+
+    def __new__(cls):
+        if not use_APScheduler:
+            return False
+
+        if cls._instance is None:
+            cls._instance = super(BackgroundScheduler, cls).__new__(cls)
+            cls.log = logger.create()
+            logger.logging.getLogger('tzlocal').setLevel(logger.logging.WARNING)
+            cls.scheduler = BScheduler()
+            cls.scheduler.start()
+
+        return cls._instance
+
+    def schedule(self, func, trigger, name=None):
+        if use_APScheduler:
+            return self.scheduler.add_job(func=func, trigger=trigger, name=name)
+
+    # Expects a lambda expression for the task
+    def schedule_task(self, task, user=None, name=None, hidden=False, trigger=None):
+        if use_APScheduler:
+            def scheduled_task():
+                worker_task = task()
+                worker_task.scheduled = True
+                WorkerThread.add(user, worker_task, hidden=hidden)
+            return self.schedule(func=scheduled_task, trigger=trigger, name=name)
+
+    # Expects a list of lambda expressions for the tasks
+    def schedule_tasks(self, tasks, user=None, trigger=None):
+        if use_APScheduler:
+            for task in tasks:
+                self.schedule_task(task[0], user=user, trigger=trigger, name=task[1], hidden=task[2])
+
+    # Expects a lambda expression for the task
+    def schedule_task_immediately(self, task, user=None, name=None, hidden=False):
+        if use_APScheduler:
+            def immediate_task():
+                WorkerThread.add(user, task(), hidden)
+            return self.schedule(func=immediate_task, trigger=DateTrigger(), name=name)
+
+    # Expects a list of lambda expressions for the tasks
+    def schedule_tasks_immediately(self, tasks, user=None):
+        if use_APScheduler:
+            for task in tasks:
+                self.schedule_task_immediately(task[0], user, name="immediately " + task[1], hidden=task[2])
+
+    # Remove all jobs
+    def remove_all_jobs(self):
+        self.scheduler.remove_all_jobs()
@@ -0,0 +1,101 @@
+# -*- coding: utf-8 -*-
+
+#  This file is part of the Calibre-Web (https://github.com/janeczku/calibre-web)
+#    Copyright (C) 2021 OzzieIsaacs
+#
+#  This program is free software: you can redistribute it and/or modify
+#  it under the terms of the GNU General Public License as published by
+#  the Free Software Foundation, either version 3 of the License, or
+#  (at your option) any later version.
+#
+#  This program is distributed in the hope that it will be useful,
+#  but WITHOUT ANY WARRANTY; without even the implied warranty of
+#  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+#  GNU General Public License for more details.
+#
+#  You should have received a copy of the GNU General Public License
+#  along with this program. If not, see <http://www.gnu.org/licenses/>.
+
+import os.path
+from google_auth_oauthlib.flow import InstalledAppFlow
+from google.auth.transport.requests import Request
+from googleapiclient.discovery import build
+from google.oauth2.credentials import Credentials
+
+from datetime import datetime
+import base64
+from flask_babel import gettext as _
+from ..constants import CONFIG_DIR
+from .. import logger
+
+
+log = logger.create()
+
+SCOPES = ['openid', 'https://www.googleapis.com/auth/gmail.send', 'https://www.googleapis.com/auth/userinfo.email']
+
+def setup_gmail(token):
+    # If there are no (valid) credentials available, let the user log in.
+    creds = None
+    user_info = None
+    if "token" in token:
+        creds = Credentials(
+            token=token['token'],
+            refresh_token=token['refresh_token'],
+            token_uri=token['token_uri'],
+            client_id=token['client_id'],
+            client_secret=token['client_secret'],
+            scopes=token['scopes'],
+        )
+        creds.expiry = datetime.fromisoformat(token['expiry'])
+
+    if not creds or not creds.valid:
+        # don't forget to dump one more time after the refresh
+        # also, some file-locking routines wouldn't be needless
+        if creds and creds.expired and creds.refresh_token:
+            creds.refresh(Request())
+        else:
+            cred_file = os.path.join(CONFIG_DIR, 'gmail.json')
+            if not os.path.exists(cred_file):
+                raise Exception(_("Found no valid gmail.json file with OAuth information"))
+            flow = InstalledAppFlow.from_client_secrets_file(
+                os.path.join(CONFIG_DIR, 'gmail.json'), SCOPES)
+            creds = flow.run_local_server(port=0)
+            user_info = get_user_info(creds)
+        return {
+            'token': creds.token,
+            'refresh_token': creds.refresh_token,
+            'token_uri': creds.token_uri,
+            'client_id': creds.client_id,
+            'client_secret': creds.client_secret,
+            'scopes': creds.scopes,
+            'expiry': creds.expiry.isoformat(),
+            'email': user_info
+        }
+    return {}
+
+def get_user_info(credentials):
+    user_info_service = build(serviceName='oauth2', version='v2',credentials=credentials)
+    user_info = user_info_service.userinfo().get().execute()
+    return user_info.get('email', "")
+
+def send_messsage(token, msg):
+    log.debug("Start sending e-mail via Gmail")
+    creds = Credentials(
+        token=token['token'],
+        refresh_token=token['refresh_token'],
+        token_uri=token['token_uri'],
+        client_id=token['client_id'],
+        client_secret=token['client_secret'],
+        scopes=token['scopes'],
+    )
+    creds.expiry = datetime.fromisoformat(token['expiry'])
+    if creds and creds.expired and creds.refresh_token:
+        creds.refresh(Request())
+    service = build('gmail', 'v1', credentials=creds)
+    message_as_bytes = msg.as_bytes()  # the message should be converted from string to bytes.
+    message_as_base64 = base64.urlsafe_b64encode(message_as_bytes)  # encode in base64 (printable letters coding)
+    raw = message_as_base64.decode()  # convert to something  JSON serializable
+    body = {'raw': raw}
+
+    (service.users().messages().send(userId='me', body=body).execute())
+    log.debug("E-mail send successfully via Gmail")
@@ -16,19 +16,88 @@
 #  You should have received a copy of the GNU General Public License
 #  along with this program. If not, see <http://www.gnu.org/licenses/>.

-from __future__ import division, print_function, unicode_literals
 import time
 from functools import reduce
+import requests
+
+from goodreads.client import GoodreadsClient
+from goodreads.request import GoodreadsRequest
+from lxml import etree

 try:
-    from goodreads.client import GoodreadsClient
+    import Levenshtein
 except ImportError:
-    from betterreads.client import GoodreadsClient
-
-try: import Levenshtein
-except ImportError: Levenshtein = False
+    Levenshtein = False

 from .. import logger
+from ..clean_html import clean_string
+
+
+
+
+def etree_to_dict(t):
+    """
+    Convert lxml ElementTree to a nested dict (similar to xmltodict).
+    """
+    d = {t.tag: {} if t.attrib else None}
+    children = list(t)
+
+    if children:
+        dd = {}
+        for dc in map(etree_to_dict, children):
+            for k, v in dc.items():
+                if k in dd:
+                    if not isinstance(dd[k], list):
+                        dd[k] = [dd[k]]
+                    dd[k].append(v)
+                else:
+                    dd[k] = v
+        d = {t.tag: dd}
+
+    if t.attrib:
+        d[t.tag].update(('@' + k, v) for k, v in t.attrib.items())
+
+    text = (t.text or '').strip()
+    if text:
+        if children or t.attrib:
+            d[t.tag]['#text'] = text
+        else:
+            d[t.tag] = text
+
+    return d
+
+class my_GoodreadsClient(GoodreadsClient):
+
+    def request(self, *args, **kwargs):
+        """Create a GoodreadsRequest object and make that request"""
+        req = my_GoodreadsRequest(self, *args, **kwargs)
+        return req.request()
+
+
+class GoodreadsRequestException(Exception):
+    def __init__(self, error_msg, url):
+        self.error_msg = error_msg
+        self.url = url
+
+    def __str__(self):
+        return self.url, ':', self.error_msg
+
+
+class my_GoodreadsRequest(GoodreadsRequest):
+
+    def request(self):
+        resp = requests.get(self.host+self.path, params=self.params,
+                            headers={"User-Agent": "Mozilla/5.0 (X11; Linux x86_64; rv:125.0) "
+                                                   "Gecko/20100101 Firefox/125.0"})
+        if resp.status_code != 200:
+            raise GoodreadsRequestException(resp.reason, self.path)
+        if self.req_format == 'xml':
+            root = etree.fromstring(resp.content, parser=etree.XMLParser(resolve_entities=False, no_network=True))
+            data_dict = etree_to_dict(root)
+
+            return data_dict['GoodreadsResponse']
+        else:
+            raise Exception("Invalid format")


 log = logger.create()
@@ -39,20 +108,20 @@ _CACHE_TIMEOUT = 23 * 60 * 60  # 23 hours (in seconds)
 _AUTHORS_CACHE = {}


-def connect(key=None, secret=None, enabled=True):
+def connect(key=None, enabled=True):
    global _client

-    if not enabled or not key or not secret:
+    if not enabled or not key:
        _client = None
        return

    if _client:
        # make sure the configuration has not changed since last we used the client
-        if _client.client_key != key or _client.client_secret != secret:
+        if _client.client_key != key:
            _client = None

    if not _client:
-        _client = GoodreadsClient(key, secret)
+        _client = my_GoodreadsClient(key, None)


 def get_author_info(author_name):
@@ -77,12 +146,13 @@ def get_author_info(author_name):

    if author_info:
        author_info._timestamp = now
+        author_info.safe_about = clean_string(author_info.about)
        _AUTHORS_CACHE[author_name] = author_info
    return author_info


 def get_other_books(author_info, library_books=None):
-    # Get all identifiers (ISBN, Goodreads, etc) and filter author's books by that list so we show fewer duplicates
+    # Get all identifiers (ISBN, Goodreads, etc.) and filter author's books by that list so we show fewer duplicates
    # Note: Not all images will be shown, even though they're available on Goodreads.com.
    #       See https://www.goodreads.com/topic/show/18213769-goodreads-book-images

@@ -92,7 +162,8 @@ def get_other_books(author_info, library_books=None):
    identifiers = []
    library_titles = []
    if library_books:
-        identifiers = list(reduce(lambda acc, book: acc + [i.val for i in book.identifiers if i.val], library_books, []))
+        identifiers = list(
+            reduce(lambda acc, book: acc + [i.val for i in book.identifiers if i.val], library_books, []))
        library_titles = [book.title for book in library_books]

    for book in author_info.books:
@@ -16,11 +16,11 @@
 #  You should have received a copy of the GNU General Public License
 #  along with this program. If not, see <http://www.gnu.org/licenses/>.

-from __future__ import division, print_function, unicode_literals
 import base64

 from flask_simpleldap import LDAP, LDAPException
 from flask_simpleldap import ldap as pyLDAP
+from flask import current_app
 from .. import constants, logger

 try:
@@ -29,7 +29,59 @@ except ImportError:
    pass

 log = logger.create()
-_ldap = LDAP()
+
+
+def _escape_ldap_filter(s):
+    """Escape special characters for safe use in LDAP filter strings (RFC 4515)."""
+    s = s.replace('\\', '\\5c')
+    s = s.replace('*', '\\2a')
+    s = s.replace('(', '\\28')
+    s = s.replace(')', '\\29')
+    s = s.replace('\x00', '\\00')
+    return s
+
+
+class LDAPLogger(object):
+
+    @staticmethod
+    def write(message):
+        try:
+            log.debug(message.strip("\n").replace("\n", ""))
+        except Exception:
+            log.debug("Logging Error")
+
+
+class mySimpleLDap(LDAP):
+
+    @staticmethod
+    def init_app(app):
+        super(mySimpleLDap, mySimpleLDap).init_app(app)
+        app.config.setdefault('LDAP_LOGLEVEL', 0)
+
+    @property
+    def initialize(self):
+        """Initialize a connection to the LDAP server.
+
+        :return: LDAP connection object.
+        """
+        try:
+            log_level = 2 if current_app.config['LDAP_LOGLEVEL'] == logger.logging.DEBUG else 0
+            conn = pyLDAP.initialize('{0}://{1}:{2}'.format(
+                current_app.config['LDAP_SCHEMA'],
+                current_app.config['LDAP_HOST'],
+                current_app.config['LDAP_PORT']), trace_level=log_level, trace_file=LDAPLogger())
+            conn.set_option(pyLDAP.OPT_NETWORK_TIMEOUT,
+                            current_app.config['LDAP_TIMEOUT'])
+            conn = self._set_custom_options(conn)
+            conn.protocol_version = pyLDAP.VERSION3
+            if current_app.config['LDAP_USE_TLS']:
+                conn.start_tls_s()
+            return conn
+        except pyLDAP.LDAPError as e:
+            raise LDAPException(self.error(e.args))
+
+
+_ldap = mySimpleLDap()


 def init_app(app, config):
@@ -45,15 +97,15 @@ def init_app(app, config):
        app.config['LDAP_SCHEMA'] = 'ldap'
    if config.config_ldap_authentication > constants.LDAP_AUTH_ANONYMOUS:
        if config.config_ldap_authentication > constants.LDAP_AUTH_UNAUTHENTICATE:
-            if config.config_ldap_serv_password is None:
-                config.config_ldap_serv_password = ''
-            app.config['LDAP_PASSWORD'] = base64.b64decode(config.config_ldap_serv_password)
+            if config.config_ldap_serv_password_e is None:
+                config.config_ldap_serv_password_e = ''
+            app.config['LDAP_PASSWORD'] = config.config_ldap_serv_password_e
        else:
-            app.config['LDAP_PASSWORD'] = base64.b64decode("")
+            app.config['LDAP_PASSWORD'] = ""
        app.config['LDAP_USERNAME'] = config.config_ldap_serv_username
    else:
        app.config['LDAP_USERNAME'] = ""
-        app.config['LDAP_PASSWORD'] = base64.b64decode("")
+        app.config['LDAP_PASSWORD'] = ""
    if bool(config.config_ldap_cert_path):
        app.config['LDAP_CUSTOM_OPTIONS'].update({
            pyLDAP.OPT_X_TLS_REQUIRE_CERT: pyLDAP.OPT_X_TLS_DEMAND,
@@ -71,7 +123,7 @@ def init_app(app, config):
    app.config['LDAP_OPENLDAP'] = bool(config.config_ldap_openldap)
    app.config['LDAP_GROUP_OBJECT_FILTER'] = config.config_ldap_group_object_filter
    app.config['LDAP_GROUP_MEMBERS_FIELD'] = config.config_ldap_group_members_field
-
+    app.config['LDAP_LOGLEVEL'] = config.config_log_level
    try:
        _ldap.init_app(app)
    except ValueError:
@@ -85,7 +137,7 @@ def init_app(app, config):
        log.error(e)


-def get_object_details(user=None,query_filter=None):
+def get_object_details(user=None, query_filter=None):
    return _ldap.get_object_details(user, query_filter=query_filter)


@@ -106,9 +158,11 @@ def bind_user(username, password):

    :returns: True if login succeeded, False if login failed, None if server unavailable.
    '''
+    # Escape LDAP special characters to prevent LDAP injection in search filters
+    safe_username = _escape_ldap_filter(username)
    try:
-        if _ldap.get_object_details(username):
-            result = _ldap.bind_user(username, password)
+        if _ldap.get_object_details(safe_username):
+            result = _ldap.bind_user(safe_username, password)
            log.debug("LDAP login '%s': %r", username, result)
            return result is not None, None
        return None, None       # User not found
@@ -1,5 +1,21 @@
+# -*- coding: utf-8 -*-
+
+#  This file is part of the Calibre-Web (https://github.com/janeczku/calibre-web)
+#    Copyright (C) 2020 pwr
+#
+#  This program is free software: you can redistribute it and/or modify
+#  it under the terms of the GNU General Public License as published by
+#  the Free Software Foundation, either version 3 of the License, or
+#  (at your option) any later version.
+#
+#  This program is distributed in the hope that it will be useful,
+#  but WITHOUT ANY WARRANTY; without even the implied warranty of
+#  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+#  GNU General Public License for more details.
+#
+#  You should have received a copy of the GNU General Public License
+#  along with this program. If not, see <http://www.gnu.org/licenses/>.

-from __future__ import division, print_function, unicode_literals
 import threading
 import abc
 import uuid
@@ -21,11 +37,13 @@ STAT_WAITING = 0
 STAT_FAIL = 1
 STAT_STARTED = 2
 STAT_FINISH_SUCCESS = 3
+STAT_ENDED = 4
+STAT_CANCELLED = 5

 # Only retain this many tasks in dequeued list
 TASK_CLEANUP_TRIGGER = 20

-QueuedTask = namedtuple('QueuedTask', 'num, user, added, task')
+QueuedTask = namedtuple('QueuedTask', 'num, user, added, task, hidden')


 def _get_main_thread():
@@ -35,7 +53,6 @@ def _get_main_thread():
    raise Exception("main thread not found?!")


-
 class ImprovedQueue(queue.Queue):
    def to_list(self):
        """
@@ -45,12 +62,13 @@ class ImprovedQueue(queue.Queue):
        with self.mutex:
            return list(self.queue)

-#Class for all worker tasks in the background
+
+# Class for all worker tasks in the background
 class WorkerThread(threading.Thread):
    _instance = None

    @classmethod
-    def getInstance(cls):
+    def get_instance(cls):
        if cls._instance is None:
            cls._instance = WorkerThread()
        return cls._instance
@@ -66,14 +84,17 @@ class WorkerThread(threading.Thread):
        self.start()

    @classmethod
-    def add(cls, user, task):
-        ins = cls.getInstance()
+    def add(cls, user, task, hidden=False):
+        ins = cls.get_instance()
        ins.num += 1
+        username = user if user is not None else 'System'
+        log.debug("Add Task for user: {} - {}".format(username, task))
        ins.queue.put(QueuedTask(
            num=ins.num,
-            user=user,
+            user=username,
            added=datetime.now(),
            task=task,
+            hidden=hidden
        ))

    @property
@@ -94,10 +115,10 @@ class WorkerThread(threading.Thread):
            if delta > TASK_CLEANUP_TRIGGER:
                ret = alive
            else:
-                # otherwise, lop off the oldest dead tasks until we hit the target trigger
-                ret = sorted(dead, key=lambda x: x.task.end_time)[-TASK_CLEANUP_TRIGGER:] + alive
+                # otherwise, loop off the oldest dead tasks until we hit the target trigger
+                ret = sorted(dead, key=lambda y: y.task.end_time)[-TASK_CLEANUP_TRIGGER:] + alive

-            self.dequeued = sorted(ret, key=lambda x: x.num)
+            self.dequeued = sorted(ret, key=lambda y: y.num)

    # Main thread loop starting the different tasks
    def run(self):
@@ -124,11 +145,21 @@ class WorkerThread(threading.Thread):

            # sometimes tasks (like Upload) don't actually have work to do and are created as already finished
            if item.task.stat is STAT_WAITING:
-                # CalibreTask.start() should wrap all exceptions in it's own error handling
+                # CalibreTask.start() should wrap all exceptions in its own error handling
                item.task.start(self)

+            # remove self_cleanup tasks and hidden "System Tasks" from list
+            if item.task.self_cleanup or item.hidden:
+                self.dequeued.remove(item)
+
            self.queue.task_done()

+    def end_task(self, task_id):
+        ins = self.get_instance()
+        for __, __, __, task, __ in ins.tasks:
+            if str(task.id) == str(task_id) and task.is_cancellable:
+                task.stat = STAT_CANCELLED if task.stat == STAT_WAITING else STAT_ENDED
+

 class CalibreTask:
    __metaclass__ = abc.ABCMeta
@@ -141,10 +172,12 @@ class CalibreTask:
        self.end_time = None
        self.message = message
        self.id = uuid.uuid4()
+        self.self_cleanup = False
+        self._scheduled = False

    @abc.abstractmethod
    def run(self, worker_thread):
-        """Provides the caller some human-readable name for this class"""
+        """The main entry-point for this task"""
        raise NotImplementedError

    @abc.abstractmethod
@@ -152,6 +185,11 @@ class CalibreTask:
        """Provides the caller some human-readable name for this class"""
        raise NotImplementedError

+    @abc.abstractmethod
+    def is_cancellable(self):
+        """Does this task gracefully handle being cancelled (STAT_ENDED, STAT_CANCELLED)?"""
+        raise NotImplementedError
+
    def start(self, *args):
        self.start_time = datetime.now()
        self.stat = STAT_STARTED
@@ -159,9 +197,9 @@ class CalibreTask:
        # catch any unhandled exceptions in a task and automatically fail it
        try:
            self.run(*args)
-        except Exception as e:
-            self._handleError(str(e))
-            log.debug_or_exception(e)
+        except Exception as ex:
+            self._handleError(str(ex))
+            log.exception(ex)

        self.end_time = datetime.now()

@@ -202,12 +240,23 @@ class CalibreTask:
        We have a separate dictating this because there may be certain tasks that want to override this
        """
        # By default, we're good to clean a task if it's "Done"
-        return self.stat in (STAT_FINISH_SUCCESS, STAT_FAIL)
+        return self.stat in (STAT_FINISH_SUCCESS, STAT_FAIL, STAT_ENDED, STAT_CANCELLED)

-    @progress.setter
-    def progress(self, x):
-        # todo: throw error if outside of [0,1]
-        self._progress = x
+    @property
+    def self_cleanup(self):
+        return self._self_cleanup
+
+    @self_cleanup.setter
+    def self_cleanup(self, is_self_cleanup):
+        self._self_cleanup = is_self_cleanup
+
+    @property
+    def scheduled(self):
+        return self._scheduled
+
+    @scheduled.setter
+    def scheduled(self, is_scheduled):
+        self._scheduled = is_scheduled

    def _handleError(self, error_message):
        self.stat = STAT_FAIL
@@ -217,3 +266,6 @@ class CalibreTask:
    def _handleSuccess(self):
        self.stat = STAT_FINISH_SUCCESS
        self.progress = 1
+
+    def __str__(self):
+        return self.name
@@ -20,69 +20,48 @@
 #  You should have received a copy of the GNU General Public License
 #  along with this program. If not, see <http://www.gnu.org/licenses/>.

-from __future__ import division, print_function, unicode_literals
-from datetime import datetime
 import sys
+from datetime import datetime, timezone

-from flask import Blueprint, request, flash, redirect, url_for
+from flask import Blueprint, flash, redirect, request, url_for, abort
 from flask_babel import gettext as _
-from flask_login import login_required, current_user
+from .cw_login import current_user
+from sqlalchemy.exc import InvalidRequestError, OperationalError
 from sqlalchemy.sql.expression import func, true
-from sqlalchemy.exc import OperationalError, InvalidRequestError

-from . import logger, ub, calibre_db, db
+from . import calibre_db, config, db, logger, ub
 from .render_template import render_title_template
-from .usermanagement import login_required_if_no_ano
+from .usermanagement import login_required_if_no_ano, user_login_required

-
-shelf = Blueprint('shelf', __name__)
 log = logger.create()

-
-def check_shelf_edit_permissions(cur_shelf):
-    if not cur_shelf.is_public and not cur_shelf.user_id == int(current_user.id):
-        log.error("User %s not allowed to edit shelf %s", current_user, cur_shelf)
-        return False
-    if cur_shelf.is_public and not current_user.role_edit_shelfs():
-        log.info("User %s not allowed to edit public shelves", current_user)
-        return False
-    return True
+shelf = Blueprint('shelf', __name__)


-def check_shelf_view_permissions(cur_shelf):
-    if cur_shelf.is_public:
-        return True
-    if current_user.is_anonymous or cur_shelf.user_id != current_user.id:
-        log.error("User is unauthorized to view non-public shelf: %s", cur_shelf)
-        return False
-    return True
-
-
-@shelf.route("/shelf/add/<int:shelf_id>/<int:book_id>")
-@login_required
+@shelf.route("/shelf/add/<int:shelf_id>/<int:book_id>", methods=["POST"])
+@user_login_required
 def add_to_shelf(shelf_id, book_id):
    xhr = request.headers.get('X-Requested-With') == 'XMLHttpRequest'
    shelf = ub.session.query(ub.Shelf).filter(ub.Shelf.id == shelf_id).first()
    if shelf is None:
        log.error("Invalid shelf specified: %s", shelf_id)
        if not xhr:
-            flash(_(u"Invalid shelf specified"), category="error")
+            flash(_("Invalid shelf specified"), category="error")
            return redirect(url_for('web.index'))
        return "Invalid shelf specified", 400

    if not check_shelf_edit_permissions(shelf):
        if not xhr:
-            flash(_(u"Sorry you are not allowed to add a book to the the shelf: %(shelfname)s", shelfname=shelf.name),
-                  category="error")
+            flash(_("Sorry you are not allowed to add a book to that shelf"), category="error")
            return redirect(url_for('web.index'))
-        return "Sorry you are not allowed to add a book to the the shelf: %s" % shelf.name, 403
+        return "Sorry you are not allowed to add a book to the that shelf", 403

    book_in_shelf = ub.session.query(ub.BookShelf).filter(ub.BookShelf.shelf == shelf_id,
                                                          ub.BookShelf.book_id == book_id).first()
    if book_in_shelf:
        log.error("Book %s is already part of %s", book_id, shelf)
        if not xhr:
-            flash(_(u"Book is already part of the shelf: %(shelfname)s", shelfname=shelf.name), category="error")
+            flash(_("Book is already part of the shelf: %(shelfname)s", shelfname=shelf.name), category="error")
            return redirect(url_for('web.index'))
        return "Book is already part of the shelf: %s" % shelf.name, 400

@@ -92,20 +71,30 @@ def add_to_shelf(shelf_id, book_id):
    else:
        maxOrder = maxOrder[0]

+    if not calibre_db.session.query(db.Books).filter(db.Books.id == book_id).one_or_none():
+        log.error("Invalid Book Id: %s. Could not be added to shelf %s", book_id, shelf.name)
+        if not xhr:
+            flash(_("%(book_id)s is a invalid Book Id. Could not be added to Shelf", book_id=book_id),
+                  category="error")
+            return redirect(url_for('web.index'))
+        return "%s is a invalid Book Id. Could not be added to Shelf" % book_id, 400
+
    shelf.books.append(ub.BookShelf(shelf=shelf.id, book_id=book_id, order=maxOrder + 1))
-    shelf.last_modified = datetime.utcnow()
+    shelf.last_modified = datetime.now(timezone.utc)
    try:
        ub.session.merge(shelf)
        ub.session.commit()
-    except (OperationalError, InvalidRequestError):
+    except (OperationalError, InvalidRequestError) as e:
        ub.session.rollback()
-        flash(_(u"Settings DB is not Writeable"), category="error")
+        log.error_or_exception("Settings Database error: {}".format(e))
+        flash(_("Oops! Database Error: %(error)s.", error=e.orig), category="error")
        if "HTTP_REFERER" in request.environ:
            return redirect(request.environ["HTTP_REFERER"])
        else:
            return redirect(url_for('web.index'))
    if not xhr:
-        flash(_(u"Book has been added to shelf: %(sname)s", sname=shelf.name), category="success")
+        log.debug("Book has been added to shelf: {}".format(shelf.name))
+        flash(_("Book has been added to shelf: %(sname)s", sname=shelf.name), category="success")
        if "HTTP_REFERER" in request.environ:
            return redirect(request.environ["HTTP_REFERER"])
        else:
@@ -113,26 +102,71 @@ def add_to_shelf(shelf_id, book_id):
    return "", 204


-@shelf.route("/shelf/massadd/<int:shelf_id>")
-@login_required
-def search_to_shelf(shelf_id):
+@shelf.route("/shelf/massremove/<int:shelf_id>", methods=["POST"])
+@user_login_required
+def search_from_shelf(shelf_id):
    shelf = ub.session.query(ub.Shelf).filter(ub.Shelf.id == shelf_id).first()
    if shelf is None:
-        log.error("Invalid shelf specified: %s", shelf_id)
-        flash(_(u"Invalid shelf specified"), category="error")
+        log.error("Invalid shelf specified: {}".format(shelf_id))
+        flash(_("Invalid shelf specified"), category="error")
        return redirect(url_for('web.index'))

    if not check_shelf_edit_permissions(shelf):
-        flash(_(u"You are not allowed to add a book to the the shelf: %(name)s", name=shelf.name), category="error")
+        log.warning("You are not allowed to remove a book from the shelf".format(shelf.name))
+        flash(_("You are not allowed to remove a book from the shelf"), category="error")
+        return redirect(url_for('web.index'))
+
+    if current_user.id in ub.searched_ids and ub.searched_ids[current_user.id]:
+        books_from_shelf = list()
+        books_in_shelf = ub.session.query(ub.BookShelf).filter(ub.BookShelf.shelf == shelf_id).all()
+        if books_in_shelf:
+            book_ids = [book_id.book_id for book_id in books_in_shelf]
+            for searchid in ub.searched_ids[current_user.id]:
+                if searchid in book_ids:
+                    books_from_shelf.append(searchid)
+        else:
+            log.error("No Books are part of {}".format(shelf.name))
+            flash(_("No Books are part of the shelf: %(name)s", name=shelf.name), category="error")
+            return redirect(url_for('web.index'))
+
+        # maxOrder = ub.session.query(func.max(ub.BookShelf.order)).filter(ub.BookShelf.shelf == shelf_id).first()[0] or 0
+
+        for book in books_from_shelf:
+            ub.session.delete(ub.session.query(ub.BookShelf).filter(ub.BookShelf.shelf == shelf_id).filter(
+                ub.BookShelf.book_id == book).first())
+        shelf.last_modified = datetime.now(timezone.utc)
+        try:
+            ub.session.commit()
+            flash(_("Books have been removed from shelf: %(sname)s", sname=shelf.name), category="success")
+        except (OperationalError, InvalidRequestError) as e:
+            ub.session.rollback()
+            log.error_or_exception("Settings Database error: {}".format(e))
+            flash(_("Oops! Database Error: %(error)s.", error=e.orig), category="error")
+    else:
+        log.error("Could not remove books from shelf: {}".format(shelf.name))
+        flash(_("Could not remove books from shelf: %(sname)s", sname=shelf.name), category="error")
+    return redirect(url_for('web.index'))
+
+
+@shelf.route("/shelf/massadd/<int:shelf_id>", methods=["POST"])
+@user_login_required
+def search_to_shelf(shelf_id):
+    shelf = ub.session.query(ub.Shelf).filter(ub.Shelf.id == shelf_id).first()
+    if shelf is None:
+        log.error("Invalid shelf specified: {}".format(shelf_id))
+        flash(_("Invalid shelf specified"), category="error")
+        return redirect(url_for('web.index'))
+
+    if not check_shelf_edit_permissions(shelf):
+        log.warning("You are not allowed to add a book to the shelf".format(shelf.name))
+        flash(_("You are not allowed to add a book to the shelf"), category="error")
        return redirect(url_for('web.index'))

    if current_user.id in ub.searched_ids and ub.searched_ids[current_user.id]:
        books_for_shelf = list()
        books_in_shelf = ub.session.query(ub.BookShelf).filter(ub.BookShelf.shelf == shelf_id).all()
        if books_in_shelf:
-            book_ids = list()
-            for book_id in books_in_shelf:
-                book_ids.append(book_id.book_id)
+            book_ids = [book_id.book_id for book_id in books_in_shelf]
            for searchid in ub.searched_ids[current_user.id]:
                if searchid not in book_ids:
                    books_for_shelf.append(searchid)
@@ -140,8 +174,8 @@ def search_to_shelf(shelf_id):
            books_for_shelf = ub.searched_ids[current_user.id]

        if not books_for_shelf:
-            log.error("Books are already part of %s", shelf.name)
-            flash(_(u"Books are already part of the shelf: %(name)s", name=shelf.name), category="error")
+            log.error("Books are already part of {}".format(shelf.name))
+            flash(_("Books are already part of the shelf: %(name)s", name=shelf.name), category="error")
            return redirect(url_for('web.index'))

        maxOrder = ub.session.query(func.max(ub.BookShelf.order)).filter(ub.BookShelf.shelf == shelf_id).first()[0] or 0
@@ -149,26 +183,28 @@ def search_to_shelf(shelf_id):
        for book in books_for_shelf:
            maxOrder += 1
            shelf.books.append(ub.BookShelf(shelf=shelf.id, book_id=book, order=maxOrder))
-        shelf.last_modified = datetime.utcnow()
+        shelf.last_modified = datetime.now(timezone.utc)
        try:
            ub.session.merge(shelf)
            ub.session.commit()
-            flash(_(u"Books have been added to shelf: %(sname)s", sname=shelf.name), category="success")
-        except (OperationalError, InvalidRequestError):
+            flash(_("Books have been added to shelf: %(sname)s", sname=shelf.name), category="success")
+        except (OperationalError, InvalidRequestError) as e:
            ub.session.rollback()
-            flash(_(u"Settings DB is not Writeable"), category="error")
+            log.error_or_exception("Settings Database error: {}".format(e))
+            flash(_("Oops! Database Error: %(error)s.", error=e.orig), category="error")
    else:
-        flash(_(u"Could not add books to shelf: %(sname)s", sname=shelf.name), category="error")
+        log.error("Could not add books to shelf: {}".format(shelf.name))
+        flash(_("Could not add books to shelf: %(sname)s", sname=shelf.name), category="error")
    return redirect(url_for('web.index'))


-@shelf.route("/shelf/remove/<int:shelf_id>/<int:book_id>")
-@login_required
+@shelf.route("/shelf/remove/<int:shelf_id>/<int:book_id>", methods=["POST"])
+@user_login_required
 def remove_from_shelf(shelf_id, book_id):
    xhr = request.headers.get('X-Requested-With') == 'XMLHttpRequest'
    shelf = ub.session.query(ub.Shelf).filter(ub.Shelf.id == shelf_id).first()
    if shelf is None:
-        log.error("Invalid shelf specified: %s", shelf_id)
+        log.error("Invalid shelf specified: {}".format(shelf_id))
        if not xhr:
            return redirect(url_for('web.index'))
        return "Invalid shelf specified", 400
@@ -193,17 +229,18 @@ def remove_from_shelf(shelf_id, book_id):

        try:
            ub.session.delete(book_shelf)
-            shelf.last_modified = datetime.utcnow()
+            shelf.last_modified = datetime.now(timezone.utc)
            ub.session.commit()
-        except (OperationalError, InvalidRequestError):
+        except (OperationalError, InvalidRequestError) as e:
            ub.session.rollback()
-            flash(_(u"Settings DB is not Writeable"), category="error")
+            log.error_or_exception("Settings Database error: {}".format(e))
+            flash(_("Oops! Database Error: %(error)s.", error=e.orig), category="error")
            if "HTTP_REFERER" in request.environ:
                return redirect(request.environ["HTTP_REFERER"])
            else:
                return redirect(url_for('web.index'))
        if not xhr:
-            flash(_(u"Book has been removed from shelf: %(sname)s", sname=shelf.name), category="success")
+            flash(_("Book has been removed from shelf: %(sname)s", sname=shelf.name), category="success")
            if "HTTP_REFERER" in request.environ:
                return redirect(request.environ["HTTP_REFERER"])
            else:
@@ -211,107 +248,43 @@ def remove_from_shelf(shelf_id, book_id):
        return "", 204
    else:
        if not xhr:
-            flash(_(u"Sorry you are not allowed to remove a book from this shelf: %(sname)s", sname=shelf.name),
+            log.warning("You are not allowed to remove a book from shelf: {}".format(shelf.name))
+            flash(_("Sorry you are not allowed to remove a book from this shelf"),
                  category="error")
            return redirect(url_for('web.index'))
-        return "Sorry you are not allowed to remove a book from this shelf: %s" % shelf.name, 403
+        return "Sorry you are not allowed to remove a book from this shelf", 403


@shelf.route("/shelf/create", methods=["GET", "POST"])
-@login_required
+@user_login_required
 def create_shelf():
    shelf = ub.Shelf()
-    return create_edit_shelf(shelf, title=_(u"Create a Shelf"), page="shelfcreate")
+    return create_edit_shelf(shelf, page_title=_("Create a Shelf"), page="shelfcreate")


@shelf.route("/shelf/edit/<int:shelf_id>", methods=["GET", "POST"])
-@login_required
+@user_login_required
 def edit_shelf(shelf_id):
    shelf = ub.session.query(ub.Shelf).filter(ub.Shelf.id == shelf_id).first()
-    return create_edit_shelf(shelf, title=_(u"Edit a shelf"), page="shelfedit", shelf_id=shelf_id)
+    if not check_shelf_edit_permissions(shelf):
+        flash(_("Sorry you are not allowed to edit this shelf"), category="error")
+        return redirect(url_for('web.index'))
+    return create_edit_shelf(shelf, page_title=_("Edit a shelf"), page="shelfedit", shelf_id=shelf_id)


-# if shelf ID is set, we are editing a shelf
-def create_edit_shelf(shelf, title, page, shelf_id=False):
-    if request.method == "POST":
-        to_save = request.form.to_dict()
-        if "is_public" in to_save:
-            shelf.is_public = 1
-        else:
-            shelf.is_public = 0
-        if check_shelf_is_unique(shelf, to_save, shelf_id):
-            shelf.name = to_save["title"]
-            # shelf.last_modified = datetime.utcnow()
-            if not shelf_id:
-                shelf.user_id = int(current_user.id)
-                ub.session.add(shelf)
-                shelf_action = "created"
-                flash_text = _(u"Shelf %(title)s created", title=to_save["title"])
-            else:
-                shelf_action = "changed"
-                flash_text = _(u"Shelf %(title)s changed", title=to_save["title"])
-            try:
-                ub.session.commit()
-                log.info(u"Shelf {} {}".format(to_save["title"], shelf_action))
-                flash(flash_text, category="success")
-                return redirect(url_for('shelf.show_shelf', shelf_id=shelf.id))
-            except (OperationalError, InvalidRequestError) as e:
-                ub.session.rollback()
-                log.debug_or_exception(e)
-                flash(_(u"Settings DB is not Writeable"), category="error")
-            except Exception as e:
-                ub.session.rollback()
-                log.debug_or_exception(e)
-                flash(_(u"There was an error"), category="error")
-    return render_title_template('shelf_edit.html', shelf=shelf, title=title, page=page)
-
-
-def check_shelf_is_unique(shelf, to_save, shelf_id=False):
-    if shelf_id:
-        ident = ub.Shelf.id != shelf_id
-    else:
-        ident = true()
-    if shelf.is_public == 1:
-        is_shelf_name_unique = ub.session.query(ub.Shelf) \
-                                   .filter((ub.Shelf.name == to_save["title"]) & (ub.Shelf.is_public == 1)) \
-                                   .filter(ident) \
-                                   .first() is None
-
-        if not is_shelf_name_unique:
-            flash(_(u"A public shelf with the name '%(title)s' already exists.", title=to_save["title"]),
-                  category="error")
-    else:
-        is_shelf_name_unique = ub.session.query(ub.Shelf) \
-                                   .filter((ub.Shelf.name == to_save["title"]) & (ub.Shelf.is_public == 0) &
-                                           (ub.Shelf.user_id == int(current_user.id))) \
-                                   .filter(ident) \
-                                   .first() is None
-
-        if not is_shelf_name_unique:
-            flash(_(u"A private shelf with the name '%(title)s' already exists.", title=to_save["title"]),
-                  category="error")
-    return is_shelf_name_unique
-
-
-def delete_shelf_helper(cur_shelf):
-    if not cur_shelf or not check_shelf_edit_permissions(cur_shelf):
-        return
-    shelf_id = cur_shelf.id
-    ub.session.delete(cur_shelf)
-    ub.session.query(ub.BookShelf).filter(ub.BookShelf.shelf == shelf_id).delete()
-    ub.session.add(ub.ShelfArchive(uuid=cur_shelf.uuid, user_id=cur_shelf.user_id))
-    ub.session_commit("successfully deleted Shelf {}".format(cur_shelf.name))
-
-
-@shelf.route("/shelf/delete/<int:shelf_id>")
-@login_required
+@shelf.route("/shelf/delete/<int:shelf_id>", methods=["POST"])
+@user_login_required
 def delete_shelf(shelf_id):
    cur_shelf = ub.session.query(ub.Shelf).filter(ub.Shelf.id == shelf_id).first()
    try:
-        delete_shelf_helper(cur_shelf)
-    except InvalidRequestError:
+        if not delete_shelf_helper(cur_shelf):
+            flash(_("Error deleting Shelf"), category="error")
+        else:
+            flash(_("Shelf successfully deleted"), category="success")
+    except InvalidRequestError as e:
        ub.session.rollback()
-        flash(_(u"Settings DB is not Writeable"), category="error")
+        log.error_or_exception("Settings Database error: {}".format(e))
+        flash(_("Oops! Database Error: %(error)s.", error=e.orig), category="error")
    return redirect(url_for('web.index'))


@@ -321,7 +294,7 @@ def show_simpleshelf(shelf_id):
    return render_show_shelf(2, shelf_id, 1, None)


-@shelf.route("/shelf/<int:shelf_id>", defaults={"sort_param": "order", 'page': 1})
+@shelf.route("/shelf/<int:shelf_id>", defaults={"sort_param": "stored", 'page': 1})
@shelf.route("/shelf/<int:shelf_id>/<sort_param>", defaults={'page': 1})
@shelf.route("/shelf/<int:shelf_id>/<sort_param>/<int:page>")
@login_required_if_no_ano
@@ -330,37 +303,158 @@ def show_shelf(shelf_id, sort_param, page):


@shelf.route("/shelf/order/<int:shelf_id>", methods=["GET", "POST"])
-@login_required
+@user_login_required
 def order_shelf(shelf_id):
+    shelf = ub.session.query(ub.Shelf).filter(ub.Shelf.id == shelf_id).first()
+    if shelf and check_shelf_view_permissions(shelf):
+        if request.method == "POST":
+            if not check_shelf_edit_permissions(shelf):
+                flash(_("Sorry you are not allowed to edit this shelf"), category="error")
+                return redirect(url_for('web.index'))
+            to_save = request.form.to_dict()
+            books_in_shelf = ub.session.query(ub.BookShelf).filter(ub.BookShelf.shelf == shelf_id).order_by(
+                ub.BookShelf.order.asc()).all()
+            counter = 0
+            for book in books_in_shelf:
+                setattr(book, 'order', to_save[str(book.book_id)])
+                counter += 1
+                # if order different from before -> shelf.last_modified = datetime.now(timezone.utc)
+            try:
+                ub.session.commit()
+            except (OperationalError, InvalidRequestError) as e:
+                ub.session.rollback()
+                log.error_or_exception("Settings Database error: {}".format(e))
+                flash(_("Oops! Database Error: %(error)s.", error=e.orig), category="error")
+
+        result = list()
+        if shelf:
+            result = calibre_db.session.query(db.Books) \
+                .join(ub.BookShelf, ub.BookShelf.book_id == db.Books.id, isouter=True) \
+                .add_columns(calibre_db.common_filters().label("visible")) \
+                .filter(ub.BookShelf.shelf == shelf_id).order_by(ub.BookShelf.order.asc()).all()
+        return render_title_template('shelf_order.html', entries=result,
+                                     title=_("Change order of Shelf: '%(name)s'", name=shelf.name),
+                                     shelf=shelf, page="shelforder")
+    else:
+        abort(404)
+
+
+def check_shelf_edit_permissions(cur_shelf):
+    if not cur_shelf.is_public and not cur_shelf.user_id == int(current_user.id):
+        log.error("User {} not allowed to edit shelf: {}".format(current_user.id, cur_shelf.name))
+        return False
+    if cur_shelf.is_public and not current_user.role_edit_shelfs():
+        log.info("User {} not allowed to edit public shelves".format(current_user.id))
+        return False
+    return True
+
+
+def check_shelf_view_permissions(cur_shelf):
+    try:
+        if cur_shelf.is_public:
+            return True
+        if current_user.is_anonymous or cur_shelf.user_id != current_user.id:
+            log.error("User is unauthorized to view non-public shelf: {}".format(cur_shelf.name))
+            return False
+    except Exception as e:
+        log.error(e)
+    return True
+
+
+# if shelf ID is set, we are editing a shelf
+def create_edit_shelf(shelf, page_title, page, shelf_id=False):
+    sync_only_selected_shelves = current_user.kobo_only_shelves_sync
+    # calibre_db.session.query(ub.Shelf).filter(ub.Shelf.user_id == current_user.id).filter(ub.Shelf.kobo_sync).count()
    if request.method == "POST":
        to_save = request.form.to_dict()
-        books_in_shelf = ub.session.query(ub.BookShelf).filter(ub.BookShelf.shelf == shelf_id).order_by(
-            ub.BookShelf.order.asc()).all()
-        counter = 0
-        for book in books_in_shelf:
-            setattr(book, 'order', to_save[str(book.book_id)])
-            counter += 1
-            # if order diffrent from before -> shelf.last_modified = datetime.utcnow()
-        try:
-            ub.session.commit()
-        except (OperationalError, InvalidRequestError):
-            ub.session.rollback()
-            flash(_(u"Settings DB is not Writeable"), category="error")
+        if not current_user.role_edit_shelfs() and to_save.get("is_public") == "on":
+            flash(_("Sorry you are not allowed to create a public shelf"), category="error")
+            return redirect(url_for('web.index'))
+        is_public = 1 if to_save.get("is_public") == "on" else 0
+        if config.config_kobo_sync:
+            shelf.kobo_sync = True if to_save.get("kobo_sync") else False
+            if shelf.kobo_sync:
+                ub.session.query(ub.ShelfArchive).filter(ub.ShelfArchive.user_id == current_user.id).filter(
+                    ub.ShelfArchive.uuid == shelf.uuid).delete()
+                ub.session_commit()
+        shelf_title = to_save.get("title", "")
+        if check_shelf_is_unique(shelf_title, is_public, shelf_id):
+            shelf.name = shelf_title
+            shelf.is_public = is_public
+            if not shelf_id:
+                shelf.user_id = int(current_user.id)
+                ub.session.add(shelf)
+                shelf_action = "created"
+                flash_text = _("Shelf %(title)s created", title=shelf_title)
+            else:
+                shelf_action = "changed"
+                flash_text = _("Shelf %(title)s changed", title=shelf_title)
+            try:
+                ub.session.commit()
+                log.info("Shelf {} {}".format(shelf_title, shelf_action))
+                flash(flash_text, category="success")
+                return redirect(url_for('shelf.show_shelf', shelf_id=shelf.id))
+            except (OperationalError, InvalidRequestError) as ex:
+                ub.session.rollback()
+                log.error_or_exception(ex)
+                log.error_or_exception("Settings Database error: {}".format(ex))
+                flash(_("Oops! Database Error: %(error)s.", error=ex.orig), category="error")
+            except Exception as ex:
+                ub.session.rollback()
+                log.error_or_exception(ex)
+                flash(_("There was an error"), category="error")
+    return render_title_template('shelf_edit.html',
+                                 shelf=shelf,
+                                 title=page_title,
+                                 page=page,
+                                 kobo_sync_enabled=config.config_kobo_sync,
+                                 sync_only_selected_shelves=sync_only_selected_shelves)

-    shelf = ub.session.query(ub.Shelf).filter(ub.Shelf.id == shelf_id).first()
-    result = list()
-    if shelf and check_shelf_view_permissions(shelf):
-        result = calibre_db.session.query(db.Books)\
-            .join(ub.BookShelf,ub.BookShelf.book_id == db.Books.id , isouter=True) \
-            .add_columns(calibre_db.common_filters().label("visible")) \
-            .filter(ub.BookShelf.shelf == shelf_id).order_by(ub.BookShelf.order.asc()).all()
-    return render_title_template('shelf_order.html', entries=result,
-                                 title=_(u"Change order of Shelf: '%(name)s'", name=shelf.name),
-                                 shelf=shelf, page="shelforder")
+
+def check_shelf_is_unique(title, is_public, shelf_id=False):
+    if shelf_id:
+        ident = ub.Shelf.id != shelf_id
+    else:
+        ident = true()
+    if is_public == 1:
+        is_shelf_name_unique = ub.session.query(ub.Shelf) \
+                                   .filter((ub.Shelf.name == title) & (ub.Shelf.is_public == 1)) \
+                                   .filter(ident) \
+                                   .first() is None
+
+        if not is_shelf_name_unique:
+            log.error("A public shelf with the name '{}' already exists.".format(title))
+            flash(_("A public shelf with the name '%(title)s' already exists.", title=title),
+                  category="error")
+    else:
+        is_shelf_name_unique = ub.session.query(ub.Shelf) \
+                                   .filter((ub.Shelf.name == title) & (ub.Shelf.is_public == 0) &
+                                           (ub.Shelf.user_id == int(current_user.id))) \
+                                   .filter(ident) \
+                                   .first() is None
+
+        if not is_shelf_name_unique:
+            log.error("A private shelf with the name '{}' already exists.".format(title))
+            flash(_("A private shelf with the name '%(title)s' already exists.", title=title),
+                  category="error")
+    return is_shelf_name_unique
+
+
+def delete_shelf_helper(cur_shelf):
+    if not cur_shelf or not check_shelf_edit_permissions(cur_shelf):
+        return False
+    shelf_id = cur_shelf.id
+    ub.session.delete(cur_shelf)
+    ub.session.query(ub.BookShelf).filter(ub.BookShelf.shelf == shelf_id).delete()
+    ub.session.add(ub.ShelfArchive(uuid=cur_shelf.uuid, user_id=cur_shelf.user_id))
+    ub.session_commit("successfully deleted Shelf {}".format(cur_shelf.name))
+    return True


 def change_shelf_order(shelf_id, order):
-    result = calibre_db.session.query(db.Books).join(ub.BookShelf,ub.BookShelf.book_id == db.Books.id)\
+    result = calibre_db.session.query(db.Books).outerjoin(db.books_series_link,
+                                                          db.Books.id == db.books_series_link.c.book)\
+        .outerjoin(db.Series).join(ub.BookShelf, ub.BookShelf.book_id == db.Books.id) \
        .filter(ub.BookShelf.shelf == shelf_id).order_by(*order).all()
    for index, entry in enumerate(result):
        book = ub.session.query(ub.BookShelf).filter(ub.BookShelf.shelf == shelf_id) \
@@ -371,28 +465,37 @@ def change_shelf_order(shelf_id, order):

 def render_show_shelf(shelf_type, shelf_id, page_no, sort_param):
    shelf = ub.session.query(ub.Shelf).filter(ub.Shelf.id == shelf_id).first()
-
+    status = current_user.get_view_property("shelf", 'man')
    # check user is allowed to access shelf
    if shelf and check_shelf_view_permissions(shelf):
-
        if shelf_type == 1:
-            # order = [ub.BookShelf.order.asc()]
-            if sort_param == 'pubnew':
-                change_shelf_order(shelf_id, [db.Books.pubdate.desc()])
-            if sort_param == 'pubold':
-                change_shelf_order(shelf_id, [db.Books.pubdate])
-            if sort_param == 'abc':
-                change_shelf_order(shelf_id, [db.Books.sort])
-            if sort_param == 'zyx':
-                change_shelf_order(shelf_id, [db.Books.sort.desc()])
-            if sort_param == 'new':
-                change_shelf_order(shelf_id, [db.Books.timestamp.desc()])
-            if sort_param == 'old':
-                change_shelf_order(shelf_id, [db.Books.timestamp])
-            if sort_param == 'authaz':
-                change_shelf_order(shelf_id, [db.Books.author_sort.asc()])
-            if sort_param == 'authza':
-                change_shelf_order(shelf_id, [db.Books.author_sort.desc()])
+            if status != 'on':
+                if sort_param == 'stored':
+                    sort_param = current_user.get_view_property("shelf", 'stored')
+                else:
+                    current_user.set_view_property("shelf", 'stored', sort_param)
+                if sort_param == 'pubnew':
+                    change_shelf_order(shelf_id, [db.Books.pubdate.desc()])
+                if sort_param == 'pubold':
+                    change_shelf_order(shelf_id, [db.Books.pubdate])
+                if sort_param == 'shelfnew':
+                    change_shelf_order(shelf_id, [ub.BookShelf.date_added.desc()])
+                if sort_param == 'shelfold':
+                    change_shelf_order(shelf_id, [ub.BookShelf.date_added])
+                if sort_param == 'abc':
+                    change_shelf_order(shelf_id, [db.Books.sort])
+                if sort_param == 'zyx':
+                    change_shelf_order(shelf_id, [db.Books.sort.desc()])
+                if sort_param == 'new':
+                    change_shelf_order(shelf_id, [db.Books.timestamp.desc()])
+                if sort_param == 'old':
+                    change_shelf_order(shelf_id, [db.Books.timestamp])
+                if sort_param == 'authaz':
+                    change_shelf_order(shelf_id, [db.Books.author_sort.asc(), db.Series.name, db.Books.series_index])
+                if sort_param == 'authza':
+                    change_shelf_order(shelf_id, [db.Books.author_sort.desc(),
+                                                  db.Series.name.desc(),
+                                                  db.Books.series_index.desc()])
            page = "shelf.html"
            pagesize = 0
        else:
@@ -400,29 +503,33 @@ def render_show_shelf(shelf_type, shelf_id, page_no, sort_param):
            page = 'shelfdown.html'

        result, __, pagination = calibre_db.fill_indexpage(page_no, pagesize,
-                                                            db.Books,
-                                                            ub.BookShelf.shelf == shelf_id,
-                                                            [ub.BookShelf.order.asc()],
-                                                            ub.BookShelf,ub.BookShelf.book_id == db.Books.id)
-        # delete chelf entries where book is not existent anymore, can happen if book is deleted outside calibre-web
-        wrong_entries = calibre_db.session.query(ub.BookShelf)\
-            .join(db.Books, ub.BookShelf.book_id == db.Books.id, isouter=True)\
+                                                           db.Books,
+                                                           ub.BookShelf.shelf == shelf_id,
+                                                           [ub.BookShelf.order.asc()],
+                                                           True, config.config_read_column,
+                                                           ub.BookShelf, ub.BookShelf.book_id == db.Books.id)
+        # delete shelf entries where book is not existent anymore, can happen if book is deleted outside calibre-web
+        wrong_entries = calibre_db.session.query(ub.BookShelf) \
+            .join(db.Books, ub.BookShelf.book_id == db.Books.id, isouter=True) \
            .filter(db.Books.id == None).all()
        for entry in wrong_entries:
            log.info('Not existing book {} in {} deleted'.format(entry.book_id, shelf))
            try:
                ub.session.query(ub.BookShelf).filter(ub.BookShelf.book_id == entry.book_id).delete()
                ub.session.commit()
-            except (OperationalError, InvalidRequestError):
+            except (OperationalError, InvalidRequestError) as e:
                ub.session.rollback()
-                flash(_(u"Settings DB is not Writeable"), category="error")
+                log.error_or_exception("Settings Database error: {}".format(e))
+                flash(_("Oops! Database Error: %(error)s.", error=e.orig), category="error")

        return render_title_template(page,
                                     entries=result,
                                     pagination=pagination,
-                                     title=_(u"Shelf: '%(name)s'", name=shelf.name),
+                                     title=_("Shelf: '%(name)s'", name=shelf.name),
                                     shelf=shelf,
-                                     page="shelf")
+                                     page="shelf",
+                                     status=status,
+                                     order=sort_param)
    else:
-        flash(_(u"Error opening shelf. Shelf does not exist or is not accessible"), category="error")
+        flash(_("Error opening shelf. Shelf does not exist or is not accessible"), category="error")
        return redirect(url_for("web.index"))
--- a/Show More
+++ b/Show More