Resolves a 403 response when accessing /ajax/updateThumbnails from a
session authenticated by reverse proxy.
For some reason, the decorators are swapped on this route specifically,
but not the others. This brings the ordering to be consistent with other
routes. The login check should happen before the auth check now.
The code in epub-progress.js was causing the epub file to be loaded
twice over the network, because it created a second instance of the
epub.js library. I moved all the progress percentage display code into
epub.js. Only the locationchange polyfill code was left in the separate
file, renamed to locationchange-polyfill.js.
I rewrote the percentage progress code to use epub.js events,
giving more succinct and readable code. Also, I added localStorage
caching of the epub location calculations, required for displaying
percentage progress, which can take up to 60-90 seconds to calculate on
longer ebooks. This localStorage caching approach is recommended by
epub.js in the `locations.html` example in their repo.
Signed-off-by: Ross Williams <ross@ross-williams.net>
Javascript files are served over HTTP with an incorrect Content-Type
header because the 'charset' option is duplicated:
$ curl -I http://127.0.0.1:8083/static/js/table.js
HTTP/1.1 200 OK
Content-Disposition: inline; filename=table.js
Content-Type: text/javascript; charset=UTF-8; charset=utf-8
Content-Length: 35967
Last-Modified: Sat, 16 Nov 2024 06:21:28 GMT
Cache-Control: no-cache
ETag: "1731738088.0-35967-471731799"
Date: Sat, 08 Feb 2025 16:30:42 GMT
Content-Security-Policy: default-src 'self' 'unsafe-inline' 'unsafe-eval'; font-src 'self' data:; img-src 'self' data:; object-src 'none';
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
Strict-Transport-Security: max-age=31536000
This header is not RFC 1521 compliant and it's breaking some reverse
proxy setups that perform compression. See this bug for reference:
https://github.com/crocodilestick/Calibre-Web-Automated/issues/217
