Sicherheits-Härtung und Bugfixes

bin/backend/plugins/ntfy.py

@@ -1,8 +1,12 @@
 """NTFY push notification plugin."""
 
-import subprocess
+import logging
 import threading
 
+import httpx
+
+logger = logging.getLogger("plugins.ntfy")
+
 EVENT_TAGS = {
     "start": "red_circle",
     "stop": "white_check_mark",
@@ -11,6 +15,23 @@ EVENT_TAGS = {
 }
 
 
+def _post(url: str, title: str, message: str, token: str, priority: str, tags: str):
+    params = {"title": title, "priority": priority or "default"}
+    if tags:
+        params["tags"] = tags
+    headers = {"Content-Type": "text/plain; charset=utf-8"}
+    if token:
+        headers["Authorization"] = f"Bearer {token}"
+    try:
+        resp = httpx.post(url, params=params, content=message.encode("utf-8"),
+                          headers=headers, timeout=10.0)
+        if resp.status_code >= 400:
+            logger.warning("NTFY-Benachrichtigung fehlgeschlagen: HTTP %s %s",
+                           resp.status_code, resp.text[:200])
+    except Exception as e:
+        logger.warning("NTFY-Benachrichtigung fehlgeschlagen: %s", e)
+
+
 def send_notification(
     url: str,
     title: str,
@@ -21,26 +42,11 @@ def send_notification(
 ):
     if not url:
         return
-
-    cmd = [
-        "curl", "-s", "-o", "/dev/null", "--max-time", "10",
-        "-H", f"Title: {title}",
-        "-H", f"Priority: {priority}",
-    ]
-    if tags:
-        cmd += ["-H", f"Tags: {tags}"]
-    cmd += ["-d", message]
-    if token:
-        cmd += ["-H", f"Authorization: Bearer {token}"]
-    cmd.append(url)
-
-    def _send():
-        try:
-            subprocess.run(cmd, capture_output=True, timeout=15, stdin=subprocess.DEVNULL)
-        except Exception:
-            pass
-
-    threading.Thread(target=_send, daemon=True).start()
+    threading.Thread(
+        target=_post,
+        args=(url, title, message, token, priority, tags),
+        daemon=True,
+    ).start()
 
 
 class NtfyNotifier:
@@ -53,7 +59,7 @@ class NtfyNotifier:
         url = self.config.get("ntfy", "url", default="")
         if not url:
             return False
-        events = self.config.get("ntfy", "events", default="error")
+        events = self.config.get("ntfy", "events", default="error") or ""
         return event in [e.strip() for e in events.split(",")]
 
     def notify(self, event: str, title: str, message: str, job_ntfy_enabled: bool = False, priority: str = "default"):