- The import screen has a file picker beside the paste box. The page reads the file, checks it looks like OPML before sending, and clears the picker when it is refused and after it is imported. The file is sent as text and never written to disk on the server. - The server parses the OPML before touching anything and answers 400 "that is not an OPML file" (was a 500). subscribe_opml takes a parsed document, so ipx import also refuses a non-OPML file by name. - Tests: Settings' Export OPML download and paste import; uploading an RSS file (refused) and a real OPML; the server's 400; the admin's export round-tripped into a second account; ipx import/export in a scratch config. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016HdTEWQNrzyFULijigkmMn
25 KiB
25 KiB