Output PNG files stored in shared directory without user scoping, enabling cross-user access

[anshul23102]

Bug Description

Converted PNG files are saved to a single global output directory. Filenames are derived from the upload UUID, which is returned to the uploader. Any user who can guess or observe another user's UUID can download their converted files.

Steps to Reproduce

1. User A uploads a PDF and receives UUID abc123.
2. User B requests GET /output/abc123/page_1.png.
3. Observe: user B can download user A's converted files.

Root Cause

OUTPUT_DIR = 'static/outputs'
out_path = os.path.join(OUTPUT_DIR, uuid, f'page_{i}.png')
# No session binding; any caller who knows the UUID can retrieve the file

Impact

Unauthorized access to other users' converted document pages.

Proposed Fix

import secrets
user_token = secrets.token_urlsafe(32)  # per-request token
# Store mapping in Redis with short TTL:
redis.setex(f'download:{user_token}', 300, json.dumps({'uuid': uuid}))
# Serve files only after validating the token

[anshul23102]

@Durgeshwar-AI Hi! I came across this issue and I would love to work on it as part of GSSoC '26.

I have reviewed the problem description carefully and am confident I can deliver a well-tested, production-ready fix within the contribution timeline. Please let me know if you need any additional context or have specific implementation preferences before I get started.

Could you please assign this issue to me?

/assign
/claim