Address second round of PR review feedback

- Fix race condition in KolibriServerService.startHttpServer(): set
  isRunning before thread.start() to prevent duplicate server threads
- Call resetServerState() in KolibriServerService.onDestroy() so
  ViewModel reflects actual server state
- Harden WebView security: disable third-party cookies, file/content
  access, and mixed content mode (unnecessary for local HTTP server)
- Remove dead Django migration loader patch (Django 3.2 does not need it)
- Rename PatchKolibriTask to StreamlineKolibriTask and deduplicate
  extraction logic into shared static method
- Rename tar/patched to tar/extracted throughout
- Remove obsolete py2only exclude from tar extraction

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: rtibbles

.gitignore

@@ -7,9 +7,9 @@ app/src/main/res/values-*/strings.xml
 tmpenv
 tmphome/
 
-# Kolibri tar files and patches
+# Kolibri tar files and extracted source
 tar/
-tar/patched/
+tar/extracted/
 
 # File format for signing keys
 *.jks

Makefile

@@ -50,7 +50,7 @@ clean:
 
 .PHONY: clean-tar
 clean-tar:
-	rm -rf tar/patched
+	rm -rf tar/extracted
 	mkdir -p tar
 
 .PHONY: get-tar
@@ -242,7 +242,7 @@ help:
 	@echo ""
 	@echo "Kolibri Source:"
 	@echo "  get-tar               - Download Kolibri tar (use: make get-tar tar=URL)"
-	@echo "  clean-tar             - Remove patched Kolibri directory"
+	@echo "  clean-tar             - Remove extracted Kolibri directory"
 	@echo ""
 	@echo "Environment Variables:"
 	@echo "  ANDROID_SDK_ROOT      - Android SDK location (default: ./android_root)"

app/build.gradle

@@ -23,67 +23,51 @@ spotless {
 import org.gradle.api.tasks.*
 import javax.inject.Inject
 
-// Task to extract and patch Kolibri tar file (replicates Makefile install-tar)
-abstract class PatchKolibriTask extends DefaultTask {
+// Task to extract Kolibri tar file, stripping unnecessary packages
+abstract class StreamlineKolibriTask extends DefaultTask {
 	@InputFile
 	abstract RegularFileProperty getTarFile()
 
 	@OutputDirectory
-	abstract DirectoryProperty getPatchedDir()
+	abstract DirectoryProperty getExtractedDir()
 
 	@Inject
 	abstract ExecOperations getExecOperations()
 
-	@TaskAction
-	void patchKolibri() {
-		def tarFile = getTarFile().get().asFile
-		def patchedDir = getPatchedDir().get().asFile
+	/** Extract Kolibri tar, cleaning the output directory and stripping unnecessary packages. */
+	static void extract(File tarFile, File extractedDir, def execOps) {
+		println "Extracting Kolibri from ${tarFile.name}"
 
-		if (!tarFile.exists()) {
-			throw new GradleException("Kolibri tar file not found: ${tarFile}")
+		if (extractedDir.exists()) {
+			extractedDir.deleteDir()
 		}
+		extractedDir.mkdirs()
 
-		println "Patching Kolibri from ${tarFile.name}"
-
-		// Clean and create patched directory
-		if (patchedDir.exists()) {
-			patchedDir.deleteDir()
-		}
-		patchedDir.mkdirs()
-
-		// Extract tar file, excluding problematic packages
-		execOperations.exec {
+		execOps.exec {
 			commandLine 'tar', 'xzf', tarFile.absolutePath,
-					'--exclude=kolibri/dist/py2only*',
 					'--exclude=kolibri/dist/cext/*',
 					'--exclude=kolibri/dist/ifaddr*',
-					'--directory=' + patchedDir.absolutePath,
+					'--directory=' + extractedDir.absolutePath,
 					'--strip-components=1'
 		}
 
-		// Patch Django to allow .pyc migration files
-		// This is critical because Chaquopy compiles .py files and deletes them
-		def djangoLoader = new File(patchedDir, 'kolibri/dist/django/db/migrations/loader.py')
-		if (djangoLoader.exists()) {
-			def content = djangoLoader.text
-			content = content.replace(
-					'if name.endswith(".py"):',
-					'if name.endswith(".py") or name.endswith(".pyc"):'
-					)
-			djangoLoader.text = content
-			println "Patched Django migrations loader"
-		} else {
-			throw new GradleException("Could not find Django loader.py to patch")
-		}
+		println "Kolibri extracted successfully at ${extractedDir.absolutePath}"
+	}
 
-		println "Kolibri patched successfully at ${patchedDir.absolutePath}"
+	@TaskAction
+	void streamlineKolibri() {
+		def tarFile = getTarFile().get().asFile
+		if (!tarFile.exists()) {
+			throw new GradleException("Kolibri tar file not found: ${tarFile}")
+		}
+		extract(tarFile, getExtractedDir().get().asFile, execOperations)
 	}
 }
 
-tasks.register('patchKolibriTar', PatchKolibriTask) {
+tasks.register('streamlineKolibriTar', StreamlineKolibriTask) {
 	def tarFile = file('../tar').listFiles()?.find { it.name.endsWith('.tar.gz') && it.name.startsWith('kolibri') }
 	getTarFile().set(tarFile)
-	getPatchedDir().set(file('../tar/patched'))
+	getExtractedDir().set(file('../tar/extracted'))
 }
 
 // Determine which Python to use for build scripts
@@ -93,52 +77,22 @@ if (venvPython.exists()) {
 	buildPythonExecutable = venvPython.absolutePath
 }
 
-// Ensure Kolibri tar is patched during configuration phase
+// Ensure Kolibri tar is extracted during configuration phase
 // This is necessary so version can be calculated before tasks run
-def patchedKolibriDir = file('../tar/patched')
+def extractedKolibriDir = file('../tar/extracted')
 def tarFile = file('../tar').listFiles()?.find { it.name.endsWith('.tar.gz') && it.name.startsWith('kolibri') }
 
-if (tarFile != null && tarFile.exists() && !new File(patchedKolibriDir, 'kolibri/VERSION').exists()) {
-	println "Extracting and patching Kolibri tar during configuration..."
-
-	// Clean and create patched directory
-	if (patchedKolibriDir.exists()) {
-		patchedKolibriDir.deleteDir()
-	}
-	patchedKolibriDir.mkdirs()
-
-	// Extract tar file, excluding problematic packages
-	exec {
-		commandLine 'tar', 'xzf', tarFile.absolutePath,
-				'--exclude=kolibri/dist/py2only*',
-				'--exclude=kolibri/dist/cext/*',
-				'--exclude=kolibri/dist/ifaddr*',
-				'--directory=' + patchedKolibriDir.absolutePath,
-				'--strip-components=1'
-	}
-
-	// Patch Django to allow .pyc migration files
-	def djangoLoader = new File(patchedKolibriDir, 'kolibri/dist/django/db/migrations/loader.py')
-	if (djangoLoader.exists()) {
-		def content = djangoLoader.text
-		content = content.replace(
-				'if name.endswith(".py"):',
-				'if name.endswith(".py") or name.endswith(".pyc"):'
-				)
-		djangoLoader.text = content
-		println "Patched Django migrations loader"
-	}
-
-	println "Kolibri patched successfully"
+if (tarFile != null && tarFile.exists() && !new File(extractedKolibriDir, 'kolibri/VERSION').exists()) {
+	StreamlineKolibriTask.extract(tarFile, extractedKolibriDir, this)
 }
 
 // Calculate version name and code
 def calculatedVersionName
 def calculatedVersionCode
 
-if (patchedKolibriDir.exists() && patchedKolibriDir.isDirectory()) {
+if (extractedKolibriDir.exists() && extractedKolibriDir.isDirectory()) {
 	// Read VERSION_NAME from Kolibri's VERSION file
-	def kolibriVersionFile = new File(patchedKolibriDir, 'kolibri/VERSION')
+	def kolibriVersionFile = new File(extractedKolibriDir, 'kolibri/VERSION')
 	if (!kolibriVersionFile.exists()) {
 		throw new GradleException("Kolibri VERSION file not found at: ${kolibriVersionFile}")
 	}
@@ -211,21 +165,21 @@ abstract class GenerateKolibriStringsTask extends DefaultTask {
 }
 
 tasks.register('generateKolibriStrings', GenerateKolibriStringsTask) {
-	dependsOn patchKolibriTar
+	dependsOn streamlineKolibriTar
 	getScriptFile().set(file('../scripts/create_strings.py'))
 	getResDir().set(file('src/main/res'))
 	// Version text input is sufficient - when it changes, task reruns
 	getVersionText().set(calculatedVersionName)
 	getPythonExecutable().set(buildPythonExecutable)
 }
 
-// Make sure Kolibri is patched before Python requirements are generated
+// Make sure Kolibri is extracted before Python requirements are generated
 afterEvaluate {
 	tasks.matching { task ->
 		task.name.contains('PythonRequirements') ||
 				task.name.contains('extractPythonBuildPackages')
 	}.all { task ->
-		task.dependsOn patchKolibriTar
+		task.dependsOn streamlineKolibriTar
 	}
 
 	// Generate strings before resources are processed or mapped
@@ -278,8 +232,8 @@ android {
 
 			pip {
 				// Install Kolibri from patched tar file
-				// The patchKolibriTar task extracts and patches the tar before this runs
-				install "../tar/patched"
+				// The streamlineKolibriTar task extracts the tar before this runs
+				install "../tar/extracted"
 				install "-r", "../requirements.txt"
 			}
 		}

app/src/main/java/org/learningequality/Kolibri/KolibriServerService.java

@@ -38,12 +38,12 @@ private synchronized void startHttpServer() {
       return;
     }
 
+    isRunning = true;
     serverThread =
         new Thread(
             () -> {
               try {
                 Log.i(TAG, "Starting Kolibri HTTP server");
-                isRunning = true;
 
                 Python py = Python.getInstance();
                 PyObject mainModule = py.getModule("main");
@@ -70,6 +70,7 @@ public void onDestroy() {
     Log.d(TAG, "KolibriServerService onDestroy");
 
     isRunning = false;
+    KolibriServerViewModel.getInstance().resetServerState();
 
     // Call Python to stop the server gracefully
     try {

app/src/main/java/org/learningequality/Kolibri/WebViewActivity.java

@@ -89,18 +89,18 @@ private void setupWebView() {
     // Enable cookies and ensure persistence
     CookieManager cookieManager = CookieManager.getInstance();
     cookieManager.setAcceptCookie(true);
-    cookieManager.setAcceptThirdPartyCookies(webView, true);
+    cookieManager.setAcceptThirdPartyCookies(webView, false);
 
     // Enable DOM storage for Service Worker
     settings.setDomStorageEnabled(true);
     settings.setJavaScriptEnabled(true);
 
-    // Enable Service Worker support (mixed content for local HTTP server)
-    settings.setMixedContentMode(WebSettings.MIXED_CONTENT_ALWAYS_ALLOW);
+    // Local HTTP server only — no mixed content needed
+    settings.setMixedContentMode(WebSettings.MIXED_CONTENT_NEVER_ALLOW);
 
-    // Enable modern web features
-    settings.setAllowFileAccess(true);
-    settings.setAllowContentAccess(true);
+    // No file:// or content:// access needed — Kolibri loads via http://127.0.0.1
+    settings.setAllowFileAccess(false);
+    settings.setAllowContentAccess(false);
 
     // Set WebChromeClient for fullscreen video
     webView.setWebChromeClient(new KolibriWebChromeClient(this, fullscreenContainer));

scripts/create_strings.py

@@ -8,10 +8,10 @@
 import xml.etree.ElementTree as ET
 from importlib import resources
 
-# Add patched Kolibri tar to Python path
-PATCHED_TAR_PATH = os.path.join(os.path.dirname(__file__), "../tar/patched")
-if os.path.exists(PATCHED_TAR_PATH):
-    sys.path.insert(0, PATCHED_TAR_PATH)
+# Add extracted Kolibri tar to Python path
+EXTRACTED_TAR_PATH = os.path.join(os.path.dirname(__file__), "../tar/extracted")
+if os.path.exists(EXTRACTED_TAR_PATH):
+    sys.path.insert(0, EXTRACTED_TAR_PATH)
 
 
 # By default we will map the locale code to e.g. "en-us" to "en-rUS"