Optimize security, stability, FPS rate limiting, and add elegant quit

runner.py

@@ -38,6 +38,9 @@ shared_mouse_pos = (0, 0)
 shared_mouse_buttons = (False, False, False)
 shared_webcam_frame = None
 
+last_pygame_frame_time = 0.0
+last_cv2_frame_time = 0.0
+
 # Key map: JavaScript event.key name -> Pygame key constant
 import pygame  # Import pygame now that SDL environment is set
 KEY_MAP = {
@@ -100,6 +103,10 @@ def reader_thread_func(sock):
                 event_type = data.get('type')  # 'keydown' or 'keyup'
                 key_name = data.get('key')
                 
+                # Make single character key codes case-insensitive (e.g. for Caps Lock/Shift)
+                if key_name and len(key_name) == 1:
+                    key_name = key_name.lower()
+                    
                 pg_key = KEY_MAP.get(key_name)
                 if pg_key is not None:
                     if event_type == 'keydown':
@@ -156,6 +163,13 @@ def reader_thread_func(sock):
                 # Stdin input from browser terminal
                 text = payload.decode('utf-8', errors='ignore')
                 stdin_queue.put(text)
+                
+            elif msg_type == 'QUIT':
+                # Clean quit request for Pygame
+                try:
+                    pygame.event.post(pygame.event.Event(pygame.QUIT))
+                except Exception:
+                    pass
                     
     except Exception as e:
         print(f"[Runner-TCP] Reader error: {e}", file=sys.__stderr__)
@@ -252,6 +266,14 @@ pygame.display.set_mode = custom_set_mode
 
 # 2. Patch flip and update to capture surface and stream it
 def send_pygame_frame():
+    global last_pygame_frame_time
+    now = time.time()
+    if now - last_pygame_frame_time < 0.033:  # limit to ~30 FPS
+        return
+    if send_queue.qsize() > 3:  # drop frames if buffer is backed up
+        return
+    last_pygame_frame_time = now
+    
     surf = pygame.display.get_surface()
     if surf:
         import io
@@ -358,13 +380,19 @@ def custom_Font(filename, size):
 pygame.font.Font = custom_Font
 
 
-
-
 # ----------------- Monkeypatching OpenCV (cv2) -----------------
 import cv2
 
 # 1. Patch imshow to capture frames
 def custom_imshow(winname, mat):
+    global last_cv2_frame_time
+    now = time.time()
+    if now - last_cv2_frame_time < 0.033:  # limit to ~30 FPS
+        return
+    if send_queue.qsize() > 3:  # drop frames if buffer is backed up
+        return
+    last_cv2_frame_time = now
+
     if mat is not None:
         try:
             ret, jpeg = cv2.imencode('.jpg', mat, [cv2.IMWRITE_JPEG_QUALITY, 70])

server.py

@@ -170,11 +170,17 @@ async def serve_static_project_file(student_token: str, project_name: str, path:
             real_class, real_student = decode_class_student(student_token, project_name)
             if real_class and real_student:
                 file_path = os.path.join(PROJECTS_DIR, real_class, real_student, actual_project_name, actual_path)
+                # Prevent Path Traversal
+                if not os.path.abspath(file_path).startswith(os.path.abspath(PROJECTS_DIR)):
+                    return HTMLResponse("Access Denied", status_code=403)
                 if os.path.exists(file_path) and not os.path.isdir(file_path):
                     return FileResponse(file_path)
         return HTMLResponse("Not Found", status_code=404)
         
     file_path = os.path.join(PROJECTS_DIR, real_class, real_student, project_name, path)
+    # Prevent Path Traversal
+    if not os.path.abspath(file_path).startswith(os.path.abspath(PROJECTS_DIR)):
+        return HTMLResponse("Access Denied", status_code=403)
     if not os.path.exists(file_path) or os.path.isdir(file_path):
         return HTMLResponse("File Not Found", status_code=404)
         
@@ -370,8 +376,8 @@ async def play_project_ws_internal(websocket: WebSocket, real_class: str, real_s
     
     # We run the subprocess and redirect stdout/stderr so we don't pollute the main server logs,
     # and to capture anything missed by monkeypatching
-    process = subprocess.Popen(
-        cmd,
+    process = await asyncio.create_subprocess_exec(
+        *cmd,
         stdout=subprocess.DEVNULL,
         stderr=subprocess.DEVNULL
     )
@@ -386,6 +392,7 @@ async def play_project_ws_internal(websocket: WebSocket, real_class: str, real_s
         print(f"[Server] 錯誤: 執行器進程 {process.pid} 建立 TCP 連結逾時。")
         await websocket.send_json({"type": "log", "data": "伺服器錯誤: 執行模擬器連線超時！\n"})
         process.terminate()
+        await process.wait()
         tcp_server.close()
         await tcp_server.wait_closed()
         await websocket.close()
@@ -462,6 +469,11 @@ async def play_project_ws_internal(websocket: WebSocket, real_class: str, real_s
                         runner_writer.write(b'INPT' + len(payload).to_bytes(4, byteorder='big') + payload)
                         await runner_writer.drain()
                         
+                    elif mtype == 'pygame_quit':
+                        # Forward clean quit request to Pygame
+                        runner_writer.write(b'QUIT' + (0).to_bytes(4, byteorder='big') + b'')
+                        await runner_writer.drain()
+                        
                 elif "bytes" in data:
                     # Binary data represents the browser webcam JPEG frame
                     payload = data["bytes"]
@@ -477,12 +489,17 @@ async def play_project_ws_internal(websocket: WebSocket, real_class: str, real_s
         await asyncio.gather(tcp_to_ws(), ws_to_tcp())
     finally:
         # --- Clean up resources ---
-        print(f"[Server] 清理專案執行資源 (Process ID: {process.pid})")
-        process.terminate()
-        try:
-            process.wait(timeout=1.0)
-        except subprocess.TimeoutExpired:
-            process.kill()
+        if 'process' in locals() and process:
+            print(f"[Server] 清理專案執行資源 (Process ID: {process.pid})")
+            try:
+                process.terminate()
+                try:
+                    await asyncio.wait_for(process.wait(), timeout=1.0)
+                except asyncio.TimeoutError:
+                    process.kill()
+                    await process.wait()
+            except Exception as e:
+                print(f"[Server] 終止進程異常: {e}")
             
         if runner_writer:
             runner_writer.close()

templates/player.html

@@ -755,7 +755,7 @@
                         <svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="3"><path d="M21.5 2v6h-6M21.34 15.57a10 10 0 1 1-.57-8.38l5.67-5.67"/></svg>
                         重設
                     </button>
-                    <button class="btn-action btn-stop" onclick="window.close()">
+                    <button class="btn-action btn-stop" onclick="stopProjectElegant()">
                         <svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="3"><rect x="3" y="3" width="18" height="18" rx="2" ry="2"/></svg>
                         終止
                     </button>
@@ -1057,6 +1057,21 @@
             setTimeout(connectWebSocket, 1000);
         }
 
+        function stopProjectElegant() {
+            appendConsole("\n[系統] 正在發送退出訊號並結束專案...\n");
+            if (projectType === "python" && socket && socket.readyState === WebSocket.OPEN) {
+                socket.send(JSON.stringify({
+                    type: "pygame_quit"
+                }));
+                // Wait 1.5s before closing to let Pygame script do graceful cleanup
+                setTimeout(() => {
+                    window.close();
+                }, 1500);
+            } else {
+                window.close();
+            }
+        }
+
         function appendConsole(text) {
             if (consoleLogs) {
                 consoleLogs.textContent += text;