Security: Auth-geschützte Media-Endpoints für Diary+Health, Walk-Foto-Naming (SW by-v879)

backend/routes/walks.py

@@ -576,7 +576,16 @@ async def upload_walk_photo(
     except Exception:
         pass
 
-    filename = f"walk_{walk_id}_{uuid.uuid4().hex[:8]}.jpg"
+    import re as _re
+    walk_datum  = walk['datum'] or "0000-00-00"  # YYYY-MM-DD
+    uname_raw   = (user.get('name') or 'user').lower()
+    uname_safe  = _re.sub(r'[^a-z0-9]', '-', uname_raw)[:20].strip('-')
+    with db() as conn:
+        count = conn.execute(
+            "SELECT COUNT(*) FROM walk_photos WHERE walk_id=? AND user_id=?",
+            (walk_id, user['id'])
+        ).fetchone()[0]
+    filename = f"{walk_datum}-{uname_safe}-{count + 1:03d}.jpg"
     path = os.path.join(MEDIA_DIR, "walks", filename)
     os.makedirs(os.path.dirname(path), exist_ok=True)
     with open(path, "wb") as f: