fix: bug scan - fix 10 bugs across backend (search field names, missing import, file handle leak, None guard, race condition, hardcoded secrets)

learn/views.py

@@ -500,10 +500,14 @@ class CDNStaticFileView(APIView):
         )
         if not os.path.exists(file_path):
             raise Http404
-        response = FileResponse(open(file_path, 'rb'), content_type='text/markdown; charset=utf-8')
-        response['Cache-Control'] = 'max-age=86400'
-        return response
-
+        fh = open(file_path, "rb")
+        try:
+            response = FileResponse(fh, content_type="text/markdown; charset=utf-8")
+            response["Cache-Control"] = "max-age=86400"
+            return response
+        except Exception:
+            fh.close()
+            raise
 
 class CourseFavoriteToggleView(APIView):
     permission_classes = [IsAuthenticated]
@@ -745,7 +749,10 @@ class MyProgressView(APIView):
                     'last_studied_at': read.completed_at,
                 }
             course_map[course_id]['completed_chapters'] += 1
-            if read.completed_at > course_map[course_id]['last_studied_at']:
+            if read.completed_at and (
+                not course_map[course_id]['last_studied_at'] or
+                read.completed_at > course_map[course_id]['last_studied_at']
+            ):
                 course_map[course_id]['last_studied_at'] = read.completed_at
 
         courses = []
@@ -765,4 +772,4 @@ class MyProgressView(APIView):
                 'total_courses': len(courses),
                 'total_completed': total_completed,
             }
-        )
+        )