[vjpixel]

Description

Reporting a problem meant opening a GitHub issue, which needs a GitHub account — the issue points out that this is precisely what stops people giving feedback.

Adds a public form at /feedback/, linked from the footer, with the four fields the issue asks for: a bug/feature dropdown, a description, the reporter's e-mail and an attachment.

Resolves (Issues)

Closes #691

General tasks performed

• Feedback model with kind, description, email, attachment and a handled flag for triage.
• FeedbackForm, the feedback view, the /feedback/ route, a feedback.jinja2 template and the footer link.
• FeedbackAdmin: filter by kind and handled state, search across description and e-mail, handled editable inline, and the reporter's content marked read-only so triage cannot rewrite what someone submitted.
• src/core/tests/test_feedback_form.py — 9 tests.

Design decisions worth a look

Stored, not e-mailed. The issue does not say where reports should go. I store them and surface them in the admin, because e-mail silently loses reports whenever SMTP is misconfigured, and because a stored report stays searchable and can carry a triage state. Adding a notification on top is easy later; recovering an e-mail that was never delivered is not.

Attachments are treated as hostile input, since the form is open to anonymous visitors: extensions limited to images, PDF and text logs, size capped at 5 MB, and the file stored under a generated name (feedback/<uuid>.<ext>) so a filename like Captura de tela #1.png never reaches storage — the same problem #699 covers for sounds.

The form is intentionally anonymous-friendly: no login required and the e-mail is optional, so someone can report a bug without identifying themselves.

Not included

No spam protection. An open form will eventually attract bots, and the right answer (honeypot field, rate limit, or captcha) is a product decision rather than something to slip into this PR — worth its own issue before this is publicised.

Verification: full suite pytest src/core src/users src/blog passes — 281 passed. makemigrations --check --dry-run reports no changes, and ruff format --diff src/ is clean.

Have you confirmed the application builds locally without error? See here.

• Yes

---

🤖 Generated with Claude Code

https://claude.ai/code/session_01HXUw7kyELDu8ycGQxtaFbb

---

Generated by Claude Code

[vjpixel]

@pablodiegoss você pode revisar este PR quando tiver um tempo?

---

Generated by Claude Code

[pablodiegoss]

Looks good and works correctly. I've already made adjustments to the migration number and conflicts from my previous MRs to develop.

However, we cannot have an unauthenticated form that submits files to our servers and creates rows on our databases, we receive an inconceivable amount of bot traffic, this features require at least the turnstile bot protection we have on the sign up form and maybe a honeypot field for extra protection, cannot accept it as is.