[Malware Scanner] Custom Path scan fails with 405 "The method is not allowed for the requested URL"

[qux-bbb]

Describe the bug

On the Malware Scanner page (http://localhost/security/scanner), entering a target directory (e.g. /var/www) in the Custom Path card and clicking Scan causes a red error banner to appear at the top of the page:

The method is not allowed for the requested URL.

Steps to reproduce

1. Install extension Malware Scanner
2. Open the security panel and navigate to the Malware Scanner page (http://localhost/security/scanner)
3. In the Custom Path card, enter a target directory, e.g. /var/www
4. Click the Scan button
5. Observe the banner at the top of the page

Expected behavior

The backend accepts the request, starts a custom-path scan for /var/www, and a corresponding task appears in the All scans list.

Environment

Ubuntu 24.04.2 LTS, Firefox 140.0.4 (64-bit), ServerKit v1.11.4

Logs

Checks

• I have searched the existing issues.
• I am using the latest version of ServerKit.

[jhd3197]

Confirmed and fixed on dev (0aea7e3).

Root cause: it wasn't the scanner's route — the extension's whole backend blueprint was missing on your running panel. Flask refuses register_blueprint once the app has served its first request, so the installer's hot-load always failed silently on a live panel (only a "will load on restart" warning in the logs). The page rendered because the frontend is static; every extension API call was actually failing — the GETs (status/history) are swallowed by the tab's error handlers, and your POST to /api/v1/security/scan/directory fell through to Flask's static-file route, which only allows GET — hence the 405.

The fix makes late blueprint registration work (safe here: single gunicorn worker with threads; werkzeug rebuilds its URL matcher lazily). Installing the extension on a running panel now registers its routes immediately, no restart needed.

On your current install, a panel restart would also have brought the routes up — but with the fix, that's no longer necessary. The fix ships in the next release; thanks for the precise report.

[jhd3197]

The fix has now been merged and shipped in v1.11.7. Closing as fixed. Please let me know if the Custom Path scan still fails after updating.