mirror of
https://github.com/comfyanonymous/ComfyUI.git
synced 2025-04-17 17:43:30 +00:00
Compare commits
2 Commits
e8144f1fa6
...
e18046d606
Author | SHA1 | Date | |
---|---|---|---|
![]() |
e18046d606 | ||
![]() |
a476e4c5e5 |
@ -63,7 +63,7 @@ class UserManager():
|
|||||||
|
|
||||||
return user
|
return user
|
||||||
|
|
||||||
def get_request_user_filepath(self, request, file, type="userdata", create_dir=True):
|
def get_request_user_filepath(self, request, target, type="userdata", create_dir=True, target_is_file=True):
|
||||||
user_directory = folder_paths.get_user_directory()
|
user_directory = folder_paths.get_user_directory()
|
||||||
|
|
||||||
if type == "userdata":
|
if type == "userdata":
|
||||||
@ -78,20 +78,23 @@ class UserManager():
|
|||||||
if os.path.commonpath((root_dir, user_root)) != root_dir:
|
if os.path.commonpath((root_dir, user_root)) != root_dir:
|
||||||
return None
|
return None
|
||||||
|
|
||||||
if file is not None:
|
if target is not None:
|
||||||
# Check if filename is url encoded
|
# Check if filename is url encoded
|
||||||
if "%" in file:
|
if "%" in target:
|
||||||
file = parse.unquote(file)
|
target = parse.unquote(target)
|
||||||
|
|
||||||
# prevent leaving /{type}/{user}
|
# prevent leaving /{type}/{user}
|
||||||
path = os.path.abspath(os.path.join(user_root, file))
|
path = os.path.abspath(os.path.join(user_root, target))
|
||||||
if os.path.commonpath((user_root, path)) != user_root:
|
if os.path.commonpath((user_root, path)) != user_root:
|
||||||
return None
|
return None
|
||||||
|
|
||||||
parent = os.path.split(path)[0]
|
if target_is_file:
|
||||||
|
dir_path = os.path.dirname(path)
|
||||||
|
else:
|
||||||
|
dir_path = path
|
||||||
|
|
||||||
if create_dir and not os.path.exists(parent):
|
if create_dir and not os.path.exists(dir_path):
|
||||||
os.makedirs(parent, exist_ok=True)
|
os.makedirs(dir_path, exist_ok=True)
|
||||||
|
|
||||||
return path
|
return path
|
||||||
|
|
||||||
@ -162,7 +165,7 @@ class UserManager():
|
|||||||
if not directory:
|
if not directory:
|
||||||
return web.Response(status=400, text="Directory not provided")
|
return web.Response(status=400, text="Directory not provided")
|
||||||
|
|
||||||
path = self.get_request_user_filepath(request, directory)
|
path = self.get_request_user_filepath(request, directory, target_is_file=False)
|
||||||
if not path:
|
if not path:
|
||||||
return web.Response(status=403, text="Invalid directory")
|
return web.Response(status=403, text="Invalid directory")
|
||||||
|
|
||||||
|
Loading…
Reference in New Issue
Block a user