From 2396d43df0bea66a3187d38631da090129b5ccc5 Mon Sep 17 00:00:00 2001
From: Vladimir Mandic <mandic00@live.com>
Date: Fri, 9 Jun 2023 10:56:47 -0400
Subject: [PATCH] fix allowed paths

---
 TODO.md  | 2 ++
 webui.py | 3 +++
 2 files changed, 5 insertions(+)

diff --git a/TODO.md b/TODO.md
index 1d146a860..cc1b284d6 100644
--- a/TODO.md
+++ b/TODO.md
@@ -59,3 +59,5 @@ Tech that can be integrated as part of the core workflow...
 - port `p.all_hr_prompts`
 - test `lyco_patch_lora`
 - fix `lyco` logging
+- save `ui-settings.json`
+- `data-dir` security issues
diff --git a/webui.py b/webui.py
index 590196833..bb71fd1bf 100644
--- a/webui.py
+++ b/webui.py
@@ -256,8 +256,11 @@ def start_ui():
         max_threads=64,
         show_api=True,
         favicon_path='html/logo.ico',
+        allowed_paths=[os.path.dirname(__file__), cmd_opts.data_dir],
         app_kwargs=gradio_kwargs,
     )
+    if cmd_opts.data_dir is not None:
+        ui_tempdir.register_tmp_file(shared.demo, os.path.join(cmd_opts.data_dir, 'x'))
     shared.log.info(f'Local URL: {local_url}')
     if cmd_opts.docs:
         shared.log.info(f'API Docs: {local_url[:-1]}/docs') # {local_url[:-1]}?view=api