Public/automatic
1
0
Fork 0
mirror of https://github.com/vladmandic/automatic synced 2026-09-19 01:04:32 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix(api): IP-adapter mask accumulation, null params, colon-in-password, raw allowed path

Browse Source 
generate.py: p.ip_adapter_masks was reinitialized inside the per-adapter loop, discarding all but the last adapter's masks; move it beside the other accumulators. process.py: req.params is dict|None, so a null params body crashed .items() in post_preprocess/post_mask. api.py: split(':') without maxsplit broke auth/auth-file entries whose password contains a colon. gallery.py: allowed_paths stored quote(path) but the membership check and path guards use the raw path, causing duplicate accumulation and an ineffective whitelist; also drop the unused FastAPI import (pylint W0611 surfaced when this file is linted).

Co-Authored-By: Claude <noreply@anthropic.com>
This commit is contained in:
QualiaRain
2026-06-13 00:21:25 -04:00
parent d227a46406
commit 711d6018bf
4 changed files with 6 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
modules/api/api.py
+2 -2
View File
@@ -17,12 +17,12 @@ class Api:
self.credentials = {}
if shared.cmd_opts.auth:
for auth in shared.cmd_opts.auth.split(","):
user, password = auth.split(":")
user, password = auth.split(":", 1)
self.credentials[user.replace('"', '').strip()] = password.replace('"', '').strip()
if shared.cmd_opts.auth_file:
with open(shared.cmd_opts.auth_file, encoding="utf8") as file:
for line in file.readlines():
user, password = line.split(":")
user, password = line.split(":", 1)
self.credentials[user.replace('"', '').strip()] = password.replace('"', '').strip()
self.router = APIRouter()
if shared.cmd_opts.docs: