From c54c0535c0409e3de9b4f3bc67d913eb9eb59a52 Mon Sep 17 00:00:00 2001 From: CalamitousFelicitousness Date: Sat, 11 Jul 2026 15:11:57 +0100 Subject: [PATCH] fix(civitai): accept civitai.red urls in header peek The .red mirror rewrites downloadUrl to its own host; normalize to civitai.com so the ssrf guard, cache hash and fetch host agree. --- modules/civitai/api_civitai.py | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/modules/civitai/api_civitai.py b/modules/civitai/api_civitai.py index 007bf26b6..6f97783cd 100644 --- a/modules/civitai/api_civitai.py +++ b/modules/civitai/api_civitai.py @@ -301,8 +301,11 @@ def get_peek_header(url: str, file_id: int = 0): import json import struct from modules import shared + # civitai.red serves the same download service and rewrites downloadUrl to + # its own host; normalize so the guard, cache hash and fetch host agree. + url = url.replace('https://civitai.red/', 'https://civitai.com/', 1) if not url.startswith('https://civitai.com/'): - return JSONResponse(content={"error": "only civitai.com urls are allowed"}, status_code=400) + return JSONResponse(content={"error": "only civitai urls are allowed"}, status_code=400) if file_id: cached = peek_cache_get(file_id, url) if cached is not None: