alphard/ComfyUI-Lora-Manager
1
0
Fork 0
mirror of https://github.com/willmiao/ComfyUI-Lora-Manager.git synced 2026-07-13 20:21:16 -03:00
Code Issues Packages Projects Releases Wiki Activity

fix(hf): allow subdirectory paths in HF resolve URLs, strip repo-internal dirs on save (#1019)

Browse Source
This commit is contained in:
Will Miao
2026-07-09 09:18:38 +08:00
parent a7625b009f
commit 316702b7ab
1 changed files with 7 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
py/routes/handlers/hf_handlers.py
View File

@@ -363,8 +363,8 @@ class HfHandler:
if ".." in (author, repo_name) or "." in (author, repo_name): if ".." in (author, repo_name) or "." in (author, repo_name):
return web.json_response({"error": f"Invalid repo format: {repo}"}, status=400) return web.json_response({"error": f"Invalid repo format: {repo}"}, status=400)
# Validate filename — must not contain path separators or .. # Validate filename — must not contain path traversal
if "/" in filename or "\\" in filename or ".." in filename: if ".." in filename:
return web.json_response({"error": "Invalid filename"}, status=400) return web.json_response({"error": "Invalid filename"}, status=400)
# Validate relative_path — must not be absolute or escape base directory # Validate relative_path — must not be absolute or escape base directory
@@ -393,8 +393,12 @@ class HfHandler:
else: else:
target_dir = base_dir target_dir = base_dir
# Strip HF repo subdirectory — "diffusion_models/xxx.safetensors"
# is an HF repo convention, not meaningful for local storage.
file_base = os.path.basename(filename)
os.makedirs(target_dir, exist_ok=True) os.makedirs(target_dir, exist_ok=True)
dest_path = os.path.join(target_dir, filename) dest_path = os.path.join(target_dir, file_base)
# Check if already exists (simple skip) # Check if already exists (simple skip)
if os.path.exists(dest_path) and os.path.getsize(dest_path) > 0: if os.path.exists(dest_path) and os.path.getsize(dest_path) > 0: