Vito Sansevero 191d02eb6c fix: image routes serve only media files inside allowed directories ...

serve_image and serve_output_image now reject anything whose extension
is not in IMAGE_EXTENSIONS, fail closed when no output directory is
configured, and answer 403 (not 404) for dot-dot, absolute and
symlink-escaping paths. Containment is checked after realpath+normcase
so it behaves the same on Windows, macOS and Linux. 500 responses use
safe_error_message so OSError text no longer leaks absolute paths.

2026-10-08 18:01:34 -07:00

..

__init__.py

feat: LoraManager integration — trigger words & example import (#52) (#136)

2026-04-03 18:26:23 -07:00

admin.py

fix: release 3.2.3 — metadata parsing, null-safe saves, auto-hide, tag search (#151)

2026-10-07 11:27:40 -07:00

autotag_routes.py

fix: validate WD14 threshold params to return 400 on bad input (#115) (#116)

2026-02-11 05:55:52 -08:00

images.py

fix: image routes serve only media files inside allowed directories

2026-10-08 18:01:34 -07:00

logging_routes.py

style: apply Black formatter (line-length=88) to all Python files

2026-02-07 08:30:09 -08:00

lora_integration.py

feat: LoraManager integration — trigger words & example import (#52) (#136)

2026-04-03 18:26:23 -07:00

prompts.py

fix: image routes serve only media files inside allowed directories

2026-10-08 18:01:34 -07:00