ComfyAssets-ComfyUI_PromptManager

Files

T

Vito Sansevero 027fdc09bb fix: cap every request-driven resource in the image routes

- /images/recent, /images/all and /images/output parse limit/offset
  through parse_page_params on every path (absent, 0, negative, float
  strings), and the clamped values are what reach the DB. /images/all
  gets its own MAX_BULK_LIMIT ceiling instead of an unbounded query;
  /images/recent caps its fetch window at MAX_RECENT_IMAGES_WINDOW.
- parse_page_params also clamps offset to MAX_PAGE_OFFSET so values past
  int64 no longer surface as a 500 from SQLite.
- Gallery and thumbnail scans share _iter_media_files: no symlink
  following, MAX_SCAN_DEPTH, and MAX_GALLERY_FILES / MAX_THUMBNAIL_FILES
  caps. Thumbnail size comes only from named presets.
- JSON bodies on /images/link and /images/generate-thumbnails are read
  in bounded chunks; over MAX_JSON_BODY_BYTES answers 413, malformed or
  non-object JSON answers 400.
- /images/link only accepts media paths inside the allowed directories
  (403 otherwise), closing a path-existence oracle.

2026-10-08 18:01:34 -07:00

__init__.py

feat: LoraManager integration — trigger words & example import (#52 ) (#136 )

2026-04-03 18:26:23 -07:00

admin.py

fix: release 3.2.3 — metadata parsing, null-safe saves, auto-hide, tag search (#151 )

2026-10-07 11:27:40 -07:00

autotag_routes.py

fix: validate WD14 threshold params to return 400 on bad input (#115 ) (#116 )

2026-02-11 05:55:52 -08:00

images.py

fix: cap every request-driven resource in the image routes