The share route joined the file name and subfolder of the selected
output, both taken from the request, onto the output or temp directory
and uploaded that file to the Matrix homeserver named in the same
request. A name such as "../../file" left the directory, so a request
could have any file that ComfyUI can read uploaded. The route runs the
upload only where matrix-nio is installed, which Manager does not
install.
- Refuse, with 400 and the error shape the share dialog shows, a path
that is not inside the directory, in the glob and the legacy copy
- Compare the normalized path without resolving symlinks, as ComfyUI's
/view does, and open that same path, so an image that the dialog
previews through a symlink in the directory can still be shared
- Refuse a path on another Windows drive, for which commonpath raises
ValueError
- Add tests that run the real route of both copies against a recording
Matrix client
- Add a CHANGELOG entry
The same change for main is #3427. The other upload that #3427 first
changed was removed from v4 in #3500.
Dr.Lt.Data
8dd1967fde