Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

merge dev #3755

Open
wants to merge 98 commits into
base: master
Choose a base branch
from
Open

merge dev #3755

wants to merge 98 commits into from
+82,527 −1,569

Conversation

vladmandic
Copy link
Owner

No description provided.

vladmandic and others added 30 commits February 5, 2025 17:07
@vladmandic
fix startup with skip
959f9e2 
Signed-off-by: Vladimir Mandic <[email protected]>
@vladmandic
add asymmetric tiling
47b4848 
Signed-off-by: Vladimir Mandic <[email protected]>
@vladmandic
ui quality-of-life improvements
e018ed6 
Signed-off-by: Vladimir Mandic <[email protected]>
@vladmandic
ui log scroll to bottom
cd1a9c5 
Signed-off-by: Vladimir Mandic <[email protected]>
@lshqqytiger
zluda torch 2.6.0
4f09014
@vladmandic
update changelog
c30b275 
Signed-off-by: Vladimir Mandic <[email protected]>
@vladmandic
update cli tools
5f6a363 
Signed-off-by: Vladimir Mandic <[email protected]>
@Disty0
Update OpenVINO to 2025.0.0
7041b2b
@vladmandic
massive hints update
8873b2f 
Signed-off-by: Vladimir Mandic <[email protected]>
@vladmandic
massive update to hints and add localization engine
a19ec07 
Signed-off-by: Vladimir Mandic <[email protected]>
@vladmandic
create locales: hr,de,es,fr,it,pt,zh,ja,ko,ru
3fcc93c 
Signed-off-by: Vladimir Mandic <[email protected]>
@vladmandic
update locales
e578afc 
Signed-off-by: Vladimir Mandic <[email protected]>
@Disty0
Upate OpenVINO to PyTorch 2.6 and fix mismatched shapes error on too …
1acbabb 
…many resolution changes
@Disty0
OpenVINO enable Upscaler compile by default
59911b7
@Disty0
Fix messed up logging with OpenVINO
c79d125
@Disty0
Don't force VAE compile with OpenVINO and set min detected memory for…
a77bd98 
… dyn atten to 4
@lshqqytiger
correct awkward or incorrect Korean localizations
57a80a7
@Disty0
Correct DPM++ 1S naming and add DPM++ SDE preset
a34d331
@vladmandic
add locale override capabilities
d01fefd 
Signed-off-by: Vladimir Mandic <[email protected]>
@vladmandic
correct links
343f11a 
Signed-off-by: Vladimir Mandic <[email protected]>
@vladmandic
update outpaint
92f494c 
Signed-off-by: Vladimir Mandic <[email protected]>
@vladmandic
modernui add control init image toggle
9bd68d3 
Signed-off-by: Vladimir Mandic <[email protected]>
@vladmandic
ui fix send to inpaint/sketch
b4881ae 
Signed-off-by: Vladimir Mandic <[email protected]>
@vladmandic
cleanup extension installer
ca7db28 
Signed-off-by: Vladimir Mandic <[email protected]>
@lshqqytiger
Move Korean localizations to override_ko.json
510ff7e 
This reverts commit 57a80a7.
@lshqqytiger
minify override_ko.json
a671501
@vladmandic
persist hf and civitai tokens
92e7e74 
Signed-off-by: Vladimir Mandic <[email protected]>
@vladmandic
fix locale override merge
9686e08 
Signed-off-by: Vladimir Mandic <[email protected]>
@vladmandic
update nightly url
6270fd8 
Signed-off-by: Vladimir Mandic <[email protected]>
@vladmandic
global lancosz
640aff8 
Signed-off-by: Vladimir Mandic <[email protected]>
vladmandic and others added 24 commits February 14, 2025 15:33
@vladmandic
Merge pull request #3760 from Artheriax/automatic-color-inpaint
c430d32 
Automatic Color Inpaint
@vladmandic
update aci
896fab1 
Signed-off-by: Vladimir Mandic <[email protected]>
@vladmandic
add aci to changelog
8e5e592 
Signed-off-by: Vladimir Mandic <[email protected]>
@vladmandic
update aci
32fe60b 
Signed-off-by: Vladimir Mandic <[email protected]>
@lshqqytiger
fix zluda installer bug
f8de92e
@lshqqytiger
fix
067512b
@lshqqytiger
use symlink if possible
23134eb
@vladmandic
quick controlnet fix
227a419 
Signed-off-by: Vladimir Mandic <[email protected]>
@lshqqytiger
fix bug
9f59967
@lshqqytiger
remove unused import
09fa340
@Disty0
Set blaslt_tensile_libpath to empty string instead of None
dc551bf
@vladmandic
add joytag
1f2fc92 
Signed-off-by: Vladimir Mandic <[email protected]>
@vladmandic
add joycaption
abd439d 
Signed-off-by: Vladimir Mandic <[email protected]>
@vladmandic
update readme
c2ec624 
Signed-off-by: Vladimir Mandic <[email protected]>
@vladmandic
deepseek-vl2 experiments
8906f96 
Signed-off-by: Vladimir Mandic <[email protected]>
@vladmandic
update wiki
af3a5d9 
Signed-off-by: Vladimir Mandic <[email protected]>
@vladmandic
caption ui redesign
e95bd93 
Signed-off-by: Vladimir Mandic <[email protected]>
@vladmandic
vlm advanced settings and batch processing
f3dd9b9 
Signed-off-by: Vladimir Mandic <[email protected]>
@vladmandic
configurable request timeout
5e12985 
Signed-off-by: Vladimir Mandic <[email protected]>
@vladmandic
modernize clip interrogate
a4b3dc2 
Signed-off-by: Vladimir Mandic <[email protected]>
@vladmandic
update changelog and todo
41426c7 
Signed-off-by: Vladimir Mandic <[email protected]>
@vladmandic
caption tab modernui support
b699015 
Signed-off-by: Vladimir Mandic <[email protected]>
@vladmandic
configurable card sizes
60a7549 
Signed-off-by: Vladimir Mandic <[email protected]>
@vladmandic
update changelog
4d9d9cb 
Signed-off-by: Vladimir Mandic <[email protected]>
github-advanced-security[bot]
github-advanced-security bot found potential problems Feb 17, 2025
View reviewed changes
modules/interrogate/vqa.py
files += [f.name for f in batch_files]
if batch_folder is not None:
files += [f.name for f in batch_folder]
if batch_str is not None and len(batch_str) > 0 and os.path.exists(batch_str) and os.path.isdir(batch_str):

Check failure

Code scanning / CodeQL

Uncontrolled data used in path expression High

This path depends on a
user-provided value
Loading
.

Copilot Autofix AI 1 day ago

To fix the problem, we need to validate the batch_str path to ensure it is within a safe root directory. This involves normalizing the path and checking that it starts with the intended base path. We will implement this validation in the batch function before using the batch_str variable.

  1. Define a safe root directory for the batch operations.
  2. Normalize the batch_str path using os.path.normpath.
  3. Check that the normalized path starts with the safe root directory.
  4. Raise an exception if the path validation fails.
Suggested changeset 1
modules/interrogate/vqa.py

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/modules/interrogate/vqa.py b/modules/interrogate/vqa.py
--- a/modules/interrogate/vqa.py
+++ b/modules/interrogate/vqa.py
@@ -514,5 +514,9 @@
         files += [f.name for f in batch_folder]
-    if batch_str is not None and len(batch_str) > 0 and os.path.exists(batch_str) and os.path.isdir(batch_str):
+    if batch_str is not None and len(batch_str) > 0:
+        safe_root = '/server/static/images'  # Define a safe root directory
+        normalized_path = os.path.normpath(batch_str)
+        if not normalized_path.startswith(safe_root) or not os.path.exists(normalized_path) or not os.path.isdir(normalized_path):
+            raise Exception("Invalid batch_str path")
         from modules.files_cache import list_files
-        files += list(list_files(batch_str, ext_filter=['.png', '.jpg', '.jpeg', '.webp'], recursive=recursive))
+        files += list(list_files(normalized_path, ext_filter=['.png', '.jpg', '.jpeg', '.webp'], recursive=recursive))
     if len(files) == 0:
EOF
@@ -514,5 +514,9 @@
files += [f.name for f in batch_folder]
if batch_str is not None and len(batch_str) > 0 and os.path.exists(batch_str) and os.path.isdir(batch_str):
if batch_str is not None and len(batch_str) > 0:
safe_root = '/server/static/images' # Define a safe root directory
normalized_path = os.path.normpath(batch_str)
if not normalized_path.startswith(safe_root) or not os.path.exists(normalized_path) or not os.path.isdir(normalized_path):
raise Exception("Invalid batch_str path")
from modules.files_cache import list_files
files += list(list_files(batch_str, ext_filter=['.png', '.jpg', '.jpeg', '.webp'], recursive=recursive))
files += list(list_files(normalized_path, ext_filter=['.png', '.jpg', '.jpeg', '.webp'], recursive=recursive))
if len(files) == 0:
Copilot is powered by AI and may make mistakes. Always verify output.
Positive Feedback
Negative Feedback

Provide additional feedback

Please help us improve GitHub Copilot by sharing more details about this comment.

Please select one or more of the options
modules/interrogate/vqa.py
files += [f.name for f in batch_files]
if batch_folder is not None:
files += [f.name for f in batch_folder]
if batch_str is not None and len(batch_str) > 0 and os.path.exists(batch_str) and os.path.isdir(batch_str):

Check failure

Code scanning / CodeQL

Uncontrolled data used in path expression High

This path depends on a
user-provided value
Loading
.

Copilot Autofix AI 1 day ago

To fix the problem, we need to validate the batch_str path before using it. The best way to do this is to normalize the path using os.path.normpath and ensure it starts with a predefined safe root directory. This will prevent directory traversal attacks and ensure that the path is within the expected directory structure.

  1. Define a safe root directory.
  2. Normalize the batch_str path using os.path.normpath.
  3. Check if the normalized path starts with the safe root directory.
  4. If the path is not valid, raise an exception or handle the error appropriately.
Suggested changeset 1
modules/interrogate/vqa.py

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/modules/interrogate/vqa.py b/modules/interrogate/vqa.py
--- a/modules/interrogate/vqa.py
+++ b/modules/interrogate/vqa.py
@@ -514,5 +514,10 @@
         files += [f.name for f in batch_folder]
-    if batch_str is not None and len(batch_str) > 0 and os.path.exists(batch_str) and os.path.isdir(batch_str):
-        from modules.files_cache import list_files
-        files += list(list_files(batch_str, ext_filter=['.png', '.jpg', '.jpeg', '.webp'], recursive=recursive))
+    if batch_str is not None and len(batch_str) > 0:
+        safe_root = '/server/static/images'  # Define your safe root directory
+        normalized_path = os.path.normpath(batch_str)
+        if not normalized_path.startswith(safe_root):
+            raise Exception("Invalid path")
+        if os.path.exists(normalized_path) and os.path.isdir(normalized_path):
+            from modules.files_cache import list_files
+            files += list(list_files(normalized_path, ext_filter=['.png', '.jpg', '.jpeg', '.webp'], recursive=recursive))
     if len(files) == 0:
EOF
@@ -514,5 +514,10 @@
files += [f.name for f in batch_folder]
if batch_str is not None and len(batch_str) > 0 and os.path.exists(batch_str) and os.path.isdir(batch_str):
from modules.files_cache import list_files
files += list(list_files(batch_str, ext_filter=['.png', '.jpg', '.jpeg', '.webp'], recursive=recursive))
if batch_str is not None and len(batch_str) > 0:
safe_root = '/server/static/images' # Define your safe root directory
normalized_path = os.path.normpath(batch_str)
if not normalized_path.startswith(safe_root):
raise Exception("Invalid path")
if os.path.exists(normalized_path) and os.path.isdir(normalized_path):
from modules.files_cache import list_files
files += list(list_files(normalized_path, ext_filter=['.png', '.jpg', '.jpeg', '.webp'], recursive=recursive))
if len(files) == 0:
Copilot is powered by AI and may make mistakes. Always verify output.
Positive Feedback
Negative Feedback

Provide additional feedback

Please help us improve GitHub Copilot by sharing more details about this comment.

Please select one or more of the options
@vladmandic
style fix
d6cb50f 
Signed-off-by: Vladimir Mandic <[email protected]>
@vladmandic
update diffusers
1ee151b 
Signed-off-by: Vladimir Mandic <[email protected]>
@vladmandic
update changelog
5eb123d 
Signed-off-by: Vladimir Mandic <[email protected]>
@vladmandic
regenerate locales and rerun all translations
041f0bb 
Signed-off-by: Vladimir Mandic <[email protected]>
@vladmandic
add ras-sd35 experimental
6cf445d 
Signed-off-by: Vladimir Mandic <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
4 participants
@vladmandic @lshqqytiger @Disty0 @Artheriax