5 Commits

Include renames

Author	SHA1	Message	Date
Dr.Lt.DataandGitHub	4410ebc6a6	fix(security): harden CSRF with Content-Type gate and expand E2E coverage (#2818) ... Defense-in-depth over GET→POST alone: reject the three CORS-safelisted simple-form Content-Types (x-www-form-urlencoded, multipart/form-data, text/plain) on 16 no-body POST handlers (glob + legacy) to block <form method=POST> CSRF that bypasses method-only gating. Move comfyui_switch_version to a JSON body so the preflight requirement applies. Split db_mode/policy/update/channel_url_list into GET(read) + POST(write). Tighten do_fix (high → high+) and gate three previously-ungated config setters at middle. Resynchronize openapi.yaml (27 paths, 30 operations, ComfyUISwitchVersionParams as a shared $ref component). Add E2E harness variants, Playwright config, CSRF/secgate suites, 39-endpoint coverage, and a CHANGELOG. Breaking: legacy per-op POST routes (install/uninstall/fix/disable/update/ reinstall/abort_current) are removed; callers already use queue/batch. Legacy /manager/notice (v1) is removed; /v2/manager/notice is retained. Reported-by: XlabAI Team of Tencent Xuanwu Lab CVSS: 8.1 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H)	2026-04-22 05:04:30 +09:00
4 people	49e205acd4	feat: add pygit2 compatibility wrapper for standalone Desktop 2.0 installs (#2719) ... * feat: add pygit2 compatibility wrapper for standalone Desktop 2.0 installs Add git_compat.py abstraction layer that wraps both GitPython and pygit2 behind a unified GitRepo interface. When CM_USE_PYGIT2=1 is set (by the Desktop 2.0 Launcher for standalone installs), or when system git is not available, the pygit2 backend is used automatically. Key changes: - New comfyui_manager/common/git_compat.py with abstract GitRepo base class, _GitPythonRepo (1:1 pass-throughs) and _Pygit2Repo implementations - All 6 non-legacy files updated to use the wrapper: - comfyui_manager/glob/manager_core.py (14 git.Repo usages) - comfyui_manager/common/git_helper.py (7 git.Repo usages) - comfyui_manager/common/context.py (1 usage) - comfyui_manager/glob/utils/environment_utils.py (2 usages) - cm_cli/__main__.py (1 usage) - comfyui_manager/common/timestamp_utils.py (repo.heads usage) - get_script_env() propagates CM_USE_PYGIT2 to subprocesses - git_helper.py uses sys.path.insert to find git_compat as standalone script - All repo handles wrapped in context managers to prevent resource leaks - get_head_by_name returns _HeadProxy for interface consistency - Submodule fallback logs clear message when system git is absent - 47 tests comparing both backends via subprocess isolation Co-authored-by: Amp <amp@ampcode.com> Amp-Thread-ID: https://ampcode.com/threads/T-019d0ec5-cb9f-74df-a1a2-0c8154a330b3 * fix(pygit2): address review findings + bump version to 4.2b1 - C1: add submodule_update() after pygit2 clone for recursive parity - C2: check subprocess returncode in submodule_update fallback - C3: move GIT_OPT_SET_OWNER_VALIDATION to module-level (once at import) - H1: use context manager in git_pull() to prevent resource leaks - Bump version to 4.2b1, version_code to [4, 2] - Add pygit2 to dev dependencies and requirements.txt * style: fix ruff F841 unused variable and F541 unnecessary f-string --------- Co-authored-by: Amp <amp@ampcode.com> Co-authored-by: Dr.Lt.Data <dr.lt.data@gmail.com>	2026-03-27 08:42:26 +09:00
Dr.Lt.Data	b9def4cb6e	refactor: remove preview_method and component legacy features ... Preview Method Removal: - Remove preview method UI from Manager settings panel - Remove /v2/manager/preview_method API endpoint (legacy) - Remove set_preview_method() and get_current_preview_method() functions - Remove preview_method from config read/write operations - Clean up latent_preview imports Use ComfyUI Settings > Execution > Live preview method instead. Component Feature Removal: - Delete components-manager.js entirely - Remove ComponentBuilderDialog, load_components, set_component_policy - Remove component policy UI from Manager settings panel - Remove /v2/manager/policy/component API endpoint - Remove /v2/manager/component/save and /loads API endpoints - Remove component_policy from config read/write operations - Remove manager_components_path from context	2025-12-19 22:39:59 +09:00
bymyself	7f1ebbe081	[cleanup] Remove completed TODO comments and fix ruff issues ... - Removed completed TODO comments about code quality checks and client_id handling - Updated comments to reflect implemented features - Fixed ruff linting errors: - Removed duplicate constant definitions - Added missing locale import - Fixed unused imports - Moved is_local_mode logic to security_utils module - Added model_dir_name_map import to model_utils All ruff checks now pass successfully.	2025-06-13 19:37:57 -07:00
bymyself	601f1bf452	[feat] Add client_id support to task queue system ... - Add client_id field to QueueTaskItem and TaskHistoryItem models - Implement client-specific WebSocket message routing - Add client filtering to queue status and history endpoints - Follow ComfyUI patterns for session management - Create data_models package for better code organization	2025-06-13 19:33:05 -07:00