Set permissions of the temporary file to 666 before replacing.
ComfyUI could be used in a shared environment and the restricted permissions introduced by this temporary file creation makes it so that workflows and other files saved through this endpoint are inaccessible by others.
Write to a temp file in the same directory then os.replace() onto the
target path. If the process crashes mid-write, the original file is
left intact instead of being truncated to zero bytes.
Fixes#11298
* feat(security): add System User protection with `__` prefix
Add protected namespace for custom nodes to store sensitive data
(API keys, licenses) that cannot be accessed via HTTP endpoints.
Key changes:
- New API: get_system_user_directory() for internal access
- New API: get_public_user_directory() with structural blocking
- 3-layer defense: header validation, path blocking, creation prevention
- 54 tests covering security, edge cases, and backward compatibility
System Users use `__` prefix (e.g., __system, __cache) following
Python's private member convention. They exist in user_directory/
but are completely blocked from /userdata HTTP endpoints.
* style: remove unused imports
* Override user directory.
* Use overridden user directory.
* Remove prints.
* Remove references to global user_files.
* Remove unused replace_folder function.
* Remove newline.
* Remove global during get_user_directory.
* Add validation.
* menu
* wip
* wip
* wip
* wip
* wip
* workflow saving/loading
* Support inserting workflows
Move buttosn to top of lists
* fix session storage
implement renaming
* temp
* refactor, better workflow instance management
* wip
* progress on progress
* added send to workflow
various fixes
* Support multiple image loaders
* Support dynamic size breakpoints based on content
* various fixes
add close unsaved warning
* Add filtering tree
* prevent renaming unsaved
* fix zindex on hover
* fix top offset
* use filename as workflow name
* resize on setting change
* hide element until it is drawn
* remove glow
* Fix export name
* Fix test, revert accidental changes to groupNode
* Fix colors on all themes
* show hover items on smaller screen (mobile)
* remove debugging code
* dialog fix
* Dont reorder open workflows
Allow elements around canvas
* Toggle body display on setting change
* Fix menu disappearing on chrome
* Increase delay when typing, remove margin on Safari, fix dialog location
* Fix overflow issue on iOS
* Add reset view button
Prevent view changes causing history entries
* Bottom menu wip
* Various fixes
* Fix merge
* Fix breaking old menu position
* Fix merge adding restore view to loadGraphData
* wip per user data
* Rename, hide menu
* better error
rework default user
* store pretty
* Add userdata endpoints
Change nodetemplates to userdata
* add multi user message
* make normal arg
* Fix tests
* Ignore user dir
* user tests
* Changed to default to browser storage and add server-storage arg
* fix crash on empty templates
* fix settings added before load
* ignore parse errors
