fixed vulenerabilities

This commit is contained in:
Saifeddine ALOUI 2024-02-19 22:40:28 +01:00
parent e225c5e6e3
commit 475c076230
7 changed files with 90 additions and 17 deletions

3
app.py
View File

@ -87,6 +87,7 @@ if __name__ == "__main__":
from lollms.server.endpoints.lollms_sd import router as lollms_sd_router
from lollms.server.endpoints.lollms_ollama import router as lollms_ollama_router
from lollms.server.endpoints.lollms_vllm import router as lollms_vllm_router
from lollms.server.endpoints.lollms_motion_ctrl import router as lollms_motion_ctrl
from endpoints.lollms_webui_infos import router as lollms_webui_infos_router
from endpoints.lollms_discussion import router as lollms_discussion_router
@ -137,6 +138,8 @@ if __name__ == "__main__":
app.include_router(lollms_ollama_router)
app.include_router(lollms_petals_router)
app.include_router(lollms_vllm_router)
app.include_router(lollms_motion_ctrl)
app.include_router(lollms_playground_router)
app.include_router(lollms_configuration_infos_router)

View File

@ -70,7 +70,7 @@ async def execute_code(request: CodeRequest):
if lollmsElfServer.config.headless_server_mode:
return {"status":False,"error":"Code execution is blocked when in headless mode for obvious security reasons!"}
if lollmsElfServer.config.host=="0.0.0.0":
if lollmsElfServer.config.host!="localhost"::
return {"status":False,"error":"Code execution is blocked when the server is exposed outside for very obvious reasons!"}
if not lollmsElfServer.config.turn_on_code_execution:
@ -134,7 +134,7 @@ async def open_code_folder_in_vs_code(request: OpenCodeFolderInVsCodeRequestMode
if lollmsElfServer.config.headless_server_mode:
return {"status":False,"error":"Open code folder in vscode is blocked when in headless mode for obvious security reasons!"}
if lollmsElfServer.config.host=="0.0.0.0":
if lollmsElfServer.config.host!="localhost"::
return {"status":False,"error":"Open code folder in vscode is blocked when the server is exposed outside for very obvious reasons!"}
if lollmsElfServer.config.turn_on_open_file_validation:
@ -180,7 +180,7 @@ async def open_file(file_path: FilePath):
if lollmsElfServer.config.headless_server_mode:
return {"status":False,"error":"Open file is blocked when in headless mode for obvious security reasons!"}
if lollmsElfServer.config.host=="0.0.0.0":
if lollmsElfServer.config.host!="localhost"::
return {"status":False,"error":"Open file is blocked when the server is exposed outside for very obvious reasons!"}
if lollmsElfServer.config.turn_on_open_file_validation:
@ -225,7 +225,7 @@ async def open_code_in_vs_code(vs_code_data: VSCodeData):
if lollmsElfServer.config.headless_server_mode:
return {"status":False,"error":"Open code in vs code is blocked when in headless mode for obvious security reasons!"}
if lollmsElfServer.config.host=="0.0.0.0":
if lollmsElfServer.config.host!="localhost"::
return {"status":False,"error":"Open code in vs code is blocked when the server is exposed outside for very obvious reasons!"}
if lollmsElfServer.config.turn_on_open_file_validation:
@ -269,7 +269,7 @@ async def open_code_folder(request: FolderRequest):
if lollmsElfServer.config.headless_server_mode:
return {"status":False,"error":"Open code folder is blocked when in headless mode for obvious security reasons!"}
if lollmsElfServer.config.host=="0.0.0.0":
if lollmsElfServer.config.host!="localhost"::
return {"status":False,"error":"Open code folder is blocked when the server is exposed outside for very obvious reasons!"}
if lollmsElfServer.config.turn_on_open_file_validation:
@ -321,7 +321,7 @@ def start_recording():
if lollmsElfServer.config.headless_server_mode:
return {"status":False,"error":"Start recording is blocked when in headless mode for obvious security reasons!"}
if lollmsElfServer.config.host=="0.0.0.0":
if lollmsElfServer.config.host!="localhost"::
return {"status":False,"error":"Start recording is blocked when the server is exposed outside for very obvious reasons!"}
lollmsElfServer.info("Starting audio capture")
@ -341,7 +341,7 @@ def stop_recording():
if lollmsElfServer.config.headless_server_mode:
return {"status":False,"error":"Stop recording is blocked when in headless mode for obvious security reasons!"}
if lollmsElfServer.config.host=="0.0.0.0":
if lollmsElfServer.config.host!="localhost"::
return {"status":False,"error":"Stop recording is blocked when the server is exposed outside for very obvious reasons!"}
lollmsElfServer.info("Stopping audio capture")

View File

@ -38,7 +38,7 @@ async def restart_program():
if lollmsElfServer.config.headless_server_mode:
return {"status":False,"error":"Restarting app is blocked when in headless mode for obvious security reasons!"}
if lollmsElfServer.config.host=="0.0.0.0":
if lollmsElfServer.config.host!="localhost"::
return {"status":False,"error":"Restarting app is blocked when the server is exposed outside for very obvious reasons!"}
lollmsElfServer.ShowBlockingMessage("Restarting program.\nPlease stand by...")
@ -65,7 +65,7 @@ async def update_software():
if lollmsElfServer.config.headless_server_mode:
return {"status":False,"error":"Updating app is blocked when in headless mode for obvious security reasons!"}
if lollmsElfServer.config.host=="0.0.0.0":
if lollmsElfServer.config.host!="localhost"::
return {"status":False,"error":"Updating app is blocked when the server is exposed outside for very obvious reasons!"}
# Display an informative message
@ -95,7 +95,7 @@ def check_update():
if lollmsElfServer.config.headless_server_mode:
return {"status":False,"error":"Checking updates is blocked when in headless mode for obvious security reasons!"}
if lollmsElfServer.config.host=="0.0.0.0":
if lollmsElfServer.config.host!="localhost"::
return {"status":False,"error":"Checking updates is blocked when the server is exposed outside for very obvious reasons!"}
if lollmsElfServer.config.auto_update:

@ -1 +1 @@
Subproject commit da2d2d9a6357891f06f39712593c999fdb270f4a
Subproject commit a20a3f67ed6cda1eba1fb6139920a7d9e1a3306f

View File

@ -261,10 +261,7 @@ class LOLLMSWebUI(LOLLMSElfServer):
ASCIIColors.blue(f"Your personal data is stored here :",end="")
ASCIIColors.green(f"{self.lollms_paths.personal_path}")
self.start_servers(
load_sd_service=load_sd_service,
load_voice_service=load_voice_service
)
self.start_servers()
def get_uploads_path(self, client_id):
return self.db.discussion_db_path/f'{self.connections[client_id]["current_discussion"].discussion_id}'

View File

@ -1237,6 +1237,59 @@
</tr>
</table>
</Card>
<Card title="Motion Ctrl service" :is_subcard="true" class="pb-2 m-2">
<table class="bg-gray-50 border border-gray-300 text-gray-900 text-sm rounded-lg focus:ring-blue-500 focus:border-blue-500 block w-full p-2.5 dark:bg-gray-700 dark:border-gray-600 dark:placeholder-gray-400 dark:text-white dark:focus:ring-blue-500 dark:focus:border-blue-500">
<tr>
<td style="min-width: 200px;">
<label for="enable_sd_service" class="text-sm font-bold" style="margin-right: 1rem;">Enable Motion Ctrl service:</label>
</td>
<td>
<div class="flex flex-row">
<input
type="checkbox"
id="enable_motion_ctrl_service"
required
v-model="configFile.enable_motion_ctrl_service"
@change="settingsChanged=true"
class="mt-1 px-2 py-1 border border-gray-300 rounded dark:bg-gray-600"
>
</div>
</td>
<td>
<div class="hover:text-secondary duration-75 active:scale-90 peer-checked:text-primary" @click="this.$store.state.messageBox.showMessage('Activates Motion ctrl service. The service will be automatically loaded at startup alowing you to use the motoin control endpoint to generate videos')">
<i data-feather="help-circle" class="w-5 h-5 "></i>
</div>
</td>
</tr>
<tr>
<td style="min-width: 200px;">
<label for="install_sd_service" class="text-sm font-bold" style="margin-right: 1rem;">Install Motion Ctrl service:</label>
</td>
<td>
<div class="flex flex-row">
<button class="hover:text-primary bg-green-200 rounded-lg p-4 m-4 w-full text-center items-center" @click="reinstallMotionCtrlService">install Motion Ctrl service</button>
</div>
</td>
</tr>
<tr>
<td style="min-width: 200px;">
<label for="sd_base_url" class="text-sm font-bold" style="margin-right: 1rem;">sd base url:</label>
</td>
<td>
<div class="flex flex-row">
<input
type="text"
id="sd_base_url"
required
v-model="configFile.sd_base_url"
@change="settingsChanged=true"
class="mt-1 px-2 py-1 border border-gray-300 rounded dark:bg-gray-600"
>
</div>
</td>
</tr>
</table>
</Card>
<Card title="Ollama service" :is_subcard="true" class="pb-2 m-2">
<table class="bg-gray-50 border border-gray-300 text-gray-900 text-sm rounded-lg focus:ring-blue-500 focus:border-blue-500 block w-full p-2.5 dark:bg-gray-700 dark:border-gray-600 dark:placeholder-gray-400 dark:text-white dark:focus:ring-blue-500 dark:focus:border-blue-500">
<tr>
@ -1268,6 +1321,7 @@
<td>
<div class="flex flex-row">
<button class="hover:text-primary bg-green-200 rounded-lg p-4 m-4 w-full text-center items-center" @click="reinstallOLLAMAService">install olama service</button>
<button class="hover:text-primary bg-green-200 rounded-lg p-4 m-4 w-full text-center items-center" @click="startvLLMService">start vLLM service</button>
</div>
</td>
</tr>
@ -1321,7 +1375,7 @@
<td>
<div class="flex flex-row">
<button class="hover:text-primary bg-green-200 rounded-lg p-4 m-4 w-full text-center items-center" @click="reinstallvLLMService">install vLLM service</button>
<button class="hover:text-primary bg-green-200 rounded-lg p-4 m-4 w-full text-center items-center" @click="startvLLMService">start vLLM service</button>
<button class="hover:text-primary bg-green-200 rounded-lg p-4 m-4 w-full text-center items-center" @click="startollamaService">start ollama service</button>
</div>
</td>
</tr>
@ -2665,6 +2719,15 @@ export default {
});
},
reinstallMotionCtrlService(){
axios.get('install_motion_ctrl')
.then(response => {
})
.catch(error => {
console.error(error);
});
},
reinstallvLLMService(){
axios.get('install_vllm')
.then(response => {
@ -2684,6 +2747,16 @@ export default {
console.error(error);
});
},
startollamaService(){
axios.get('start_ollama')
.then(response => {
})
.catch(error => {
console.error(error);
});
},
reinstallPetalsService(){
axios.get('install_petals')

@ -1 +1 @@
Subproject commit b735b80a1c700effcf20d9a35af023270e803439
Subproject commit 21db25a0707d5cb56b03743dd4af60ed8e1daa91