nopoz 6824fbb729 fix(gallery): validate upstream result image URLs ...

Validate image URLs returned by upstream diffusion/OpenAI responses before server-side fetches to prevent SSRF through result image retrieval.

2026-06-15 15:01:28 +09:00

..

__init__.py

Odysseus v1.0

2026-05-31 23:58:26 +09:00

_validators.py

fix(hwfit): validate remote SSH detection targets (#3718)

2026-06-11 00:43:49 +02:00

admin_wipe_routes.py

refactor(constants): single source of truth for data dir (#3368)

2026-06-08 09:58:52 +02:00

api_token_routes.py

fix(tokens): owner check on update and delete routes (#3899)

2026-06-11 15:34:44 +02:00

assistant_routes.py

Odysseus v1.0

2026-05-31 23:58:26 +09:00

auth_routes.py

fix(uploads): migrate upload ownership on rename (#3617)

2026-06-11 16:01:04 +02:00

backup_routes.py

fix: backup import dropping a user's skill on cross-tenant title/id collision (#2057)

2026-06-09 08:04:22 +02:00

calendar_routes.py

fix(calanders): Removed/merged duplicate calender delete endpoints (#3682)

2026-06-09 22:35:55 +02:00

chat_helpers.py

fix(chat): stabilize system prompt, sequence memory extraction, and send stable session id to preserve KV cache (#3360)

2026-06-09 22:46:54 +01:00

chat_routes.py

fix: read allow_bash/allow_web_search from JSON body (#3229) (#3281)

2026-06-11 19:14:41 +01:00

chatgpt_subscription_routes.py

feat: add ChatGPT Subscription provider (#2876)

2026-06-08 10:19:18 +02:00

cleanup_routes.py

Odysseus v1.0

2026-05-31 23:58:26 +09:00

codex_routes.py

fix(codex): validate stored SSH host and port

2026-06-15 15:01:03 +09:00

compare_routes.py

fix(endpoint): scope secondary endpoint lookups by owner

2026-06-08 11:51:55 +01:00

contacts_routes.py

fix(contacts): tolerate non-string body in /api/contacts/import (#3638)

2026-06-10 17:50:22 +02:00

cookbook_helpers.py

fix: detect HuggingFace token when downloading cookbook models (#3459)

2026-06-11 21:53:16 +01:00

cookbook_output.py

fix: expand cookbook error output tail from 12 to 50 lines (#1538)

2026-06-11 17:55:33 +01:00

cookbook_routes.py

fix: detect HuggingFace token when downloading cookbook models (#3459)

2026-06-11 21:53:16 +01:00

copilot_routes.py

feat: add ChatGPT Subscription provider (#2876)

2026-06-08 10:19:18 +02:00

device_flow.py

feat: add ChatGPT Subscription provider (#2876)

2026-06-08 10:19:18 +02:00

diagnostics_routes.py

feat(diagnostics): add consolidated service health endpoint for degraded-state reporting (#964)

2026-06-09 16:00:24 +01:00

document_helpers.py

fix: _resolve_user_upload_path crashes on a non-dict resolve_upload result (#1715)

2026-06-03 13:34:33 +09:00

document_routes.py

refactor(tools): extract document tools to handle registry (#3666)

2026-06-10 10:41:52 +02:00

editor_draft_routes.py

Ignore invalid editor draft payloads (#1533)

2026-06-03 14:07:03 +09:00

email_helpers.py

fix(email): scope learned sender signatures by owner (#3724)

2026-06-11 13:26:59 +02:00

email_pollers.py

fix: quote IMAP mailbox arguments (#2170)

2026-06-05 16:00:20 +02:00

email_routes.py

perf(email): run blocking IMAP routes in threadpool

2026-06-15 14:54:13 +09:00

embedding_routes.py

refactor(constants): single source of truth for data dir (#3368)

2026-06-08 09:58:52 +02:00

emoji_routes.py

refactor(constants): single source of truth for data dir (#3368)

2026-06-08 09:58:52 +02:00

font_routes.py

Keep compact font family names together (#1263)

2026-06-03 14:24:30 +09:00

gallery_helpers.py

fix(gallery): fail closed for null-user owner scope (#3613)

2026-06-09 20:20:21 +02:00

gallery_routes.py

fix(gallery): validate upstream result image URLs

2026-06-15 15:01:28 +09:00

history_routes.py

fix(sessions): copy message metadata when forking a session (#3409)

2026-06-08 20:49:15 +02:00

hwfit_routes.py

fix(hwfit): tolerate non-numeric gpu_count in /api/hwfit/models (#3639)

2026-06-11 01:01:58 +02:00

mcp_routes.py

refactor(constants): single source of truth for data dir (#3368)

2026-06-08 09:58:52 +02:00

memory_routes.py

fix(memory): validate session owner on manual add (#3807)

2026-06-11 15:44:10 +02:00

model_routes.py

fix(models): reassign default endpoint when current default is disabled (#3649)

2026-06-11 13:17:31 +02:00

note_routes.py

refactor(constants): single source of truth for data dir (#3368)

2026-06-08 09:58:52 +02:00

personal_routes.py

fix(personal): confine remove_directory_from_rag to PERSONAL_DIR

2026-06-15 15:00:35 +09:00

prefs_routes.py

refactor(constants): single source of truth for data dir (#3368)

2026-06-08 09:58:52 +02:00

preset_routes.py

fix(presets): scope expand-prompt model resolution to owner (#3477)

2026-06-08 21:12:02 +02:00

research_routes.py

fix(endpoint): scope secondary endpoint lookups by owner

2026-06-08 11:51:55 +01:00

search_routes.py

Odysseus v1.0

2026-05-31 23:58:26 +09:00

session_routes.py

fix(sessions): use owner_filter for list_sessions queries when auth disabled (#3622)

2026-06-10 17:07:07 +02:00

shell_routes.py

fix(cookbook): don't 500 the packages panel when an optional package crashes on import (#2618)

2026-06-07 18:14:43 +02:00

signature_routes.py

Constrain signature uploads to PNG data (#2844)

2026-06-05 13:17:43 +02:00

skills_routes.py

fix(presets): scope expand-prompt model resolution to owner (#3477)

2026-06-08 21:12:02 +02:00

stt_routes.py

refactor(uploads): centralize upload byte-limits in upload_limits.py (#3364) (#3518)

2026-06-09 01:24:30 +02:00

task_routes.py

Merge branch 'dev'

2026-06-09 09:36:01 +09:00

tts_routes.py

Odysseus v1.0

2026-05-31 23:58:26 +09:00

upload_routes.py

Scope vision model resolution by owner (#3009)

2026-06-07 12:39:02 +02:00

vault_routes.py

refactor(constants): single source of truth for data dir (#3368)

2026-06-08 09:58:52 +02:00

webhook_routes.py

feat: add ChatGPT Subscription provider (#2876)

2026-06-08 10:19:18 +02:00

workspace_routes.py

feat(agent): confine agent file/shell tools to a selectable workspace (#3665)

2026-06-11 18:17:54 +02:00