ChuckandClaude Opus 5 15cc6926a4 fix(web): keep plugin asset and action routes inside their directories ...

POST /plugins/assets/upload, GET /plugins/assets/list and POST
/plugins/assets/delete joined the request's plugin_id onto assets/plugins
unchecked, so '../../config' created, wrote, listed and deleted outside
it. #561 guarded only the route that serves the files. All three now go
through path_safety.resolve_under and answer 400 for anything but a
plain name, and delete only unlinks a metadata path that resolves into
that plugin's uploads directory.

PluginManager.get_plugin_directory refuses ids that are not one plain
path segment, so /plugins/action (which runs a manifest script from the
returned directory) and every other caller get the guard; the action
route also rejects such ids up front, covering its no-manager fallback.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

2026-09-17 08:48:21 -04:00

..

api_v3

fix(web): keep plugin asset and action routes inside their directories

2026-09-17 08:48:21 -04:00

__init__.py

Plugins (#145)

2025-12-27 14:15:49 -05:00

pages_v3.py

fix(web): accept every panel size and row address type the rgbmatrix library does (#586)

2026-09-15 19:17:48 -04:00