diff options
| author | Muhammad Rizqi Nur <rizqinur2010@gmail.com> | 2022-11-04 11:47:28 +0000 |
|---|---|---|
| committer | Muhammad Rizqi Nur <rizqinur2010@gmail.com> | 2022-11-04 11:47:28 +0000 |
| commit | 3277f90e933485d2590a55998480d02f9499be5c (patch) | |
| tree | ae1c4774a503ff0401a1589703f924fcbc59ee91 /webui.py | |
| parent | 31a98d0dc0a97640afa0611eb261ef9c3ba10532 (diff) | |
| parent | 81973091bc07c706d056809d89221bafcd01b38a (diff) | |
| download | stable-diffusion-webui-gfx803-3277f90e933485d2590a55998480d02f9499be5c.tar.gz stable-diffusion-webui-gfx803-3277f90e933485d2590a55998480d02f9499be5c.tar.bz2 stable-diffusion-webui-gfx803-3277f90e933485d2590a55998480d02f9499be5c.zip | |
Merge branch 'master' into gradient-clipping
Diffstat (limited to 'webui.py')
| -rw-r--r-- | webui.py | 6 |
1 files changed, 6 insertions, 0 deletions
@@ -141,6 +141,12 @@ def webui(): # after initial launch, disable --autolaunch for subsequent restarts
cmd_opts.autolaunch = False
+ # gradio uses a very open CORS policy via app.user_middleware, which makes it possible for
+ # an attacker to trick the user into opening a malicious HTML page, which makes a request to the
+ # running web ui and do whatever the attcker wants, including installing an extension and
+ # runnnig its code. We disable this here. Suggested by RyotaK.
+ app.user_middleware = [x for x in app.user_middleware if x.cls.__name__ != 'CORSMiddleware']
+
app.add_middleware(GZipMiddleware, minimum_size=1000)
if launch_api:
|