InvokeAI 6.13.0rc2__tar.gz → 6.13.5__tar.gz

{invokeai-6.13.0rc2 → invokeai-6.13.5}/InvokeAI.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: InvokeAI
-Version: 6.13.0rc2
+Version: 6.13.5
 Summary: A full-featured AI-assisted image generation environment designed for creatives and enthusiasts.
 Author-email: Invoke <support@invoke.ai>
 License:                                  Apache License
@@ -211,7 +211,7 @@ License-File: LICENSE-SD1+SD2.txt
 License-File: LICENSE-SDXL.txt
 Requires-Dist: accelerate
 Requires-Dist: bitsandbytes; sys_platform != "darwin"
-Requires-Dist: compel==2.1.1
+Requires-Dist: compel<3,>=2.4.0
 Requires-Dist: diffusers[torch]==0.37.0
 Requires-Dist: gguf
 Requires-Dist: mediapipe==0.10.14
@@ -222,10 +222,11 @@ Requires-Dist: opencv-contrib-python
 Requires-Dist: safetensors
 Requires-Dist: sentencepiece==0.2.0
 Requires-Dist: spandrel
-Requires-Dist: torch~=2.7.0
+Requires-Dist: torch<3.0,>=2.7.0; sys_platform != "darwin"
+Requires-Dist: torch<2.8.0,>=2.7.0; sys_platform == "darwin"
 Requires-Dist: torchsde
 Requires-Dist: torchvision
-Requires-Dist: transformers>=4.56.0
+Requires-Dist: transformers<5.6,>=5.5
 Requires-Dist: fastapi-events
 Requires-Dist: fastapi==0.118.3
 Requires-Dist: huggingface-hub
@@ -259,9 +260,9 @@ Provides-Extra: cuda
 Requires-Dist: torch==2.7.1+cu128; extra == "cuda"
 Requires-Dist: torchvision==0.22.1+cu128; extra == "cuda"
 Provides-Extra: rocm
-Requires-Dist: torch==2.7.1+rocm6.3; extra == "rocm"
-Requires-Dist: torchvision==0.22.1+rocm6.3; extra == "rocm"
-Requires-Dist: pytorch-triton-rocm; extra == "rocm"
+Requires-Dist: torch==2.10.0+rocm7.1; sys_platform == "linux" and extra == "rocm"
+Requires-Dist: torchvision==0.25.0+rocm7.1; sys_platform == "linux" and extra == "rocm"
+Requires-Dist: triton-rocm==3.6.0; sys_platform == "linux" and extra == "rocm"
 Provides-Extra: onnx
 Requires-Dist: onnxruntime; extra == "onnx"
 Provides-Extra: onnx-cuda
@@ -272,11 +273,6 @@ Provides-Extra: dist
 Requires-Dist: pip-tools; extra == "dist"
 Requires-Dist: pipdeptree; extra == "dist"
 Requires-Dist: twine; extra == "dist"
-Provides-Extra: docs
-Requires-Dist: mkdocs-material>=9.5.36; extra == "docs"
-Requires-Dist: mkdocs-git-revision-date-localized-plugin; extra == "docs"
-Requires-Dist: mkdocs-redirects; extra == "docs"
-Requires-Dist: mkdocstrings[python]>=0.26.1; extra == "docs"
 Provides-Extra: dev
 Requires-Dist: jurigged; extra == "dev"
 Requires-Dist: pudb; extra == "dev"
@@ -399,6 +395,15 @@ Get started with contributing by reading our [contribution documentation][contri
 
 We hope you enjoy using Invoke as much as we enjoy creating it, and we hope you will elect to become part of our community.
 
+## Sponsors
+
+Invoke's open-source development is powered by our sponsors. If Invoke is valuable to you or your business, please consider [sponsoring us][sponsor link] — it directly funds maintenance, new features, and community support.
+
+<!-- Sponsor logos can be added below, or automated with a GitHub Action
+     such as `JamesIves/github-sponsors-readme-action` to keep them in sync. -->
+
+[![Sponsor Invoke](https://img.shields.io/badge/Sponsor-Invoke-ea4aaa?logo=githubsponsors&logoColor=white)][sponsor link]
+
 ## Thanks
 
 Invoke is a combined effort of [passionate and talented people from across the world][contributors]. We thank them for their time, hard work and effort.
@@ -411,6 +416,7 @@ Original portions of the software are Copyright © 2024 by respective contributo
 [github issues]: https://github.com/invoke-ai/InvokeAI/issues
 [docs home]: https://invoke.ai
 [installation docs]: https://invoke.ai/start-here/installation/
+[sponsor link]: https://github.com/sponsors/invoke-ai
 [#dev-chat]: https://discord.com/channels/1020123559063990373/1049495067846524939
 [contributing docs]: https://invoke.ai/contributing/
 [CI checks on main badge]: https://flat.badgen.net/github/checks/invoke-ai/InvokeAI/main?label=CI%20status%20on%20main&cache=900&icon=github

{invokeai-6.13.0rc2 → invokeai-6.13.5}/InvokeAI.egg-info/SOURCES.txt

@@ -17,6 +17,7 @@ invokeai/app/api/dependencies.py
 invokeai/app/api/extract_metadata_from_image.py
 invokeai/app/api/no_cache_staticfiles.py
 invokeai/app/api/sockets.py
+invokeai/app/api/routers/_access.py
 invokeai/app/api/routers/app_info.py
 invokeai/app/api/routers/auth.py
 invokeai/app/api/routers/board_images.py
@@ -94,6 +95,7 @@ invokeai/app/invocations/image_panels.py
 invokeai/app/invocations/image_to_latents.py
 invokeai/app/invocations/infill.py
 invokeai/app/invocations/ip_adapter.py
+invokeai/app/invocations/latent_noise.py
 invokeai/app/invocations/latents_to_image.py
 invokeai/app/invocations/lineart.py
 invokeai/app/invocations/lineart_anime.py
@@ -299,6 +301,7 @@ invokeai/app/services/shared/sqlite_migrator/migrations/migration_29.py
 invokeai/app/services/shared/sqlite_migrator/migrations/migration_3.py
 invokeai/app/services/shared/sqlite_migrator/migrations/migration_30.py
 invokeai/app/services/shared/sqlite_migrator/migrations/migration_31.py
+invokeai/app/services/shared/sqlite_migrator/migrations/migration_32.py
 invokeai/app/services/shared/sqlite_migrator/migrations/migration_4.py
 invokeai/app/services/shared/sqlite_migrator/migrations/migration_5.py
 invokeai/app/services/shared/sqlite_migrator/migrations/migration_6.py
@@ -367,6 +370,7 @@ invokeai/app/shared/models.py
 invokeai/app/util/__init__.py
 invokeai/app/util/controlnet_utils.py
 invokeai/app/util/custom_openapi.py
+invokeai/app/util/dynamicprompts.py
 invokeai/app/util/metaenum.py
 invokeai/app/util/misc.py
 invokeai/app/util/model_exclude_null.py
@@ -393,6 +397,10 @@ invokeai/backend/anima/anima_transformer_patch.py
 invokeai/backend/anima/conditioning_data.py
 invokeai/backend/anima/regional_prompting.py
 invokeai/backend/anima/scheduler_driver.py
+invokeai/backend/anima/t5_tokenizer.py
+invokeai/backend/anima/tokenizer/special_tokens_map.json
+invokeai/backend/anima/tokenizer/tokenizer.json
+invokeai/backend/anima/tokenizer/tokenizer_config.json
 invokeai/backend/flux/custom_block_processor.py
 invokeai/backend/flux/denoise.py
 invokeai/backend/flux/flux_state_dict_utils.py
@@ -436,6 +444,7 @@ invokeai/backend/flux2/ref_image_extension.py
 invokeai/backend/flux2/sampling_utils.py
 invokeai/backend/image_util/__init__.py
 invokeai/backend/image_util/canny.py
+invokeai/backend/image_util/color_conversion.py
 invokeai/backend/image_util/composition.py
 invokeai/backend/image_util/content_shuffle.py
 invokeai/backend/image_util/controlnet_processor.py
@@ -656,6 +665,7 @@ invokeai/backend/patches/lora_conversions/flux_onetrainer_lora_conversion_utils.
 invokeai/backend/patches/lora_conversions/flux_xlabs_lora_conversion_utils.py
 invokeai/backend/patches/lora_conversions/formats.py
 invokeai/backend/patches/lora_conversions/kohya_key_utils.py
+invokeai/backend/patches/lora_conversions/peft_adapter_utils.py
 invokeai/backend/patches/lora_conversions/qwen_image_lora_constants.py
 invokeai/backend/patches/lora_conversions/qwen_image_lora_conversion_utils.py
 invokeai/backend/patches/lora_conversions/sd_lora_conversion_utils.py
@@ -753,19 +763,20 @@ invokeai/frontend/install/__init__.py
 invokeai/frontend/install/import_images.py
 invokeai/frontend/web/__init__.py
 invokeai/frontend/web/dist/index.html
-invokeai/frontend/web/dist/assets/App-CUtkwK_R.css
-invokeai/frontend/web/dist/assets/App-_oasd7BR.js
-invokeai/frontend/web/dist/assets/browser-ponyfill-C5aUvZrv.js
+invokeai/frontend/web/dist/assets/App-D9NhDLr1.js
+invokeai/frontend/web/dist/assets/App-tn1JZtBo.css
+invokeai/frontend/web/dist/assets/browser-ponyfill-BpMPqZAt.js
+invokeai/frontend/web/dist/assets/chunk-jRWAZmH_.js
 invokeai/frontend/web/dist/assets/denoising-strength-4mznP2tj.png
-invokeai/frontend/web/dist/assets/index-8XKo2diT.js
-invokeai/frontend/web/dist/assets/inter-cyrillic-ext-wght-normal-B2xhLi22.woff2
-invokeai/frontend/web/dist/assets/inter-cyrillic-wght-normal-CMZtQduZ.woff2
-invokeai/frontend/web/dist/assets/inter-greek-ext-wght-normal-CGAr0uHJ.woff2
-invokeai/frontend/web/dist/assets/inter-greek-wght-normal-CaVNZxsx.woff2
+invokeai/frontend/web/dist/assets/index-m5FbyQXs.js
+invokeai/frontend/web/dist/assets/inter-cyrillic-ext-wght-normal-BOeWTOD4.woff2
+invokeai/frontend/web/dist/assets/inter-cyrillic-wght-normal-DqGufNeO.woff2
+invokeai/frontend/web/dist/assets/inter-greek-ext-wght-normal-DlzME5K_.woff2
+invokeai/frontend/web/dist/assets/inter-greek-wght-normal-CkhJZR-_.woff2
 invokeai/frontend/web/dist/assets/inter-latin-ext-wght-normal-DO1Apj_S.woff2
 invokeai/frontend/web/dist/assets/inter-latin-wght-normal-Dx4kXJAl.woff2
 invokeai/frontend/web/dist/assets/inter-vietnamese-wght-normal-CBcvBZtf.woff2
-invokeai/frontend/web/dist/assets/worker-Dywf1EVc.js
+invokeai/frontend/web/dist/assets/worker-DrJIfe_t.js
 invokeai/frontend/web/dist/assets/images/commercial-license-bg.png
 invokeai/frontend/web/dist/assets/images/denoising-strength.png
 invokeai/frontend/web/dist/assets/images/invoke-alert-favicon.svg
@@ -824,7 +835,6 @@ invokeai/version/invokeai_version.py
 tests/test_asyncio_shutdown.py
 tests/test_config.py
 tests/test_dangerously_run_function_in_subprocess.py
-tests/test_docs.py
 tests/test_docs_json_export.py
 tests/test_graph_execution_state.py
 tests/test_imports.py

{invokeai-6.13.0rc2 → invokeai-6.13.5}/InvokeAI.egg-info/requires.txt

@@ -1,5 +1,5 @@
 accelerate
-compel==2.1.1
+compel<3,>=2.4.0
 diffusers[torch]==0.37.0
 gguf
 mediapipe==0.10.14
@@ -10,10 +10,9 @@ opencv-contrib-python
 safetensors
 sentencepiece==0.2.0
 spandrel
-torch~=2.7.0
 torchsde
 torchvision
-transformers>=4.56.0
+transformers<5.6,>=5.5
 fastapi-events
 fastapi==0.118.3
 huggingface-hub
@@ -41,6 +40,10 @@ PyWavelets
 
 [:sys_platform != "darwin"]
 bitsandbytes
+torch<3.0,>=2.7.0
+
+[:sys_platform == "darwin"]
+torch<2.8.0,>=2.7.0
 
 [cpu]
 torch==2.7.1+cpu
@@ -61,12 +64,6 @@ pip-tools
 pipdeptree
 twine
 
-[docs]
-mkdocs-material>=9.5.36
-mkdocs-git-revision-date-localized-plugin
-mkdocs-redirects
-mkdocstrings[python]>=0.26.1
-
 [onnx]
 onnxruntime
 
@@ -77,9 +74,11 @@ onnxruntime-gpu
 onnxruntime-directml
 
 [rocm]
-torch==2.7.1+rocm6.3
-torchvision==0.22.1+rocm6.3
-pytorch-triton-rocm
+
+[rocm:sys_platform == "linux"]
+torch==2.10.0+rocm7.1
+torchvision==0.25.0+rocm7.1
+triton-rocm==3.6.0
 
 [test]
 ruff~=0.11.2

{invokeai-6.13.0rc2 → invokeai-6.13.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: InvokeAI
-Version: 6.13.0rc2
+Version: 6.13.5
 Summary: A full-featured AI-assisted image generation environment designed for creatives and enthusiasts.
 Author-email: Invoke <support@invoke.ai>
 License:                                  Apache License
@@ -211,7 +211,7 @@ License-File: LICENSE-SD1+SD2.txt
 License-File: LICENSE-SDXL.txt
 Requires-Dist: accelerate
 Requires-Dist: bitsandbytes; sys_platform != "darwin"
-Requires-Dist: compel==2.1.1
+Requires-Dist: compel<3,>=2.4.0
 Requires-Dist: diffusers[torch]==0.37.0
 Requires-Dist: gguf
 Requires-Dist: mediapipe==0.10.14
@@ -222,10 +222,11 @@ Requires-Dist: opencv-contrib-python
 Requires-Dist: safetensors
 Requires-Dist: sentencepiece==0.2.0
 Requires-Dist: spandrel
-Requires-Dist: torch~=2.7.0
+Requires-Dist: torch<3.0,>=2.7.0; sys_platform != "darwin"
+Requires-Dist: torch<2.8.0,>=2.7.0; sys_platform == "darwin"
 Requires-Dist: torchsde
 Requires-Dist: torchvision
-Requires-Dist: transformers>=4.56.0
+Requires-Dist: transformers<5.6,>=5.5
 Requires-Dist: fastapi-events
 Requires-Dist: fastapi==0.118.3
 Requires-Dist: huggingface-hub
@@ -259,9 +260,9 @@ Provides-Extra: cuda
 Requires-Dist: torch==2.7.1+cu128; extra == "cuda"
 Requires-Dist: torchvision==0.22.1+cu128; extra == "cuda"
 Provides-Extra: rocm
-Requires-Dist: torch==2.7.1+rocm6.3; extra == "rocm"
-Requires-Dist: torchvision==0.22.1+rocm6.3; extra == "rocm"
-Requires-Dist: pytorch-triton-rocm; extra == "rocm"
+Requires-Dist: torch==2.10.0+rocm7.1; sys_platform == "linux" and extra == "rocm"
+Requires-Dist: torchvision==0.25.0+rocm7.1; sys_platform == "linux" and extra == "rocm"
+Requires-Dist: triton-rocm==3.6.0; sys_platform == "linux" and extra == "rocm"
 Provides-Extra: onnx
 Requires-Dist: onnxruntime; extra == "onnx"
 Provides-Extra: onnx-cuda
@@ -272,11 +273,6 @@ Provides-Extra: dist
 Requires-Dist: pip-tools; extra == "dist"
 Requires-Dist: pipdeptree; extra == "dist"
 Requires-Dist: twine; extra == "dist"
-Provides-Extra: docs
-Requires-Dist: mkdocs-material>=9.5.36; extra == "docs"
-Requires-Dist: mkdocs-git-revision-date-localized-plugin; extra == "docs"
-Requires-Dist: mkdocs-redirects; extra == "docs"
-Requires-Dist: mkdocstrings[python]>=0.26.1; extra == "docs"
 Provides-Extra: dev
 Requires-Dist: jurigged; extra == "dev"
 Requires-Dist: pudb; extra == "dev"
@@ -399,6 +395,15 @@ Get started with contributing by reading our [contribution documentation][contri
 
 We hope you enjoy using Invoke as much as we enjoy creating it, and we hope you will elect to become part of our community.
 
+## Sponsors
+
+Invoke's open-source development is powered by our sponsors. If Invoke is valuable to you or your business, please consider [sponsoring us][sponsor link] — it directly funds maintenance, new features, and community support.
+
+<!-- Sponsor logos can be added below, or automated with a GitHub Action
+     such as `JamesIves/github-sponsors-readme-action` to keep them in sync. -->
+
+[![Sponsor Invoke](https://img.shields.io/badge/Sponsor-Invoke-ea4aaa?logo=githubsponsors&logoColor=white)][sponsor link]
+
 ## Thanks
 
 Invoke is a combined effort of [passionate and talented people from across the world][contributors]. We thank them for their time, hard work and effort.
@@ -411,6 +416,7 @@ Original portions of the software are Copyright © 2024 by respective contributo
 [github issues]: https://github.com/invoke-ai/InvokeAI/issues
 [docs home]: https://invoke.ai
 [installation docs]: https://invoke.ai/start-here/installation/
+[sponsor link]: https://github.com/sponsors/invoke-ai
 [#dev-chat]: https://discord.com/channels/1020123559063990373/1049495067846524939
 [contributing docs]: https://invoke.ai/contributing/
 [CI checks on main badge]: https://flat.badgen.net/github/checks/invoke-ai/InvokeAI/main?label=CI%20status%20on%20main&cache=900&icon=github

{invokeai-6.13.0rc2 → invokeai-6.13.5}/README.md

@@ -100,6 +100,15 @@ Get started with contributing by reading our [contribution documentation][contri
 
 We hope you enjoy using Invoke as much as we enjoy creating it, and we hope you will elect to become part of our community.
 
+## Sponsors
+
+Invoke's open-source development is powered by our sponsors. If Invoke is valuable to you or your business, please consider [sponsoring us][sponsor link] — it directly funds maintenance, new features, and community support.
+
+<!-- Sponsor logos can be added below, or automated with a GitHub Action
+     such as `JamesIves/github-sponsors-readme-action` to keep them in sync. -->
+
+[![Sponsor Invoke](https://img.shields.io/badge/Sponsor-Invoke-ea4aaa?logo=githubsponsors&logoColor=white)][sponsor link]
+
 ## Thanks
 
 Invoke is a combined effort of [passionate and talented people from across the world][contributors]. We thank them for their time, hard work and effort.
@@ -112,6 +121,7 @@ Original portions of the software are Copyright © 2024 by respective contributo
 [github issues]: https://github.com/invoke-ai/InvokeAI/issues
 [docs home]: https://invoke.ai
 [installation docs]: https://invoke.ai/start-here/installation/
+[sponsor link]: https://github.com/sponsors/invoke-ai
 [#dev-chat]: https://discord.com/channels/1020123559063990373/1049495067846524939
 [contributing docs]: https://invoke.ai/contributing/
 [CI checks on main badge]: https://flat.badgen.net/github/checks/invoke-ai/InvokeAI/main?label=CI%20status%20on%20main&cache=900&icon=github

{invokeai-6.13.0rc2 → invokeai-6.13.5}/invokeai/app/api/extract_metadata_from_image.py

@@ -48,7 +48,11 @@ def extract_metadata_from_image(
     stringified_metadata: str | None = None
 
     # Use the metadata override if provided, else attempt to extract it from the image file.
-    metadata_raw = invokeai_metadata_override or pil_image.info.get("invokeai_metadata", None)
+    metadata_raw = (
+        invokeai_metadata_override
+        if invokeai_metadata_override is not None
+        else pil_image.info.get("invokeai_metadata", None)
+    )
 
     # If the metadata is present in the image file, we will attempt to parse it as JSON. When we create images,
     # we always store metadata as a stringified JSON dict. So, we expect it to be a string here.
@@ -66,7 +70,11 @@ def extract_metadata_from_image(
 
     # We expect the workflow, if embedded in the image, to be a JSON-stringified WorkflowWithoutID. We will store it
     # as a string.
-    workflow_raw: str | None = invokeai_workflow_override or pil_image.info.get("invokeai_workflow", None)
+    workflow_raw: str | None = (
+        invokeai_workflow_override
+        if invokeai_workflow_override is not None
+        else pil_image.info.get("invokeai_workflow", None)
+    )
 
     # The fallback value for workflow is None.
     stringified_workflow: str | None = None
@@ -85,7 +93,9 @@ def extract_metadata_from_image(
 
     # We expect the workflow, if embedded in the image, to be a JSON-stringified Graph. We will store it as a
     # string.
-    graph_raw: str | None = invokeai_graph_override or pil_image.info.get("invokeai_graph", None)
+    graph_raw: str | None = (
+        invokeai_graph_override if invokeai_graph_override is not None else pil_image.info.get("invokeai_graph", None)
+    )
 
     # The fallback value for graph is None.
     stringified_graph: str | None = None

invokeai-6.13.5/invokeai/app/api/routers/_access.py

@@ -0,0 +1,92 @@
+"""Cross-router authorization helpers.
+
+These helpers are imported by multiple router modules. Keep them free of router
+specifics so any route can call them after resolving `current_user`.
+"""
+
+from fastapi import HTTPException
+
+from invokeai.app.api.auth_dependencies import CurrentUserOrDefault
+from invokeai.app.api.dependencies import ApiDependencies
+from invokeai.app.services.board_records.board_records_common import BoardVisibility
+
+
+def assert_image_owner(image_name: str, current_user: CurrentUserOrDefault) -> None:
+    """Raise 403 if the current user does not own the image and is not an admin.
+
+    Ownership is satisfied when ANY of these hold:
+    - The user is an admin.
+    - The user is the image's direct owner (image_records.user_id).
+    - The user owns the board the image sits on.
+    - The image sits on a Public board (public boards grant mutation rights).
+    """
+    if current_user.is_admin:
+        return
+    owner = ApiDependencies.invoker.services.image_records.get_user_id(image_name)
+    if owner is not None and owner == current_user.user_id:
+        return
+
+    board_id = ApiDependencies.invoker.services.board_image_records.get_board_for_image(image_name)
+    if board_id is not None:
+        try:
+            board = ApiDependencies.invoker.services.boards.get_dto(board_id=board_id)
+            if board.user_id == current_user.user_id:
+                return
+            if board.board_visibility == BoardVisibility.Public:
+                return
+        except Exception:
+            pass
+
+    raise HTTPException(status_code=403, detail="Not authorized to modify this image")
+
+
+def assert_image_read_access(image_name: str, current_user: CurrentUserOrDefault) -> None:
+    """Raise 403 if the current user may not view the image.
+
+    Access is granted when ANY of these hold:
+    - The user is an admin.
+    - The user owns the image.
+    - The image sits on a shared or public board.
+    """
+    if current_user.is_admin:
+        return
+
+    owner = ApiDependencies.invoker.services.image_records.get_user_id(image_name)
+    if owner is not None and owner == current_user.user_id:
+        return
+
+    board_id = ApiDependencies.invoker.services.board_image_records.get_board_for_image(image_name)
+    if board_id is not None:
+        try:
+            board = ApiDependencies.invoker.services.boards.get_dto(board_id=board_id)
+            if board.board_visibility in (BoardVisibility.Shared, BoardVisibility.Public):
+                return
+        except Exception:
+            pass
+
+    raise HTTPException(status_code=403, detail="Not authorized to access this image")
+
+
+def assert_board_read_access(board_id: str, current_user: CurrentUserOrDefault) -> None:
+    """Raise 403 if the current user may not read images from this board.
+
+    Access is granted when ANY of these hold:
+    - The user is an admin.
+    - The user owns the board.
+    - The board visibility is Shared or Public.
+    """
+    if current_user.is_admin:
+        return
+
+    try:
+        board = ApiDependencies.invoker.services.boards.get_dto(board_id=board_id)
+    except Exception:
+        raise HTTPException(status_code=404, detail="Board not found")
+
+    if board.user_id == current_user.user_id:
+        return
+
+    if board.board_visibility in (BoardVisibility.Shared, BoardVisibility.Public):
+        return
+
+    raise HTTPException(status_code=403, detail="Not authorized to access this board")

{invokeai-6.13.0rc2 → invokeai-6.13.5}/invokeai/app/api/routers/app_info.py

@@ -201,6 +201,7 @@ async def get_external_provider_configs() -> list[ExternalProviderConfigModel]:
     response_model=ExternalProviderConfigModel,
 )
 async def set_external_provider_config(
+    _: AdminUserOrDefault,
     provider_id: str = Path(description="The external provider identifier"),
     update: ExternalProviderConfigUpdate = Body(description="External provider configuration settings"),
 ) -> ExternalProviderConfigModel:
@@ -231,6 +232,7 @@ async def set_external_provider_config(
     response_model=ExternalProviderConfigModel,
 )
 async def reset_external_provider_config(
+    _: AdminUserOrDefault,
     provider_id: str = Path(description="The external provider identifier"),
 ) -> ExternalProviderConfigModel:
     api_key_field, base_url_field = _get_external_provider_fields(provider_id)

{invokeai-6.13.0rc2 → invokeai-6.13.5}/invokeai/app/api/routers/download_queue.py

@@ -1,6 +1,8 @@
 # Copyright (c) 2023 Lincoln D. Stein
 """FastAPI route for the download queue."""
 
+from pathlib import Path as FsPath
+from pathlib import PurePosixPath, PureWindowsPath
 from typing import List, Optional
 
 from fastapi import Body, Path, Response
@@ -8,6 +10,7 @@ from fastapi.routing import APIRouter
 from pydantic.networks import AnyHttpUrl
 from starlette.exceptions import HTTPException
 
+from invokeai.app.api.auth_dependencies import AdminUserOrDefault, CurrentUserOrDefault
 from invokeai.app.api.dependencies import ApiDependencies
 from invokeai.app.services.download import (
     DownloadJob,
@@ -17,11 +20,32 @@ from invokeai.app.services.download import (
 download_queue_router = APIRouter(prefix="/v1/download_queue", tags=["download_queue"])
 
 
+def _validate_dest(dest: str) -> str:
+    """Reject absolute paths and parent-traversal segments.
+
+    Accepts a relative POSIX- or Windows-style path. Returns the original string
+    for the caller to wrap in `Path(...)`. Raises 400 on suspicious input so the
+    download service never sees it.
+    """
+    if not dest or not dest.strip():
+        raise HTTPException(status_code=400, detail="Download destination must not be empty.")
+
+    posix = PurePosixPath(dest)
+    windows = PureWindowsPath(dest)
+    if posix.is_absolute() or windows.is_absolute():
+        raise HTTPException(status_code=400, detail="Download destination must be a relative path.")
+
+    if ".." in posix.parts or ".." in windows.parts:
+        raise HTTPException(status_code=400, detail="Download destination must not contain '..' segments.")
+
+    return dest
+
+
 @download_queue_router.get(
     "/",
     operation_id="list_downloads",
 )
-async def list_downloads() -> List[DownloadJob]:
+async def list_downloads(current_user: CurrentUserOrDefault) -> List[DownloadJob]:
     """Get a list of active and inactive jobs."""
     queue = ApiDependencies.invoker.services.download_queue
     return queue.list_jobs()
@@ -35,7 +59,7 @@ async def list_downloads() -> List[DownloadJob]:
         400: {"description": "Bad request"},
     },
 )
-async def prune_downloads() -> Response:
+async def prune_downloads(current_user: AdminUserOrDefault) -> Response:
     """Prune completed and errored jobs."""
     queue = ApiDependencies.invoker.services.download_queue
     queue.prune_jobs()
@@ -47,14 +71,16 @@ async def prune_downloads() -> Response:
     operation_id="download",
 )
 async def download(
+    current_user: CurrentUserOrDefault,
     source: AnyHttpUrl = Body(description="download source"),
     dest: str = Body(description="download destination"),
     priority: int = Body(default=10, description="queue priority"),
     access_token: Optional[str] = Body(default=None, description="token for authorization to download"),
 ) -> DownloadJob:
     """Download the source URL to the file or directory indicted in dest."""
+    validated_dest = _validate_dest(dest)
     queue = ApiDependencies.invoker.services.download_queue
-    return queue.download(source, Path(dest), priority, access_token)
+    return queue.download(source, FsPath(validated_dest), priority, access_token)
 
 
 @download_queue_router.get(
@@ -66,6 +92,7 @@ async def download(
     },
 )
 async def get_download_job(
+    current_user: CurrentUserOrDefault,
     id: int = Path(description="ID of the download job to fetch."),
 ) -> DownloadJob:
     """Get a download job using its ID."""
@@ -85,6 +112,7 @@ async def get_download_job(
     },
 )
 async def cancel_download_job(
+    current_user: CurrentUserOrDefault,
     id: int = Path(description="ID of the download job to cancel."),
 ) -> Response:
     """Cancel a download job using its ID."""
@@ -104,7 +132,7 @@ async def cancel_download_job(
         204: {"description": "Download jobs have been cancelled"},
     },
 )
-async def cancel_all_download_jobs() -> Response:
+async def cancel_all_download_jobs(current_user: AdminUserOrDefault) -> Response:
     """Cancel all download jobs."""
     ApiDependencies.invoker.services.download_queue.cancel_all_jobs()
     return Response(status_code=204)