fix: url decode filename from API (comfyanonymous#4801)

thomastraum · Sep 9, 2024 · 967867d · 967867d
1 parent cbaac71
commit 967867d
Showing 1 changed file with 5 additions and 0 deletions.
diff --git a/app/user_manager.py b/app/user_manager.py
@@ -5,6 +5,7 @@
 import glob
 import shutil
 from aiohttp import web
+from urllib import parse
 from comfy.cli_args import args
 from folder_paths import user_directory
 from .app_settings import AppSettings
@@ -59,6 +60,10 @@ def get_request_user_filepath(self, request, file, type="userdata", create_dir=T
             return None
 
         if file is not None:
+            # Check if filename is url encoded
+            if "%" in file:
+                file = parse.unquote(file)
+
             # prevent leaving /{type}/{user}
             path = os.path.abspath(os.path.join(user_root, file))
             if os.path.commonpath((user_root, path)) != user_root: