diff --git a/shared_utils/fastapi_server.py b/shared_utils/fastapi_server.py
index 7b06fab9..c826e7b9 100644
--- a/shared_utils/fastapi_server.py
+++ b/shared_utils/fastapi_server.py
@@ -47,6 +47,28 @@ queue cocurrent effectiveness
import os, requests, threading, time
import uvicorn
+def validate_path_safety(path_or_url, user):
+ from toolbox import get_conf, default_user_name
+ from toolbox import FriendlyException
+ PATH_PRIVATE_UPLOAD, PATH_LOGGING = get_conf('PATH_PRIVATE_UPLOAD', 'PATH_LOGGING')
+ sensitive_path = None
+ path_or_url = os.path.relpath(path_or_url)
+ if path_or_url.startswith(PATH_LOGGING): # 日志文件（按用户划分）
+ sensitive_path = PATH_LOGGING
+ elif path_or_url.startswith(PATH_PRIVATE_UPLOAD): # 用户的上传目录（按用户划分）
+ sensitive_path = PATH_PRIVATE_UPLOAD
+ elif path_or_url.startswith('tests'): # 一个常用的测试目录
+ return True
+ else:
+ raise FriendlyException(f"输入文件的路径 ({path_or_url}) 存在，但位置非法。请将文件上传后再执行该任务。") # return False
+ if sensitive_path:
+ allowed_users = [user, 'autogen', default_user_name] # three user path that can be accessed
+ for user_allowed in allowed_users:
+ if f"{os.sep}".join(path_or_url.split(os.sep)[:2]) == os.path.join(sensitive_path, user_allowed):
+ return True
+ raise FriendlyException(f"输入文件的路径 ({path_or_url}) 存在，但属于其他用户。请将文件上传后再执行该任务。") # return False
+ return True
+
def _authorize_user(path_or_url, request, gradio_app):
from toolbox import get_conf, default_user_name
PATH_PRIVATE_UPLOAD, PATH_LOGGING = get_conf('PATH_PRIVATE_UPLOAD', 'PATH_LOGGING')
diff --git a/toolbox.py b/toolbox.py
index 2446a208..4794f054 100644
--- a/toolbox.py
+++ b/toolbox.py
@@ -10,6 +10,7 @@ import glob
import logging
import uuid
from functools import wraps
+from textwrap import dedent
from shared_utils.config_loader import get_conf
from shared_utils.config_loader import set_conf
from shared_utils.config_loader import set_multi_conf
@@ -193,9 +194,20 @@ def trimmed_format_exc():
replace_path = "."
return str.replace(current_path, replace_path)
+
def trimmed_format_exc_markdown():
return '\n\n```\n' + trimmed_format_exc() + '```'
+
+class FriendlyException(Exception):
+ def generate_error_html(self):
+ return dedent(f"""
+
+ {"
".join(self.args)}
+
+ """)
+
+
def CatchException(f):
"""
装饰器函数，捕捉函数f中的异常并封装到一个生成器中返回，并显示到聊天当中。
@@ -206,13 +218,18 @@ def CatchException(f):
chatbot_with_cookie:ChatBotWithCookies, history:list, *args, **kwargs):
try:
yield from f(main_input, llm_kwargs, plugin_kwargs, chatbot_with_cookie, history, *args, **kwargs)
+ except FriendlyException as e:
+ if len(chatbot_with_cookie) == 0:
+ chatbot_with_cookie.clear()
+ chatbot_with_cookie.append(["插件调度异常", None])
+ chatbot_with_cookie[-1] = [chatbot_with_cookie[-1][0], e.generate_error_html()]
+ yield from update_ui(chatbot=chatbot_with_cookie, history=history, msg=f'异常') # 刷新界面
except Exception as e:
- from toolbox import get_conf
tb_str = '```\n' + trimmed_format_exc() + '```'
if len(chatbot_with_cookie) == 0:
chatbot_with_cookie.clear()
chatbot_with_cookie.append(["插件调度异常", "异常原因"])
- chatbot_with_cookie[-1] = (chatbot_with_cookie[-1][0], f"[Local Message] 插件调用出错: \n\n{tb_str} \n")
+ chatbot_with_cookie[-1] = [chatbot_with_cookie[-1][0], f"[Local Message] 插件调用出错: \n\n{tb_str} \n"]
yield from update_ui(chatbot=chatbot_with_cookie, history=history, msg=f'异常 {e}') # 刷新界面
return decorated