5eeea1407b
The dataset upload took Path(filename).name, which on POSIX does not split on a backslash, so a Windows client sending a backslash path in the multipart filename stored the name verbatim. The caption/thumbnail/delete endpoints then run it through _safe_dataset_image_path, which rejects backslashes and '..', so the labeling grid could list an image it could never preview, caption, or delete (an orphan). Fold backslashes to forward slashes before taking the basename so the true name is stored, and reject a basename that still contains '..' at upload rather than persisting an unmanageable entry. Regression test covers a Windows backslash path (stored and served under the clean basename) and a '..' rejection. |
||
|---|---|---|
| .. | ||
| assets | ||
| auth | ||
| core | ||
| hub | ||
| loggers | ||
| models | ||
| plugins | ||
| requirements | ||
| routes | ||
| state | ||
| storage | ||
| tests | ||
| utils | ||
| __init__.py | ||
| _platform_compat.py | ||
| cloudflare_tunnel.py | ||
| colab.py | ||
| main.py | ||
| run.py | ||
| startup_banner.py | ||