AUTOMATIC1111/stable-diffusion-webui

--hide-ui-dir-config does not hide the directories in the textual inversion tab

Closed this issue · 1 comments

lethargus commented

Describe the bug
The --hide-ui-dir-config option does not hide the configuration directory in the textual inversion tab. The default for the prompt template file will be the complete directory from root

To Reproduce
Steps to reproduce the behavior:

  1. Launch with the --hide-ui-dir-config option
  2. Click on the textual inversion tab
  3. Scroll down to the prompt template file entry
  4. See error

Expected behavior
The fields should limit the display and entries similar to the config tab. Preferably locking everything to a sub directory of the install directory for security reasons.

Desktop (please complete the following information):

  • OS: Windows
  • Browser: chrome, but I don't think it matters.
  • Commit revision Commit hash: 2865ef4

Additional context
This is potentially a large security vulnerability for anyone that runs with share enabled or has this running exposed through a reverse proxy or straight port forwarding.

catboxanon commented

Closing this as the train tab is planned to be deprecated at some point. #11857 (comment)