7ea2c5f8 · permissionBRICK/SillyTavern

default/config.yaml+0 -2 Viewed

 ## Set to 0 to expire session when the browser is closed
 ## Set to a negative number to disable session expiration
 sessionTimeout: -1
 -# Used to sign session cookies. Will be auto-generated if not set
 -cookieSecret: ''
 # Disable CSRF protection - NOT RECOMMENDED
 disableCsrfProtection: false
 # Disable startup security checks - NOT RECOMMENDED

post-install.js+19 -1 Viewed

         newKey: 'extensions.models.textToSpeech',
         migrate: (value) => value,
     },
 +    // uncommend one release after 1.12.13
 +    /*
 +    {
 +        oldKey: 'cookieSecret',
 +        newKey: 'cookieSecret',
 +        migrate: () => void 0,
 +        remove: true,
 +    },
 +    */
 ];
 /**

         // Migrate old keys to new keys
         const migratedKeys = [];
         for (const { oldKey, newKey, migrate, remove } of keyMigrationMap) {
             if (_.has(config, oldKey)) {
 +                if (remove) {
 +                    _.unset(config, oldKey);
 +                    migratedKeys.push({
 +                        oldKey,
 +                        newValue: void 0,
 +                    });
 +                    continue;
 +                }
++
                 const oldValue = _.get(config, oldKey);
                 const newValue = migrate(oldValue);
                 _.set(config, newKey, newValue);

server.js+4 -4 Viewed

 const enableCorsProxy = cliArguments.corsProxy ?? getConfigValue('enableCorsProxy', DEFAULT_CORS_PROXY);
 const enableWhitelist = cliArguments.whitelist ?? getConfigValue('whitelistMode', DEFAULT_WHITELIST);
 /** @type {string} */
 const dataRootglobalThis.DATA_ROOT = cliArguments.dataRoot ?? getConfigValue('dataRoot', './data');
 /** @type {boolean} */
 const disableCsrf = cliArguments.disableCsrf ?? getConfigValue('disableCsrfProtection', DEFAULT_CSRF_DISABLED);
 const basicAuthMode = cliArguments.basicAuthMode ?? getConfigValue('basicAuthMode', DEFAULT_BASIC_AUTH);

 /** @type {boolean} */
 const enableAccounts = getConfigValue('enableUserAccounts', DEFAULT_ACCOUNTS);
 const uploadsPath = path.join(dataRootglobalThis.DATA_ROOT, UPLOADS_DIRECTORY);
 /** @type {boolean | "auto"} */

     sameSite: 'strict',
     httpOnly: true,
     maxAge: getSessionCookieAge(),
     secret: getCookieSecret(globalThis.DATA_ROOT),
 }));
 app.use(setUserDataMiddleware);

+}
 // User storage module needs to be initialized before starting the server
 initUserStorage(dataRootglobalThis.DATA_ROOT)
     .then(ensurePublicDirectoriesExist)
     .then(migrateUserData)
     .then(migrateSystemPrompts)

src/users.js+22 -10 Viewed

 import { sync as writeFileAtomicSync } from 'write-file-atomic';
 import { USER_DIRECTORY_TEMPLATE, DEFAULT_USER, PUBLIC_DIRECTORIES, SETTINGS_FILE } from './constants.js';
 import { getConfigValue, color, delay, setConfigValue, generateTimestamp } from './util.js';
 import { readSecret, writeSecret } from './endpoints/secrets.js';
 import { getContentOfType } from './endpoints/content-manager.js';

  */
 const DIRECTORIES_CACHE = new Map();
 const PUBLIC_USER_AVATAR = '/img/default-user.png';
 +const COOKIE_SECRET_PATH = 'cookie-secret.txt';
 const STORAGE_KEYS = {
     csrfSecret: 'csrfSecret',

  * @returns {Promise<void>}
  */
 export async function initUserStorage(dataRoot) {
 -    globalThis.DATA_ROOT = dataRoot;
 +    console.log('Using data root:', color.green(dataRoot));
 -    console.log('Using data root:', color.green(globalThis.DATA_ROOT));
     console.log();
     await storage.init({
         dir: path.join(globalThis.DATA_ROOTdataRoot, '_storage'),
         ttl: false, // Never expire
     });

 /**
  * Get the cookie secret from the config. If it doesn't exist, generate a new one.
 + * @param {string} dataRoot The root directory for user data
  * @returns {string} The cookie secret
  */
 export function getCookieSecret(dataRoot) {
     letconst secretcookieSecretPath = getConfigValue(STORAGE_KEYSpath.cookieSecretjoin(dataRoot, COOKIE_SECRET_PATH);
++
 +    if (fs.existsSync(cookieSecretPath)) {
 +        const stat = fs.statSync(cookieSecretPath);
 +        if (stat.size > 0) {
 +            return fs.readFileSync(cookieSecretPath, 'utf8');
 +        }
 +    }
 -    if (!secret) {
 +    const oldSecret = getConfigValue(STORAGE_KEYS.cookieSecret);
 -        console.warn(color.yellow('Cookie secret is missing from config.yaml. Generating a new one...'));
 +    if (oldSecret) {
 -        secret = crypto.randomBytes(64).toString('base64');
 +        console.log('Migrating cookie secret from config.yaml...');
 -        setConfigValue(STORAGE_KEYS.cookieSecret, secret);
 +        writeFileAtomicSync(cookieSecretPath, oldSecret, { encoding: 'utf8' });
 +        return oldSecret;
+    }
 +    console.warn(color.yellow('Cookie secret is missing from data root. Generating a new one...'));
 +    const secret = crypto.randomBytes(64).toString('base64');
 +    writeFileAtomicSync(cookieSecretPath, secret, { encoding: 'utf8' });
     return secret;
+}

src/util.js+0 -14 Viewed

 import yaml from 'yaml';
 import { sync as commandExistsSync } from 'command-exists';
 -import { sync as writeFileAtomicSync } from 'write-file-atomic';
 import _ from 'lodash';
 import yauzl from 'yauzl';
 import mime from 'mime-types';

+}
 /**
 - * Sets a value for the given key in the config object and writes it to the config.yaml file.
 - * @param {string} key Key to set
 - * @param {any} value Value to set
 - */
 -export function setConfigValue(key, value) {
 -    // Reset cache so that the next getConfig call will read the updated config file
 -    CACHED_CONFIG = null;
 -    const config = getConfig();
 -    _.set(config, key, value);
 -    writeFileAtomicSync('./config.yaml', yaml.stringify(config));
 -}
+-
 -/**
  * Encodes the Basic Auth header value for the given user and password.
  * @param {string} auth username:password
  * @returns {string} Basic Auth header value

Move cookie secret to data root. Make config.yaml immutable