9a2968d1 · permissionBRICK/SillyTavern

default/config.yaml+15 -13 Viewed

 ##   headers:
 ##     User-Agent: "Googlebot/2.1 (+http://www.google.com/bot.html)"
 requestOverrides: []
 -# -- EXTENSIONS CONFIGURATION --
++
 +# EXTENSIONS CONFIGURATION
 +extensions:
   # Enable UI extensions
 enableExtensions  enabled: true
   # Automatically update extensions when a release version changes
 enableExtensionsAutoUpdate  autoUpdate: true
 +  models:
 +    # Enables automatic model download from HuggingFace
 +    autoDownload: true
 +    # Additional models for extensions. Expects model IDs from HuggingFace model hub in ONNX format
 +    classification: Cohee/distilbert-base-uncased-go-emotions-onnx
 +    captioning: Xenova/vit-gpt2-image-captioning
 +    embedding: Cohee/jina-embeddings-v2-base-en
 +    speechToText: Xenova/whisper-small
 +    textToSpeech: Xenova/speecht5_tts
++
 # Additional model tokenizers can be downloaded on demand.
 # Disabling will fallback to another locally available tokenizer.
 enableDownloadableTokenizers: true
 -# Extension settings
 -extras:
 -  # Disables automatic model download from HuggingFace
 -  disableAutoDownload: false
 -  # Extra models for plugins. Expects model IDs from HuggingFace model hub in ONNX format
 -  classificationModel: Cohee/distilbert-base-uncased-go-emotions-onnx
 -  captioningModel: Xenova/vit-gpt2-image-captioning
 -  embeddingModel: Cohee/jina-embeddings-v2-base-en
 -  speechToTextModel: Xenova/whisper-small
 -  textToSpeechModel: Xenova/speecht5_tts
 # -- OPENAI CONFIGURATION --
 # A placeholder message to use in strict prompt post-processing mode when the prompt doesn't start with a user message
 promptPlaceholder: "[Start a new chat]"

jsconfig.json+1 -1 Viewed

         "**/node_modules/**",
         "**/dist/**",
         "**/.git/**",
         "public/lib/**",
         "backups/**",
         "data/**",
         "cache/**",

post-install.js+40 -0 Viewed

         newKey: 'backups.chat.throttleInterval',
         migrate: (value) => value,
     },
 +    {
 +        oldKey: 'enableExtensions',
 +        newKey: 'extensions.enabled',
 +        migrate: (value) => value,
 +    },
 +    {
 +        oldKey: 'enableExtensionsAutoUpdate',
 +        newKey: 'extensions.autoUpdate',
 +        migrate: (value) => value,
 +    },
 +    {
 +        oldKey: 'extras.disableAutoDownload',
 +        newKey: 'extensions.models.autoDownload',
 +        migrate: (value) => !value,
 +    },
 +    {
 +        oldKey: 'extras.classificationModel',
 +        newKey: 'extensions.models.classification',
 +        migrate: (value) => value,
 +    },
 +    {
 +        oldKey: 'extras.captioningModel',
 +        newKey: 'extensions.models.captioning',
 +        migrate: (value) => value,
 +    },
 +    {
 +        oldKey: 'extras.embeddingModel',
 +        newKey: 'extensions.models.embedding',
 +        migrate: (value) => value,
 +    },
 +    {
 +        oldKey: 'extras.speechToTextModel',
 +        newKey: 'extensions.models.speechToText',
 +        migrate: (value) => value,
 +    },
 +    {
 +        oldKey: 'extras.textToSpeechModel',
 +        newKey: 'extensions.models.textToSpeech',
 +        migrate: (value) => value,
 +    },
 ];
 /**

public/locales/zh-cn.json+8 -8 Viewed

     "welcome_message_part_8": "您可随时通过",
     "welcome_message_part_9": "图标来更改此设置。",
     "Persona Name:": "用户角色名称：",
     "Temporarily disable automatic replies from this character": "暂时禁用此角色的自动回复临时禁言此角色",
     "Enable automatic replies from this character": "启用此角色的自动回复解除禁言此角色",
     "Trigger a message from this character": "从此角色触发消息强制触发该角色发言",
     "Move up": "向上移动",
     "Move down": "向下移动",
     "View character card": "查看角色卡片",

     "Enter the Git URL of the extension to install": "输入扩展程序的 Git URL 以安装",
     "Disclaimer:": "免责声明：",
     "Please be aware that using external extensions can have unintended side effects and may pose security risks. Always make sure you trust the source before importing an extension. We are not responsible for any damage caused by third-party extensions.": "使用外部的扩展程序可能存在意料外的副作用和安全隐患。在导入扩展程序前，请一定确认其来源可信。我们不为第三方扩展程序造成的任何损失负责。",
     "Prompt Itemization": "将提示词分条提示词拆分",
     "Show Raw Prompt": "显示原始提示词",
     "Copy Prompt": "复制提示词",
     "Show Prompt Differences": "显示提示词差异",

     "Post a GitHub issue": "在 GitHub 发布问题",
     "Contact the developers": "联系开发者",
     "If you're connected to an API, try asking me something!": "若您已经配置好API，尝试发送些什么吧！",
     "Title/Memo": "标题/备忘录（备忘）",
     "Strategy": "Strategy触发策略",
     "Position": "位置插入位置",
     "Trigger %": "触发率 ％触发概率%"
+}

public/scripts/st-context.js+6 -2 Viewed

     extension_prompts,
     Generate,
     generateQuietPrompt,
 +    getCharacters,
     getCurrentChatId,
     getRequestHeaders,
     getThumbnailUrl,

 import { oai_settings } from './openai.js';
 import { callGenericPopup, Popup, POPUP_RESULT, POPUP_TYPE } from './popup.js';
 import { power_user, registerDebugFunction } from './power-user.js';
 import { humanizedDateTime, isMobile, shouldSendOnEnter } from './RossAscends-mods.js';
 import { ScraperManager } from './scrapers.js';
 import { executeSlashCommands, executeSlashCommandsWithOptions, registerSlashCommand } from './slash-commands.js';
 import { SlashCommand } from './slash-commands/SlashCommand.js';

 import { textgenerationwebui_settings } from './textgen-settings.js';
 import { tokenizers, getTextTokens, getTokenCount, getTokenCountAsync, getTokenizerModel } from './tokenizers.js';
 import { ToolManager } from './tool-calling.js';
 import { timestampToMoment, uuidv4 } from './utils.js';
 export function getContext() {
     return {

         chatCompletionSettings: oai_settings,
         textCompletionSettings: textgenerationwebui_settings,
         powerUserSettings: power_user,
 +        getCharacters,
 +        uuidv4,
 +        humanizedDateTime,
     };
+}

src/endpoints/avatars.js+2 -1 Viewed

 import { jsonParser, urlencodedParser } from '../express-common.js';
 import { AVATAR_WIDTH, AVATAR_HEIGHT } from '../constants.js';
 import { getImages, tryParse } from '../util.js';
 +import { getFileNameValidationFunction } from '../middleware/validateFileName.js';
 export const router = express.Router();

     response.send(JSON.stringify(images));
 });
 router.post('/delete', jsonParser, getFileNameValidationFunction('avatar'), function (request, response) {
     if (!request.body) return response.sendStatus(400);
     if (request.body.avatar !== sanitize(request.body.avatar)) {

src/endpoints/backgrounds.js+2 -1 Viewed

 import { jsonParser, urlencodedParser } from '../express-common.js';
 import { invalidateThumbnail } from './thumbnails.js';
 import { getImages } from '../util.js';
 +import { getFileNameValidationFunction } from '../middleware/validateFileName.js';
 export const router = express.Router();

     response.send(JSON.stringify(images));
 });
 router.post('/delete', jsonParser, getFileNameValidationFunction('bg'), function (request, response) {
     if (!request.body) return response.sendStatus(400);
     if (request.body.bg !== sanitize(request.body.bg)) {

src/endpoints/characters.js+10 -9 Viewed

 import { AVATAR_WIDTH, AVATAR_HEIGHT } from '../constants.js';
 import { jsonParser, urlencodedParser } from '../express-common.js';
 +import { default as validateAvatarUrlMiddleware, getFileNameValidationFunction } from '../middleware/validateFileName.js';
 import { deepMerge, humanizedISO8601DateTime, tryParse, extractFileFromZipBuffer, MemoryLimitedMap, getConfigValue } from '../util.js';
 import { TavernCardValidator } from '../validator/TavernCardValidator.js';
 import { parse, write } from '../character-card-parser.js';

@@ -756,7 +757,7 @@ router.post('/create', urlencodedParser, async function (request, response) {
756	757	}
757	758	});
758	759
759	760	router.post('/rename', jsonParser, validateAvatarUrlMiddleware, async function (request, response) {
760	761	if (!request.body.avatar_url \|\| !request.body.new_name) {
761	762	return response.sendStatus(400);
762	763	}

+    }
 });
 router.post('/edit', urlencodedParser, validateAvatarUrlMiddleware, async function (request, response) {
     if (!request.body) {
         console.error('Error: no response body detected');
         response.status(400).send('Error: no response body detected');

  * @param {Object} response - The HTTP response object.
  * @returns {void}
  */
 router.post('/edit-attribute', jsonParser, validateAvatarUrlMiddleware, async function (request, response) {
     console.log(request.body);
     if (!request.body) {
         console.error('Error: no response body detected');

+ *
  * @returns {void}
  * */
 router.post('/merge-attributes', jsonParser, getFileNameValidationFunction('avatar'), async function (request, response) {
     try {
         const update = request.body;
         const avatarPath = path.join(request.user.directories.characters, update.avatar);

@@ -929,7 +930,7 @@ router.post('/merge-attributes', jsonParser, async function (request, response)
929	930	}
930	931	});
931	932
932	933	router.post('/delete', jsonParser, validateAvatarUrlMiddleware, async function (request, response) {
933	934	if (!request.body \|\| !request.body.avatar_url) {
934	935	return response.sendStatus(400);
935	936	}

+    }
 });
 router.post('/get', jsonParser, validateAvatarUrlMiddleware, async function (request, response) {
     try {
         if (!request.body) return response.sendStatus(400);
         const item = request.body.avatar_url;

+    }
 });
 router.post('/chats', jsonParser, validateAvatarUrlMiddleware, async function (request, response) {
     if (!request.body) return response.sendStatus(400);
     const characterDirectory = (request.body.avatar_url).replace('.png', '');

+    }
 });
 router.post('/duplicate', jsonParser, validateAvatarUrlMiddleware, async function (request, response) {
     try {
         if (!request.body.avatar_url) {
             console.log('avatar URL not found in request body');

+    }
 });
 router.post('/export', jsonParser, validateAvatarUrlMiddleware, async function (request, response) {
     try {
         if (!request.body.format || !request.body.avatar_url) {
             return response.sendStatus(400);

src/endpoints/chats.js+8 -7 Viewed

 import _ from 'lodash';
 import { jsonParser, urlencodedParser } from '../express-common.js';
 +import validateAvatarUrlMiddleware from '../middleware/validateFileName.js';
 import {
     getConfigValue,
     humanizedISO8601DateTime,

 export const router = express.Router();
 router.post('/save', jsonParser, validateAvatarUrlMiddleware, function (request, response) {
     try {
         const directoryName = String(request.body.avatar_url).replace('.png', '');
         const chatData = request.body.chat;

+    }
 });
 router.post('/get', jsonParser, validateAvatarUrlMiddleware, function (request, response) {
     try {
         const dirName = String(request.body.avatar_url).replace('.png', '');
         const directoryPath = path.join(request.user.directories.chats, dirName);

 });
 router.post('/rename', jsonParser, validateAvatarUrlMiddleware, async function (request, response) {
     if (!request.body || !request.body.original_file || !request.body.renamed_file) {
         return response.sendStatus(400);
+    }

     return response.send({ ok: true, sanitizedFileName });
 });
 router.post('/delete', jsonParser, validateAvatarUrlMiddleware, function (request, response) {
     const dirName = String(request.body.avatar_url).replace('.png', '');
     const fileName = String(request.body.chatfile);
     const filePath = path.join(request.user.directories.chats, dirName, sanitize(fileName));

     return response.send('ok');
 });
 router.post('/export', jsonParser, validateAvatarUrlMiddleware, async function (request, response) {
     if (!request.body.file || (!request.body.avatar_url && request.body.is_group === false)) {
         return response.sendStatus(400);
+    }

+    }
 });
 router.post('/import', urlencodedParser, validateAvatarUrlMiddleware, function (request, response) {
     if (!request.body) return response.sendStatus(400);
     const format = request.body.file_type;

     return response.send({ ok: true });
 });
 router.post('/search', jsonParser, validateAvatarUrlMiddleware, function (request, response) {
     try {
         const { query, avatar_url, group_id } = request.body;
         let chatFiles = [];

src/endpoints/settings.js+5 -4 Viewed

 import { getConfigValue, generateTimestamp, removeOldBackups } from '../util.js';
 import { jsonParser } from '../express-common.js';
 import { getAllUserHandles, getUserDirectories } from '../users.js';
 +import { getFileNameValidationFunction } from '../middleware/validateFileName.js';
 const ENABLE_EXTENSIONS = !!getConfigValue('enableExtensionsextensions.enabled', true);
 const ENABLE_EXTENSIONS_AUTO_UPDATE = !!getConfigValue('enableExtensionsAutoUpdateextensions.autoUpdate', true);
 const ENABLE_ACCOUNTS = getConfigValue('enableUserAccounts', false);
 // 10 minutes

+    }
 });
 router.post('/load-snapshot', jsonParser, getFileNameValidationFunction('name'), async (request, response) => {
     try {
         const userFilesPattern = getFilePrefix(request.user.profile.handle);

+    }
 });
 router.post('/restore-snapshot', jsonParser, getFileNameValidationFunction('name'), async (request, response) => {
     try {
         const userFilesPattern = getFilePrefix(request.user.profile.handle);

src/endpoints/vectors.js+1 -1 Viewed

             };
         case 'transformers':
             return {
                 model: getConfigValue('extrasextensions.embeddingModelmodels.embedding', ''),
             };
         case 'palm':
             return {

src/middleware/validateFileName.js+34 -0 Viewed

 +import path from 'node:path';
++
 +/**
 + * Gets a middleware function that validates the field in the request body.
 + * @param {string} fieldName Field name
 + * @returns {import('express').RequestHandler} Middleware function
 + */
 +export function getFileNameValidationFunction(fieldName) {
 +    /**
 +    * Validates the field in the request body.
 +    * @param {import('express').Request} req Request object
 +    * @param {import('express').Response} res Response object
 +    * @param {import('express').NextFunction} next Next middleware
 +    */
 +    return function validateAvatarUrlMiddleware(req, res, next) {
 +        if (req.body && fieldName in req.body && typeof req.body[fieldName] === 'string') {
 +            const forbiddenRegExp = path.sep === '/' ? /[/\x00]/ : /[/\x00\\]/;
 +            if (forbiddenRegExp.test(req.body[fieldName])) {
 +                console.error('An error occurred while validating the request body', {
 +                    handle: req.user.profile.handle,
 +                    path: req.originalUrl,
 +                    field: fieldName,
 +                    value: req.body[fieldName],
 +                });
 +                return res.sendStatus(400);
 +            }
 +        }
++
 +        next();
 +    };
 +}
++
 +const avatarUrlValidationFunction = getFileNameValidationFunction('avatar_url');
 +export default avatarUrlValidationFunction;

src/transformers.js+6 -6 Viewed

     'text-classification': {
         defaultModel: 'Cohee/distilbert-base-uncased-go-emotions-onnx',
         pipeline: null,
         configField: 'extrasextensions.classificationModelmodels.classification',
         quantized: true,
     },
     'image-to-text': {
         defaultModel: 'Xenova/vit-gpt2-image-captioning',
         pipeline: null,
         configField: 'extrasextensions.captioningModelmodels.captioning',
         quantized: true,
     },
     'feature-extraction': {
         defaultModel: 'Xenova/all-mpnet-base-v2',
         pipeline: null,
         configField: 'extrasextensions.embeddingModelmodels.embedding',
         quantized: true,
     },
     'automatic-speech-recognition': {
         defaultModel: 'Xenova/whisper-small',
         pipeline: null,
         configField: 'extrasextensions.speechToTextModelmodels.speechToText',
         quantized: true,
     },
     'text-to-speech': {
         defaultModel: 'Xenova/speecht5_tts',
         pipeline: null,
         configField: 'extrasextensions.textToSpeechModelmodels.textToSpeech',
         quantized: false,
     },
 };

     const cacheDir = path.join(globalThis.DATA_ROOT, '_cache');
     const model = forceModel || getModelForTask(task);
     const localOnly = !getConfigValue('extrasextensions.disableAutoDownloadmodels.autoDownload', falsetrue);
     console.log('Initializing transformers.js pipeline for task', task, 'with model', model);
     const instance = await pipeline(task, model, { cache_dir: cacheDir, quantized: tasks[task].quantized ?? true, local_files_only: localOnly });
     tasks[task].pipeline = instance;

Merge branch 'staging' into woo-yeah