mptyl/ThothII
1
0
Fork 0
Code Issues 25 Pull Requests Actions Packages Projects Releases 1 Wiki Activity

fix(docker): run real questions through trusted Pi gate

Browse Source
This commit is contained in:
marcopan
2026-07-12 19:20:10 +02:00
parent c446d40e1f
commit 7628eaa579
16 changed files with 266 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/src/config/secret-bundle.ts
+4 -1
View File
@@ -56,7 +56,10 @@ function unavailable(): Error { return new Error("secret bundle is unavailable")
function secureStat(info: Stats, docker: boolean): boolean {
const mode = info.mode & 0o777;
if (!info.isFile() || info.isSymbolicLink() || info.nlink !== 1 || info.size > MAX_BUNDLE_BYTES) return false;
if (docker) return info.uid === 0 && mode === 0o444;
if (docker) {
return (info.uid === 0 && mode === 0o444)
|| (info.uid === (process.getuid?.() ?? info.uid) && (mode === 0o400 || mode === 0o600));
}
return info.uid === (process.getuid?.() ?? info.uid) && (mode === 0o400 || mode === 0o600);
}