[PR #3410] fix: respect bypass_ssl in share and notice requests #3276

New issue

Open

opened 2026-10-28 21:16:39 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-28 21:16:39 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/Comfy-Org/ComfyUI-Manager/pull/3410
Author: @Dextheking1
Created: 10/23/2026
Status: 🔄 Open

Base: main ← Head: fix/share-verify-ssl

📝 Commits (1)

d6d3f15 fix: respect bypass_ssl in share and notice requests

📊 Changes

2 files changed (+6 additions, -5 deletions)

View changed files

📝 glob/manager_server.py (+1 -1)
📝 glob/share_3rdparty.py (+5 -4)

📄 Description

the comfyworkflows share flow and /manager/notice hardcode verify_ssl=False and ignore the bypass_ssl setting. every other fetch uses verify=not manager_util.bypass_ssl (see cnr_utils.py). the share flow sends the share key and the workflow json and takes presigned upload urls over that unverified connection, so a network mitm can grab the key and the content or hand back hostile presigned urls.

switch the five hardcoded connectors (4 in glob/share_3rdparty.py, 1 in glob/manager_server.py) to verify_ssl=not manager_util.bypass_ssl. with bypass_ssl off (the default) certs are now verified. users who set bypass_ssl keep the old behavior. no other change.

checked: python syntax on both files, grep confirms no verify_ssl=False left in glob/.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/Comfy-Org/ComfyUI-Manager/pull/3410 **Author:** [@Dextheking1](https://github.com/Dextheking1) **Created:** 10/23/2026 **Status:** 🔄 Open **Base:** `main` ← **Head:** `fix/share-verify-ssl` --- ### 📝 Commits (1) - [`d6d3f15`](https://github.com/Comfy-Org/ComfyUI-Manager/commit/d6d3f153d0ae23f200fceb35ac101affc3a3dd53) fix: respect bypass_ssl in share and notice requests ### 📊 Changes **2 files changed** (+6 additions, -5 deletions) <details> <summary>View changed files</summary> 📝 `glob/manager_server.py` (+1 -1) 📝 `glob/share_3rdparty.py` (+5 -4) </details> ### 📄 Description the comfyworkflows share flow and /manager/notice hardcode verify_ssl=False and ignore the bypass_ssl setting. every other fetch uses verify=not manager_util.bypass_ssl (see cnr_utils.py). the share flow sends the share key and the workflow json and takes presigned upload urls over that unverified connection, so a network mitm can grab the key and the content or hand back hostile presigned urls. switch the five hardcoded connectors (4 in glob/share_3rdparty.py, 1 in glob/manager_server.py) to verify_ssl=not manager_util.bypass_ssl. with bypass_ssl off (the default) certs are now verified. users who set bypass_ssl keep the old behavior. no other change. checked: python syntax on both files, grep confirms no verify_ssl=False left in glob/. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi added the

pull-request

label

2026-10-28 21:16:39 +00:00