mirror of
https://github.com/Comfy-Org/ComfyUI-Manager.git
synced 2026-11-04 23:37:31 +00:00
[GH-ISSUE #1996] [Feature request] Allow users to manually change the security level in the FE or hide features that are not allowed in the current security level config. #835
Labels
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
Comfy-Org/ComfyUI-Manager#835
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @comfyui-wiki on GitHub (Jul 14, 2025).
Original GitHub issue: https://github.com/Comfy-Org/ComfyUI-Manager/issues/1996
When users install custom nodes and choose the nightly version, they will install the custom nodes from GitHub. However, since the default
security_levelis set tonormal, users may be confused as to why they can't install custom nodes.Also, there is too little information in the prompt. Users who don't know how to change the security_level setting will only feel frustrated.
Here's my advice
1. Only show interface features allowed by the user's current security settings.
Such as hide the "nightly version" or don't use the "nightly" as default version (but seems lot of custom node only have nightly)
Don't show the
install PIP packageandinstall via Git URLif theirsecurity_levelisn't weak.Otherwise, when users try to use these features for the first time, they will be confused about why they can't install custom nodes.
2. Allow users change the
security levelin the FEI think a lot of users still look up how to fix security level issues every day. Whatever the outcome, they always set the security to 'weak' once they figure out how.
So why not allow users to change security settings in the FE? But we should make sure users fully understand the consequences and risks. Add more details in the prompt, then let users decide whether to change the settings or not.
Especially for beginners, they may not know much about computers or ComfyUI. Sometimes they might not even know how to update the config.ini
3. Add more details in the prompt.
The current prompt lacks information. Should we add more details to tell users how they can change the security settings?
Such as "This action is not allowed with this security level configuration. If you need to, you can change the
security leveltoweakin theComfyUI/user/default/ComfyUI-Manager/config.ini. [Notice] Please make sure you know what it means, otherwise you shouldn't change this setting."@christian-byrne commented on GitHub (Jul 14, 2025):
Option 2 and 3 seem good. Making security level configurable from the client has issues e.g. when a server is serving multiple clients.
@comfyui-wiki commented on GitHub (Jul 15, 2025):
In ComfyUI-Manager v3.33.4, when installing a custom node, the
latestis now the default option. But the desktop is still using3.30.4, which is why when I took the screenshot,nightlywas still the default option.@ltdrdata commented on GitHub (Jul 15, 2025):
This feature should be available only in the Desktop version. Security settings should not be editable remotely.
@christian-byrne commented on GitHub (Jul 16, 2025):
You could keep the issue open for the UI adjustments. It makes sense to hide things that are disabled by security level, maybe.
@comfyui-wiki commented on GitHub (Jul 16, 2025):
Ok, just reopened it. XD
@melMass commented on GitHub (Aug 20, 2025):
Can someone clarify what does latest protect against vs
nightly?@comfyui-wiki commented on GitHub (Aug 20, 2025):
Latest means the latest stable version, and the custom node will be downloaded from the ComfyUI registry server (The custom node has undergone some security scans). For the nightly version, it will be downloaded from Github, which may contain malicious code.
@melMass commented on GitHub (Aug 20, 2025):
Nice thanks, I did not know that subtlety. It does make sense then
@LingYingNX commented on GitHub (Dec 8, 2025):
I watched it repeatedly and didn't know if this was the answer, but I couldn't update the plugin, and I set all security to the minimum before I saw this post
