Merge branch 'staging' of https://github.com/Cohee1207/SillyTavern into staging

SECURITY.md

@@ -0,0 +1,25 @@
+# Security Policy
+
+We take the security of this project seriously. If you discover any security vulnerabilities or have concerns regarding the security of this repository, please reach out to us immediately. We appreciate your efforts in responsibly disclosing the issue and will make every effort to address it promptly.
+
+## Reporting a Vulnerability
+
+To report a security vulnerability, please follow these steps:
+
+1. Go to the **Security** tab of this repository on GitHub.
+2. Click on **"Report a vulnerability"**.
+3. Provide a clear description of the vulnerability and its potential impact. Be as detailed as possible.
+4. If applicable, include steps or a PoC (Proof of Concept) to reproduce the vulnerability.
+5. Submit the report.
+
+Once we receive the private report notification, we will promptly investigate and assess the reported vulnerability.
+
+Please do not disclose any potential vulnerabilities in public repositories, issue trackers, or forums until we have had a chance to review and address the issue.
+
+## Scope
+
+This security policy applies to all the code and files within this repository and its dependencies actively maintained by us. If you encounter a security issue in a dependency that is not directly maintained by us, please follow responsible disclosure practices and report it to the respective project.
+
+While we strive to ensure the security of this project, please note that there may be limitations on resources, response times, and mitigations.
+
+Thank you for your help in making this project more secure.

public/i18n.json

@@ -5,7 +5,8 @@
         "ko-kr",
         "ru-ru",
         "it-it",
-    "nl-nl"
+        "nl-nl",
+        "es-spa"
     ],
     "zh-cn": {
         "clickslidertips": "点击滑块右侧数字可手动输入",
@@ -3483,5 +3484,135 @@
         "Select this as default persona for the new chats.": "Selecteer dit als standaard persona voor de nieuwe chats.",
         "Change persona image": "persona afbeelding wijzigen",
         "Delete persona": "persona verwijderen"
+	},
+    "es-spa": {
+    "clickslidertips": "Haz click en el número al lado de la barra \npara seleccionar un número manualmente.",
+    "kobldpresets": "Configuraciones de KoboldAI",
+    "guikoboldaisettings": "Configuración actual de la interfaz de KoboldAI",
+    "novelaipreserts": "Configuraciones de NovelAI",
+    "default": "Predeterminado",
+    "openaipresets": "Configuraciones de OpenAI",
+    "text gen webio(ooba) presets": "Configuraciones de WebUI(ooba)",
+    "response legth(tokens)": "Largo de la respuesta de la IA (en Tokens)",
+    "select": "Seleccionar",
+    "context size(tokens)": "Tamaño del contexto (en Tokens)",
+    "unlocked": "Desbloqueado",
+    "only select modls support context sizes greater than 2048 tokens. proceed only is you know you're doing": "Solo algunos modelos tienen soporte para tamaños de más de 2048 tokens. Procede solo si sabes lo que estás haciendo.",
+    "rep.pen": "Rep. Pen.",
+    "rep.pen range": "Rango de Rep. Pen.",
+    "temperature": "Temperature",
+    "Encoder Rep. Pen.": "Encoder Rep. Pen.",
+    "No Repeat Ngram Size": "No Repeat Ngram Size",
+    "Min Length": "Largo mínimo",
+    "OpenAI Reverse Proxy": "Reverse Proxy de OpenAI",
+    "Alternative server URL (leave empty to use the default value).": "URL del server alternativo (deja vacío para usar el predeterminado)",
+    "Remove your real OAI API Key from the API panel BEFORE typing anything into this box": "Borra tu clave(API) real de OpenAI ANTES de escribir nada en este campo.",
+    "We cannot provide support for problems encountered while using an unofficial OpenAI proxy": "SillyTaven no puede dar soporte por problemas encontrados durante el uso de un proxy no-oficial de OpenAI",
+    "Legacy Streaming Processing": "Processo Streaming Legacy",
+    "Enable this if the streaming doesn't work with your proxy": "Habilita esta opción si el \"streaming\" no está funcionando.",
+    "Context Size (tokens)": "Tamaño del contexto (en Tokens)",
+    "Max Response Length (tokens)": "Tamaño máximo (en Tokens)",
+    "Temperature": "Temperatura",
+    "Frequency Penalty": "Frequency Penalty",
+    "Presence Penalty": "Presence Penalty",
+    "Top-p": "Top-p",
+    "Display bot response text chunks as they are generated": "Muestra el texto poco a poco al mismo tiempo que es generado.",
+    "Top A": "Top-a",
+    "Typical Sampling": "Typical Sampling",
+    "Tail Free Sampling": "Tail Free Sampling",
+    "Rep. Pen. Slope": "Rep. Pen. Slope",
+    "Single-line mode": "Modo \"Solo una línea\"",
+    "Top K": "Top-k",
+    "Top P": "Top-p",
+    "Do Sample": "Do Sample",
+    "Add BOS Token": "Añadir BOS Token",
+    "Add the bos_token to the beginning of prompts. Disabling this can make the replies more creative.": "Añade el \"bos_token\" al inicio del prompt. Desabilitar esto puede hacer las respuestas de la IA más creativas",
+    "Ban EOS Token": "Prohibir EOS Token",
+    "Ban the eos_token. This forces the model to never end the generation prematurely": "Prohibe el \"eos_token\". Esto obliga a la IA a no terminar su generación de forma prematura",
+    "Skip Special Tokens": "Saltarse Tokens Especiales",
+    "Beam search": "Beam Search",
+    "Number of Beams": "Number of Beams",
+    "Length Penalty": "Length Penalty",
+    "Early Stopping": "Early Stopping",
+    "Contrastive search": "Contrastive search",
+    "Penalty Alpha": "Penalty Alpha",
+    "Seed": "Seed",
+    "Inserts jailbreak as a last system message.": "Inserta el \"jailbreak\" como el último mensaje del Sistema",
+    "This tells the AI to ignore its usual content restrictions.": "Esto ayuda a la IA para ignorar sus restricciones de contenido",
+    "NSFW Encouraged": "Alentar \"NSFW\"",
+    "Tell the AI that NSFW is allowed.": "Le dice a la IA que el contenido NSFW (+18) está permitido",
+    "NSFW Prioritized": "Priorizar NSFW",
+    "NSFW prompt text goes first in the prompt to emphasize its effect.": "El \"prompt NSFW\" va antes para enfatizar su efecto",
+    "Streaming": "Streaming",
+    "Display the response bit by bit as it is generated.": "Enseña el texto poco a poco mientras es generado",
+    "When this is off, responses will be displayed all at once when they are complete.": "Cuando esto está deshabilitado, las respuestas se mostrarán de una vez cuando la generación se haya completado",
+    "Enhance Definitions": "Definiciones Mejoradas",
+    "Use OAI knowledge base to enhance definitions for public figures and known fictional characters": "Usa el conocimiento de OpenAI (GPT 3.5, GPT 4, ChatGPT) para mejorar las definiciones de figuras públicas y personajes ficticios",
+    "Wrap in Quotes": "Envolver En Comillas",
+    "Wrap entire user message in quotes before sending.": "Envuelve todo el mensaje en comillas antes de enviar",
+    "Leave off if you use quotes manually for speech.": "Déjalo deshabilitado si usas comillas manualmente para denotar diálogo",
+    "Main prompt": "Prompt Principal",
+    "The main prompt used to set the model behavior": "El prompt principal usado para definir el comportamiento de la IA",
+    "NSFW prompt": "Prompt NSFW",
+    "Prompt that is used when the NSFW toggle is on": "Prompt que es utilizado cuando \"Alentar NSFW\" está activado",
+    "Jailbreak prompt": "Jailbreak prompt",
+    "Prompt that is used when the Jailbreak toggle is on": "Prompt que es utilizado cuando Jailbreak Prompt está activado",
+    "Impersonation prompt": "Prompt \"Impersonar\"",
+    "Prompt that is used for Impersonation function": "Prompt que es utilizado para la función \"Impersonar\"",
+    "Logit Bias": "Logit Bias",
+    "Helps to ban or reenforce the usage of certain words": "Ayuda a prohibir o alentar el uso de algunas palabras",
+    "View / Edit bias preset": "Ver/Editar configuración de \"Logit Bias\"",
+    "Add bias entry": "Añadir bias",
+    "Jailbreak activation message": "Mensaje de activación de Jailbrak",
+    "Message to send when auto-jailbreak is on.": "Mensaje enviado cuando auto-jailbreak está activado",
+    "Jailbreak confirmation reply": "Mensaje de confirmación de Jailbreak",
+    "Bot must send this back to confirm jailbreak": "La IA debe enviar un mensaje para confirmar el jailbreak",
+    "Character Note": "Nota del personaje",
+    "Influences bot behavior in its responses": "Influencia el comportamiento de la IA y sus respuestas",
+    "API": "API",
+    "KoboldAI": "KoboldAI",
+    "Use Horde": "Usar AI Horde de KoboldAI",
+    "API url": "URL de la API",
+    "Register a Horde account for faster queue times": "Regístrate en KoboldAI para conseguir respuestas más rápido",
+    "Learn how to contribute your idle GPU cycles to the Hord": "Aprende cómo contribuir a AI Horde con tu GPU",
+    "Adjust context size to worker capabilities": "Ajustar tamaño del contexto a las capacidades del trabajador",
+    "Adjust response length to worker capabilities": "Ajustar tamaño de la respuesta a las capacidades del trabajador",
+    "API key": "API key",
+    "Register": "Registrarse",
+    "For privacy reasons": "Por motivos de privacidad, tu API será ocultada cuando se vuelva a cargar la página",
+    "Model": "Modelo IA",
+    "Hold Control / Command key to select multiple models.": "Presiona Ctrl/Command Key para seleccionar multiples modelos",
+    "Horde models not loaded": "Modelos del Horde no cargados",
+    "Not connected": "Desconectado",
+    "Novel API key": "API key de NovelAI",
+    "Follow": "Sigue",
+    "these directions": "estas instrucciones",
+    "to get your NovelAI API key.": "para conseguir tu NovelAI API key",
+    "Enter it in the box below": "Introduce tu NovelAI API key en el siguiente campo",
+    "Novel AI Model": "Modelo IA de NovelAI",
+    "Euterpe": "Euterpe",
+    "Krake": "Krake",
+    "No connection": "Desconectado",
+    "oobabooga/text-generation-webui": "oobabooga/text-generation-webui",
+    "Make sure you run it with": "Asegúrate de usar el argumento --api cuando se ejecute",
+    "Blocking API url": "API URL",
+    "Streaming API url": "Streaming API URL",
+    "to get your OpenAI API key.": "para conseguir tu clave API de OpenAI",
+    "OpenAI Model": "Modelo AI de OpenAI",
+    "View API Usage Metrics": "Ver métricas de uso de la API",
+    "Bot": "Bot",
+    "Auto-connect to Last Server": "Auto-conectarse con el último servidor",
+    "View hidden API keys": "Ver claves API ocultas",
+    "Advanced Formatting": "Formateo avanzado",
+    "AutoFormat Overrides": "Autoformateo de overrides",
+    "Samplers Order": "Orden de Samplers",
+    "Samplers will be applied in a top-down order. Use with caution.": "Los Samplers serán aplicados de orden superior a inferior. \nUsa con precaución",
+    "Load koboldcpp order": "Cargar el orden de koboldcpp",
+    "Repetition Penalty": "Repetition Penalty",
+    "Epsilon Cutoff": "Epsilon Cutoff",
+    "Eta Cutoff": "Eta Cutoff",
+    "Rep. Pen. Range.": "Rep. Pen. Range.",
+    "Rep. Pen. Freq.": "Rep. Pen. Freq.",
+    "Rep. Pen. Presence": "Rep. Pen. Presence."
     }
 }

public/index.html

@@ -2926,6 +2926,10 @@
                                 <input id="encode_tags" type="checkbox" />
                                 <span data-i18n="Show tags in responses">Show &lt;tags&gt; in responses</span>
                             </label>
+                            <label data-newbie-hidden class="checkbox_label" for="disable_group_trimming" title="Allow AI messages in groups to contain lines spoken by other group members.">
+                                <input id="disable_group_trimming" type="checkbox" />
+                                <span data-i18n="Show impersonated replies in groups">Show impersonated replies in groups</span>
+                            </label>
                             <label data-newbie-hidden class="checkbox_label" for="console_log_prompts">
                                 <input id="console_log_prompts" type="checkbox" />
                                 <span data-i18n="Log prompts to console">Log prompts to console</span>
@@ -4322,6 +4326,9 @@
                 <i class="fa-lg fa-solid fa-note-sticky"></i>
                 <span data-i18n="Author's Note">Author's Note</span>
             </a>
+            <div data-newbie-hidden id="options_advanced">
+
+            </div>
             <a id="option_back_to_main">
                 <i class="fa-lg fa-solid fa-left-long"></i>
                 <span data-i18n="Back to parent chat">Back to parent chat</span>

public/script.js

@@ -1895,7 +1895,17 @@ export function extractMessageBias(message) {
     }
 }
 
+/**
+ * Removes impersonated group member lines from the group member messages.
+ * Doesn't do anything if group reply trimming is disabled.
+ * @param {string} getMessage Group message
+ * @returns Cleaned-up group message
+ */
 function cleanGroupMessage(getMessage) {
+    if (power_user.disable_group_trimming) {
+        return getMessage;
+    }
+
     const group = groups.find((x) => x.id == selected_group);
 
     if (group && Array.isArray(group.members) && group.members) {

public/scripts/PromptManager.js

@@ -4,7 +4,7 @@ import { callPopup, event_types, eventSource, is_send_press, main_api, substitut
 import { is_group_generating } from "./group-chats.js";
 import { TokenHandler } from "./openai.js";
 import { power_user } from "./power-user.js";
-import { debounce, waitUntilCondition } from "./utils.js";
+import { debounce, waitUntilCondition, escapeHtml } from "./utils.js";
 
 function debouncePromise(func, delay) {
     let timeoutId;
@@ -1291,7 +1291,7 @@ PromptManagerModule.prototype.renderPromptManager = function () {
         const prompts = [...this.serviceSettings.prompts]
             .filter(prompt => prompt && !prompt?.system_prompt)
             .sort((promptA, promptB) => promptA.name.localeCompare(promptB.name))
-            .reduce((acc, prompt) => acc + `<option value="${prompt.identifier}">${prompt.name}</option>`, '');
+            .reduce((acc, prompt) => acc + `<option value="${prompt.identifier}">${escapeHtml(prompt.name)}</option>`, '');
 
         const footerHtml = `
             <div class="${this.configuration.prefix}prompt_manager_footer">
@@ -1440,13 +1440,14 @@ PromptManagerModule.prototype.renderPromptManagerListItems = function () {
             toggleSpanHtml = `<span class="fa-solid"></span>`;
         }
 
+        const encodedName = escapeHtml(prompt.name);
         listItemHtml += `
             <li class="${prefix}prompt_manager_prompt ${draggableClass} ${enabledClass} ${markerClass}" data-pm-identifier="${prompt.identifier}">
-                <span class="${prefix}prompt_manager_prompt_name" data-pm-name="${prompt.name}">
+                <span class="${prefix}prompt_manager_prompt_name" data-pm-name="${encodedName}">
                     ${prompt.marker ? '<span class="fa-solid fa-thumb-tack" title="Marker"></span>' : ''}
                     ${!prompt.marker && prompt.system_prompt ? '<span class="fa-solid fa-square-poll-horizontal" title="Global Prompt"></span>' : ''}
                     ${!prompt.marker && !prompt.system_prompt ? '<span class="fa-solid fa-user" title="User Prompt"></span>' : ''}
-                    ${this.isPromptInspectionAllowed(prompt) ? `<a class="prompt-manager-inspect-action">${prompt.name}</a>` : prompt.name}
+                    ${this.isPromptInspectionAllowed(prompt) ? `<a class="prompt-manager-inspect-action">${encodedName}</a>` : encodedName}
                 </span>
                 <span>
                         <span class="prompt_manager_prompt_controls">

public/scripts/extensions/cfg/index.js

@@ -385,7 +385,7 @@ jQuery(async () => {
 
     const buttonHtml = $(await $.get(`${extensionFolderPath}/menuButton.html`));
     buttonHtml.on('click', onCfgMenuItemClick)
-    buttonHtml.insertAfter("#option_toggle_AN");
+    buttonHtml.appendTo("#options_advanced");
 
     // Hook events
     eventSource.on(event_types.CHAT_CHANGED, async () => {

public/scripts/power-user.js

@@ -165,6 +165,7 @@ let power_user = {
     continue_on_send: false,
     trim_spaces: true,
     relaxed_api_urls: false,
+    disable_group_trimming: false,
 
     default_instruct: '',
     instruct: {
@@ -789,6 +790,7 @@ function loadPowerUserSettings(settings, data) {
     $("#trim_sentences_checkbox").prop("checked", power_user.trim_sentences);
     $("#include_newline_checkbox").prop("checked", power_user.include_newline);
     $('#render_formulas').prop("checked", power_user.render_formulas);
+    $('#disable_group_trimming').prop("checked", power_user.disable_group_trimming);
     $("#markdown_escape_strings").val(power_user.markdown_escape_strings);
     $("#fast_ui_mode").prop("checked", power_user.fast_ui_mode);
     $("#waifuMode").prop("checked", power_user.waifuMode);
@@ -2160,6 +2162,11 @@ $(document).ready(() => {
         saveSettingsDebounced();
     });
 
+    $('#disable_group_trimming').on('input', function () {
+        power_user.disable_group_trimming = !!$(this).prop('checked');
+        saveSettingsDebounced();
+    });
+
     $('#debug_menu').on('click', function () {
         showDebugMenu();
     });

public/scripts/utils.js

@@ -14,6 +14,10 @@ export const PAGINATION_TEMPLATE = '<%= rangeStart %>-<%= rangeEnd %> of <%= tot
  */
 export const navigation_option = { none: 0, previous: 1, last: 2, };
 
+export function escapeHtml(str) {
+    return String(str).replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;');
+}
+
 /**
  * Determines if a value is unique in an array.
  * @param {any} value Current value.

server.js

@@ -53,8 +53,8 @@ const cliArguments = yargs(hideBin(process.argv))
 
 // change all relative paths
 const path = require('path');
-const directory = process.pkg ? path.dirname(process.execPath) : __dirname;
+const directory = process['pkg'] ? path.dirname(process.execPath) : __dirname;
-console.log(process.pkg ? 'Running from binary' : 'Running from source');
+console.log(process['pkg'] ? 'Running from binary' : 'Running from source');
 process.chdir(directory);
 
 const express = require('express');
@@ -385,7 +385,7 @@ function getIpFromRequest(req) {
     let clientIp = req.connection.remoteAddress;
     let ip = ipaddr.parse(clientIp);
     // Check if the IP address is IPv4-mapped IPv6 address
-    if (ip.kind() === 'ipv6' && ip.isIPv4MappedAddress()) {
+    if (ip.kind() === 'ipv6' && ip instanceof ipaddr.IPv6 && ip.isIPv4MappedAddress()) {
         const ipv4 = ip.toIPv4Address().toString();
         clientIp = ipv4;
     } else {
@@ -422,7 +422,7 @@ app.use(function (req, res, next) {
 });
 
 
-app.use(express.static(process.cwd() + "/public", { refresh: true }));
+app.use(express.static(process.cwd() + "/public", {}));
 
 app.use('/backgrounds', (req, res) => {
     const filePath = decodeURIComponent(path.join(process.cwd(), 'public/backgrounds', req.url.replace(/%20/g, ' ')));
@@ -596,7 +596,7 @@ app.post("/generate", jsonParser, async function (request, response_generate = r
 });
 
 //************** Text generation web UI
-app.post("/generate_textgenerationwebui", jsonParser, async function (request, response_generate = response) {
+app.post("/generate_textgenerationwebui", jsonParser, async function (request, response_generate) {
     if (!request.body) return response_generate.sendStatus(400);
 
     console.log(request.body);
@@ -711,7 +711,7 @@ app.post("/generate_textgenerationwebui", jsonParser, async function (request, r
             console.log("Endpoint response:", data);
             return response_generate.send(data);
         } catch (error) {
-            retval = { error: true, status: error.status, response: error.statusText };
+            let retval = { error: true, status: error.status, response: error.statusText };
             console.log("Endpoint error:", error);
             try {
                 retval.response = await error.json();
@@ -837,7 +837,7 @@ function getVersion() {
     try {
         const pkgJson = require('./package.json');
         pkgVersion = pkgJson.version;
-        if (!process.pkg && commandExistsSync('git')) {
+        if (!process['pkg'] && commandExistsSync('git')) {
             gitRevision = require('child_process')
                 .execSync('git rev-parse --short HEAD', { cwd: process.cwd(), stdio: ['ignore', 'pipe', 'ignore'] })
                 .toString().trim();
@@ -4227,7 +4227,7 @@ app.post('/readsecretstate', jsonParser, (_, response) => {
     }
 
     try {
-        const fileContents = fs.readFileSync(SECRETS_FILE);
+        const fileContents = fs.readFileSync(SECRETS_FILE, 'utf8');
         const secrets = JSON.parse(fileContents);
         const state = {};
 
@@ -4286,7 +4286,7 @@ app.post('/viewsecrets', jsonParser, async (_, response) => {
     }
 
     try {
-        const fileContents = fs.readFileSync(SECRETS_FILE);
+        const fileContents = fs.readFileSync(SECRETS_FILE, 'utf-8');
         const secrets = JSON.parse(fileContents);
         return response.send(secrets);
     } catch (error) {
@@ -4349,6 +4349,7 @@ app.post('/horde_generateimage', jsonParser, async (request, response) => {
                 {
                     sampler_name: request.body.sampler,
                     hires_fix: request.body.enable_hr,
+                    // @ts-ignore - use_gfpgan param is not in the type definition, need to update to new ai_horde @ https://github.com/ZeldaFan0225/ai_horde/blob/main/index.ts
                     use_gfpgan: request.body.restore_faces,
                     cfg_scale: request.body.scale,
                     steps: request.body.steps,
@@ -4375,6 +4376,7 @@ app.post('/horde_generateimage', jsonParser, async (request, response) => {
 
             if (check.done) {
                 const result = await ai_horde.getImageGenerationStatus(generation.id);
+                if (result.generations === undefined) return response.sendStatus(500);
                 return response.send(result.generations[0].img);
             }
 
@@ -4703,7 +4705,7 @@ app.post('/import_custom', jsonParser, async (request, response) => {
             return response.sendStatus(404);
         }
 
-        response.set('Content-Type', result.fileType);
+        if (result.fileType) response.set('Content-Type', result.fileType)
         response.set('Content-Disposition', `attachment; filename="${result.fileName}"`);
         response.set('X-Custom-Content-Type', chubParsed?.type);
         return response.send(result.buffer);
@@ -4761,6 +4763,11 @@ async function downloadChubCharacter(id) {
     return { buffer, fileName, fileType };
 }
 
+/**
+ *
+ * @param {String} str
+ * @returns { { id: string, type: "character" | "lorebook" } | null }
+ */
 function parseChubUrl(str) {
     const splitStr = str.split('/');
     const length = splitStr.length;
@@ -4865,7 +4872,7 @@ function writeSecret(key, value) {
         writeFileAtomicSync(SECRETS_FILE, emptyFile, "utf-8");
     }
 
-    const fileContents = fs.readFileSync(SECRETS_FILE);
+    const fileContents = fs.readFileSync(SECRETS_FILE, 'utf-8');
     const secrets = JSON.parse(fileContents);
     secrets[key] = value;
     writeFileAtomicSync(SECRETS_FILE, JSON.stringify(secrets), "utf-8");
@@ -4876,7 +4883,7 @@ function readSecret(key) {
         return undefined;
     }
 
-    const fileContents = fs.readFileSync(SECRETS_FILE);
+    const fileContents = fs.readFileSync(SECRETS_FILE, 'utf-8');
     const secrets = JSON.parse(fileContents);
     return secrets[key];
 }
@@ -4957,7 +4964,7 @@ async function getImageBuffers(zipFilePath) {
 /**
  * This function extracts the extension information from the manifest file.
  * @param {string} extensionPath - The path of the extension folder
- * @returns {Object} - Returns the manifest data as an object
+ * @returns {Promise<Object>} - Returns the manifest data as an object
  */
 async function getManifest(extensionPath) {
     const manifestPath = path.join(extensionPath, 'manifest.json');
@@ -4972,6 +4979,7 @@ async function getManifest(extensionPath) {
 }
 
 async function checkIfRepoIsUpToDate(extensionPath) {
+    // @ts-ignore - simple-git types are incorrect, this is apparently callable but no call signature
     const git = simpleGit();
     await git.cwd(extensionPath).fetch('origin');
     const currentBranch = await git.cwd(extensionPath).branch();
@@ -5002,6 +5010,7 @@ async function checkIfRepoIsUpToDate(extensionPath) {
  * @returns {void}
  */
 app.post('/get_extension', jsonParser, async (request, response) => {
+    // @ts-ignore - simple-git types are incorrect, this is apparently callable but no call signature
     const git = simpleGit();
     if (!request.body.url) {
         return response.status(400).send('Bad Request: URL is required in the request body.');
@@ -5047,6 +5056,7 @@ app.post('/get_extension', jsonParser, async (request, response) => {
  * @returns {void}
  */
 app.post('/update_extension', jsonParser, async (request, response) => {
+    // @ts-ignore - simple-git types are incorrect, this is apparently callable but no call signature
     const git = simpleGit();
     if (!request.body.extensionName) {
         return response.status(400).send('Bad Request: extensionName is required in the request body.');
@@ -5092,6 +5102,7 @@ app.post('/update_extension', jsonParser, async (request, response) => {
  * @returns {void}
  */
 app.post('/get_extension_version', jsonParser, async (request, response) => {
+    // @ts-ignore - simple-git types are incorrect, this is apparently callable but no call signature
     const git = simpleGit();
     if (!request.body.extensionName) {
         return response.status(400).send('Bad Request: extensionName is required in the request body.');
@@ -5240,10 +5251,11 @@ app.post('/asset_download', jsonParser, async (request, response) => {
     const inputCategory = request.body.category;
     const inputFilename = sanitize(request.body.filename);
     const validCategories = ["bgm", "ambient"];
+    const fetch = require('node-fetch').default;
 
     // Check category
     let category = null;
-    for (i of validCategories)
+    for (let i of validCategories)
         if (i == inputCategory)
             category = i;
 
@@ -5255,7 +5267,7 @@ app.post('/asset_download', jsonParser, async (request, response) => {
     // Sanitize filename
     const safe_input = checkAssetFileName(inputFilename);
     if (safe_input == '')
-        return response.sendFile(400);
+        return response.sendStatus(400);
 
     const temp_path = path.join(directories.assets, "temp", safe_input)
     const file_path = path.join(directories.assets, category, safe_input)
@@ -5263,9 +5275,8 @@ app.post('/asset_download', jsonParser, async (request, response) => {
 
     try {
         // Download to temp
-        const downloadFile = (async (url, temp_path) => {
         const res = await fetch(url);
-            if (!res.ok) {
+        if (!res.ok || res.body === null) {
             throw new Error(`Unexpected response ${res.statusText}`);
         }
         const destination = path.resolve(temp_path);
@@ -5276,10 +5287,7 @@ app.post('/asset_download', jsonParser, async (request, response) => {
             });
         }
         const fileStream = fs.createWriteStream(destination, { flags: 'wx' });
-            await finished(Readable.fromWeb(res.body).pipe(fileStream));
+        await finished(res.body.pipe(fileStream));
-        });
-
-        await downloadFile(url, temp_path);
 
         // Move into asset place
         console.debug("Download finished, moving file from", temp_path, "to", file_path);
@@ -5309,7 +5317,7 @@ app.post('/asset_delete', jsonParser, async (request, response) => {
 
     // Check category
     let category = null;
-    for (i of validCategories)
+    for (let i of validCategories)
         if (i == inputCategory)
             category = i;
 
@@ -5321,7 +5329,7 @@ app.post('/asset_delete', jsonParser, async (request, response) => {
     // Sanitize filename
     const safe_input = checkAssetFileName(inputFilename);
     if (safe_input == '')
-        return response.sendFile(400);
+        return response.sendStatus(400);
 
     const file_path = path.join(directories.assets, category, safe_input)
     console.debug("Request received to delete", category, file_path);
@@ -5358,13 +5366,14 @@ app.post('/asset_delete', jsonParser, async (request, response) => {
  * @returns {void}
  */
 app.post('/get_character_assets_list', jsonParser, async (request, response) => {
-    const name = sanitize(request.query.name);
+    if (request.query.name === undefined) return response.sendStatus(400);
+    const name = sanitize(request.query.name.toString());
     const inputCategory = request.query.category;
     const validCategories = ["bgm", "ambient"]
 
     // Check category
     let category = null
-    for (i of validCategories)
+    for (let i of validCategories)
         if (i == inputCategory)
             category = i
 
@@ -5383,7 +5392,7 @@ app.post('/get_character_assets_list', jsonParser, async (request, response) =>
                     return filename != ".placeholder";
                 });
 
-            for (i of files)
+            for (let i of files)
                 output.push(`/characters/${name}/${category}/${i}`);
 
         }