From 684fe3945d4c6306a7b30a8e6058d96ba74a85f7 Mon Sep 17 00:00:00 2001
From: MacRimi <ricoextincion@gmail.com>
Date: Sun, 30 Nov 2025 21:19:38 +0100
Subject: [PATCH] Update AppImage

---
 AppImage/app/api/gpu/nvidia/install/route.ts |  4 ++--
 AppImage/scripts/flask_server.py             | 24 ++++++++++++--------
 2 files changed, 17 insertions(+), 11 deletions(-)

diff --git a/AppImage/app/api/gpu/nvidia/install/route.ts b/AppImage/app/api/gpu/nvidia/install/route.ts
index 9e94ab7..1a66946 100644
--- a/AppImage/app/api/gpu/nvidia/install/route.ts
+++ b/AppImage/app/api/gpu/nvidia/install/route.ts
@@ -28,8 +28,8 @@ export async function POST(request: Request) {
         "Content-Type": "application/json",
       },
       body: JSON.stringify({
-        script_path: "/usr/local/share/proxmenux/scripts/gpu_tpu/nvidia_installer.sh",
-        env: {
+        script_relative_path: "gpu_tpu/nvidia_installer.sh",
+        params: {
           EXECUTION_MODE: "web",
           WEB_LOG: "/tmp/nvidia_web_install.log",
         },
diff --git a/AppImage/scripts/flask_server.py b/AppImage/scripts/flask_server.py
index 91b7892..2219562 100644
--- a/AppImage/scripts/flask_server.py
+++ b/AppImage/scripts/flask_server.py
@@ -6353,15 +6353,21 @@ def execute_script():
         script_name = data.get('script_name')
         script_params = data.get('params', {})
         
-        # Map script names to file paths
-        script_map = {
-            'nvidia_installer': '/usr/local/share/proxmenux/scripts/gpu_tpu/nvidia_installer.sh',
-        }
-        
-        if script_name not in script_map:
-            return jsonify({'success': False, 'error': 'Unknown script'}), 400
-        
-        script_path = script_map[script_name]
+
+        script_relative_path = data.get('script_relative_path')
+
+        if not script_relative_path:
+            return jsonify({'error': 'script_relative_path is required'}), 400
+
+
+        BASE_SCRIPTS_DIR = '/usr/local/share/proxmenux/scripts'
+        script_path = os.path.join(BASE_SCRIPTS_DIR, script_relative_path)
+
+
+        script_path = os.path.abspath(script_path)
+        if not script_path.startswith(BASE_SCRIPTS_DIR):
+            return jsonify({'error': 'Invalid script path'}), 403
+
         
         if not os.path.exists(script_path):
             return jsonify({'success': False, 'error': 'Script file not found'}), 404