security patch: model downloading policy is updated

doesn't allow model downloading if security level is high and ComfyUI is remotely accessible

glob/manager_server.py

@@ -985,6 +985,14 @@ async def install_model(request):
 
     model_path = get_model_path(json_data)
 
+    if not is_allowed_security_level('middle'):
+        print(f"ERROR: To use this action, a security_level of `middle or below` is required. Please contact the administrator.")
+        return web.Response(status=403)
+
+    if not json_data['name'].endswith('.safetensors') and not is_allowed_security_level('high'):
+        print(f"ERROR: To use this feature, you must set '--listen' to a local IP and set the security level to 'middle' or 'weak'. Please contact the administrator.")
+        return web.Response(status=403)
+
     res = False
 
     try: