From c0539cf1a6256089ed1b9601d5477657963458ac Mon Sep 17 00:00:00 2001
From: HibiKier <775757368@qq.com>
Date: Sun, 16 Mar 2025 20:27:46 +0800
Subject: [PATCH] =?UTF-8?q?:adhesive=5Fbandage:=20=E6=A3=80=E6=B5=8B?=
 =?UTF-8?q?=E6=95=B0=E6=8D=AE=E5=BA=93=E8=B7=AF=E5=BE=84?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 zhenxun/builtin_plugins/web_ui/api/configure/__init__.py | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/zhenxun/builtin_plugins/web_ui/api/configure/__init__.py b/zhenxun/builtin_plugins/web_ui/api/configure/__init__.py
index f04fe5fe..abadd03e 100644
--- a/zhenxun/builtin_plugins/web_ui/api/configure/__init__.py
+++ b/zhenxun/builtin_plugins/web_ui/api/configure/__init__.py
@@ -52,7 +52,10 @@ async def _(setting: Setting) -> Result:
         port = setting.port
     if setting.db_url:
         if setting.db_url.startswith("sqlite"):
+            base_dir = Path().resolve()
             db_path = Path(setting.db_url.split(":")[-1])
+            if db_path.is_absolute() and not db_path.is_relative_to(base_dir):
+                return Result.fail("数据库路径不在项目根目录内。")
             db_path.parent.mkdir(parents=True, exist_ok=True)
         env_text = env_text.replace('DB_URL = ""', f'DB_URL = "{setting.db_url}"')
     if setting.username: