针对最近home assistant遍历漏洞升级后不能使用天猫精灵

[neckyaan]

今天因为home assistant 遍历漏洞，升级系统为：python3.8.6+home assistant 2021.3.2版本，在启动中提示如下信息，并且加载了插件后无法启动。但因为遍历漏洞又不得不升级，希望作者尽快完善。
Restarting Home Assistant
2021-03-07 15:45:09 WARNING (MainThread) [homeassistant.loader] You are using a custom integration zhibot which has not been tested by Home Assistant. This component might cause stability problems, be sure to disable it if you experience issues with Home Assistant
2021-03-07 15:45:09 WARNING (MainThread) [homeassistant.loader] No 'version' key in the manifest file for custom integration 'zhibot'. This will not be allowed in a future version of Home Assistant. Please report this to the maintainer of 'zhibot'
2021-03-07 15:45:09 WARNING (MainThread) [homeassistant.loader] You are using a custom integration hacs which has not been tested by Home Assistant. This component might cause stability problems, be sure to disable it if you experience issues with Home Assistant

并且表现为明明服务在运行，可是就是登录不了页面

[neckyaan]

后台报错如下：
2021-03-09 21:49:26 ERROR (MainThread) [homeassistant] Error doing job: Task exception was never retrieved
Traceback (most recent call last):
File "/home/homeassistant/.homeassistant/custom_components/hacs/operational/reload.py", line 10, in async_reload_entry
await async_setup_entry(hass, config_entry)
File "/home/homeassistant/.homeassistant/custom_components/hacs/operational/setup.py", line 68, in async_setup_entry
return await async_startup_wrapper_for_config_entry()
File "/home/homeassistant/.homeassistant/custom_components/hacs/operational/setup.py", line 97, in async_startup_wrapper_for_config_entry
raise ConfigEntryNotReady
homeassistant.exceptions.ConfigEntryNotReady
2021-03-09 22:25:39 WARNING (MainThread) [homeassistant.components.http.ban] Login attempt or request with invalid authentication from OpenWrt.lan (192.168.3.1). (Mozilla/5.0 (Linux; Android 10; ELE-AL00) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.117 Mobile Safari/537.36)
2021-03-09 22:26:37 WARNING (MainThread) [homeassistant.components.http.ban] Login attempt or request with invalid authentication from OpenWrt.lan (192.168.3.1). (Mozilla/5.0 (Linux; Android 10; ELE-AL00) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.117 Mobile Safari/537.36)
2021-03-09 22:31:57 WARNING (MainThread) [homeassistant.loader] You are using a custom integration zhibot which has not been tested by Home Assistant. This component might cause stability problems, be sure to disable it if you experience issues with Home Assistant
Home Assistant attempting to restart.
Restarting Home Assistant
2021-03-09 22:32:05 WARNING (MainThread) [homeassistant.loader] You are using a custom integration hacs which has not been tested by Home Assistant. This component might cause stability problems, be sure to disable it if you experience issues with Home Assistant
2021-03-09 22:32:05 WARNING (MainThread) [homeassistant.loader] You are using a custom integration zhibot which has not been tested by Home Assistant. This component might cause stability problems, be sure to disable it if you experience issues with Home Assistant
2021-03-09 22:32:13 ERROR (MainThread)

然后就是可以输入用户名和密码，但一进入网页就提示：
unable to connect to home assistant
retry
关了zhibot 就没问题，输入用户和密码后可以顺利登录，大神何解？

[neckyaan]

TypeError: async_create_refresh_token() takes from 2 to 7 positional arguments but 8 were given

[102757017]

我也遇到了同样的问题，加载了天猫精灵的插件就无法登陆，在configuration.yaml中关闭插件就里面恢复正常

[neckyaan]

最终解决方案：安装nginx,配置用nginx作https代理回落hass，hass不用ssl,直接用http。

[neckyaan]

参见Yonsm/ZhiBot#3 的解决方案