From 36cdb053879401c9db8640f0f827c2f300edd239 Mon Sep 17 00:00:00 2001
From: Pascal Vizeli <pascal.vizeli@syshack.ch>
Date: Mon, 1 Oct 2018 15:22:26 +0200
Subject: [PATCH] Don't allow add-on to update itself (#733)

---
 hassio/api/security.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hassio/api/security.py b/hassio/api/security.py
index 40dbe9efb..2377af769 100644
--- a/hassio/api/security.py
+++ b/hassio/api/security.py
@@ -32,7 +32,7 @@ NO_SECURITY_CHECK = re.compile(
 # Can called by every add-on
 ADDONS_API_BYPASS = re.compile(
     r"^(?:"
-    r"|/addons/self/(?!security)[^/]+"
+    r"|/addons/self/(?!security|update)[^/]+"
     r"|/version"
     r"|/services.*"
     r"|/discovery.*"