From 1c8b6f95ae4baa095f57f24ff8e3d4c7e7ec0390 Mon Sep 17 00:00:00 2001
From: junjun <junjie.xia@fit2cloud.com>
Date: Wed, 17 Jun 2026 17:56:41 +0800
Subject: [PATCH] fix: Fix the vulnerability in viewing enumeration values
 across workspaces

---
 backend/apps/datasource/api/datasource.py | 1 +
 1 file changed, 1 insertion(+)

diff --git a/backend/apps/datasource/api/datasource.py b/backend/apps/datasource/api/datasource.py
index 1e72c3fb..90801fdf 100644
--- a/backend/apps/datasource/api/datasource.py
+++ b/backend/apps/datasource/api/datasource.py
@@ -65,6 +65,7 @@ async def check(session: SessionDep, trans: Trans, ds: CoreDatasource):
 
 
 @router.get("/check/{ds_id}", response_model=bool, summary=f"{PLACEHOLDER_PREFIX}ds_check")
+@require_permissions(permission=SqlbotPermission(type='ds', keyExpression="ds_id"))
 async def check_by_id(session: SessionDep, trans: Trans,
                       ds_id: int = Path(..., description=f"{PLACEHOLDER_PREFIX}ds_id")):
     def inner():