klinsmaya/SQLBot
1
0
Fork 0
mirror of https://gh-proxy.org/https://github.com/klinsmaya/SQLBot.git synced 2026-11-08 01:06:59 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix: Authenticated IDOR in Dashboard update endpoints allows cross-user Dashboard modification

Browse Source
This commit is contained in:
wangjiahao
2026-09-09 14:11:08 +08:00
parent 835d0b10bd
commit 33c87b61a4
1 changed files with 20 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/apps/dashboard/crud/dashboard_service.py
+20 -2
View File
@@ -79,7 +79,16 @@ def create_resource(session: SessionDep, user: CurrentUser, dashboard: CreateDas
def update_resource(session: SessionDep, user: CurrentUser, dashboard: QueryDashboard):
record = session.query(CoreDashboard).filter(CoreDashboard.id == dashboard.id).first()
# 添加权限检查：只能更新自己创建的、且在自己工作空间的 Dashboard
record = session.query(CoreDashboard).filter(
CoreDashboard.id == dashboard.id,
CoreDashboard.create_by == str(user.id),
CoreDashboard.workspace_id == str(user.oid if user.oid is not None else 1)
).first()
if not record:
raise ValueError(f"Dashboard with id {dashboard.id} does not exist or you do not have permission to update it")
record.name = dashboard.name
record.update_by = user.id
record.update_time = int(time.time())
@@ -102,7 +111,16 @@ def create_canvas(session: SessionDep, user: CurrentUser, dashboard: CreateDashb
def update_canvas(session: SessionDep, user: CurrentUser, dashboard: CreateDashboard):
record = session.query(CoreDashboard).filter(CoreDashboard.id == dashboard.id).first()
# 添加权限检查：只能更新自己创建的、且在自己工作空间的 Dashboard
record = session.query(CoreDashboard).filter(
CoreDashboard.id == dashboard.id,
CoreDashboard.create_by == str(user.id),
CoreDashboard.workspace_id == str(user.oid if user.oid is not None else 1)
).first()
if not record:
raise ValueError(f"Dashboard with id {dashboard.id} does not exist or you do not have permission to update it")
record.name = dashboard.name
record.update_by = user.id
record.update_time = int(time.time())