klinsmaya/SQLBot
1
0
Fork 0
mirror of https://gh-proxy.org/https://github.com/klinsmaya/SQLBot.git synced 2026-11-08 09:17:06 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix: Cross-Workspace Data-Source Schema Disclosure and Modification (Incomplete IDOR Remediation)

Browse Source
This commit is contained in:
junjun
2026-09-17 15:23:43 +08:00
parent 26818963a6
commit 35e7e00592
2 changed files with 19 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/apps/datasource/api/datasource.py
+4 -3
View File
@@ -166,8 +166,9 @@ async def get_fields(session: SessionDep,
@router.post("/syncFields/{ds_id}/{id}", response_model=None, summary=f"{PLACEHOLDER_PREFIX}ds_sync_fields")
@require_permissions(permission=SqlbotPermission(role=['ws_admin'], type='ds', keyExpression="ds_id"))
async def sync_fields(session: SessionDep, trans: Trans,
ds_id: int = Path(..., description=f"{PLACEHOLDER_PREFIX}ds_id"),
id: int = Path(..., description=f"{PLACEHOLDER_PREFIX}ds_table_id")):
return sync_single_fields(session, trans, id)
return sync_single_fields(session, trans, ds_id, id)
from pydantic import BaseModel
@@ -215,13 +216,13 @@ async def field_list(session: SessionDep, field: FieldObj,
@router.post("/editTable", response_model=None, summary=f"{PLACEHOLDER_PREFIX}ds_edit_table")
@require_permissions(permission=SqlbotPermission(role=['ws_admin'], type='ds', keyExpression="ds_id"))
@require_permissions(permission=SqlbotPermission(role=['ws_admin'], type='ds', keyExpression="table.ds_id"))
async def edit_table(session: SessionDep, table: CoreTable):
updateTable(session, table)
@router.post("/editField", response_model=None, summary=f"{PLACEHOLDER_PREFIX}ds_edit_field")
@require_permissions(permission=SqlbotPermission(role=['ws_admin'], type='ds', keyExpression="ds_id"))
@require_permissions(permission=SqlbotPermission(role=['ws_admin'], type='ds', keyExpression="field.ds_id"))
async def edit_field(session: SessionDep, field: CoreField):
updateField(session, field)