klinsmaya/SQLBot
1
0
Fork 0
mirror of https://gh-proxy.org/https://github.com/klinsmaya/SQLBot.git synced 2026-11-10 18:26:55 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix: Cross-Workspace Data-Source Schema Disclosure and Modification (Incomplete IDOR Remediation)

Browse Source
This commit is contained in:
junjun
2026-09-17 15:23:43 +08:00
parent 26818963a6
commit 35e7e00592
2 changed files with 19 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/apps/datasource/api/datasource.py
+4 -3
View File
@@ -166,8 +166,9 @@ async def get_fields(session: SessionDep,
@router.post("/syncFields/{ds_id}/{id}", response_model=None, summary=f"{PLACEHOLDER_PREFIX}ds_sync_fields") @router.post("/syncFields/{ds_id}/{id}", response_model=None, summary=f"{PLACEHOLDER_PREFIX}ds_sync_fields")
@require_permissions(permission=SqlbotPermission(role=['ws_admin'], type='ds', keyExpression="ds_id")) @require_permissions(permission=SqlbotPermission(role=['ws_admin'], type='ds', keyExpression="ds_id"))
async def sync_fields(session: SessionDep, trans: Trans, async def sync_fields(session: SessionDep, trans: Trans,
ds_id: int = Path(..., description=f"{PLACEHOLDER_PREFIX}ds_id"),
id: int = Path(..., description=f"{PLACEHOLDER_PREFIX}ds_table_id")): id: int = Path(..., description=f"{PLACEHOLDER_PREFIX}ds_table_id")):
return sync_single_fields(session, trans, id) return sync_single_fields(session, trans, ds_id, id)
from pydantic import BaseModel from pydantic import BaseModel
@@ -215,13 +216,13 @@ async def field_list(session: SessionDep, field: FieldObj,
@router.post("/editTable", response_model=None, summary=f"{PLACEHOLDER_PREFIX}ds_edit_table") @router.post("/editTable", response_model=None, summary=f"{PLACEHOLDER_PREFIX}ds_edit_table")
@require_permissions(permission=SqlbotPermission(role=['ws_admin'], type='ds', keyExpression="ds_id")) @require_permissions(permission=SqlbotPermission(role=['ws_admin'], type='ds', keyExpression="table.ds_id"))
async def edit_table(session: SessionDep, table: CoreTable): async def edit_table(session: SessionDep, table: CoreTable):
updateTable(session, table) updateTable(session, table)
@router.post("/editField", response_model=None, summary=f"{PLACEHOLDER_PREFIX}ds_edit_field") @router.post("/editField", response_model=None, summary=f"{PLACEHOLDER_PREFIX}ds_edit_field")
@require_permissions(permission=SqlbotPermission(role=['ws_admin'], type='ds', keyExpression="ds_id")) @require_permissions(permission=SqlbotPermission(role=['ws_admin'], type='ds', keyExpression="field.ds_id"))
async def edit_field(session: SessionDep, field: CoreField): async def edit_field(session: SessionDep, field: CoreField):
updateField(session, field) updateField(session, field)
backend/apps/datasource/crud/datasource.py
+15 -3
View File
@@ -121,7 +121,8 @@ def update_ds(session: SessionDep, trans: Trans, user: CurrentUser, ds: CoreData
def update_ds_recommended_config(session: SessionDep, datasource_id: int, recommended_config: int): def update_ds_recommended_config(session: SessionDep, datasource_id: int, recommended_config: int):
# 使用 update 语句直接更新，避免 ORM 追踪问题 # 使用 update 语句直接更新，避免 ORM 追踪问题
from sqlalchemy import update from sqlalchemy import update
stmt = update(CoreDatasource).where(CoreDatasource.id == datasource_id).values(recommended_config=recommended_config) stmt = update(CoreDatasource).where(CoreDatasource.id == datasource_id).values(
recommended_config=recommended_config)
session.execute(stmt) session.execute(stmt)
session.commit() session.commit()
@@ -181,8 +182,10 @@ def execSql(session: SessionDep, id: int, sql: str):
return exec_sql(ds, sql, True) return exec_sql(ds, sql, True)
def sync_single_fields(session: SessionDep, trans: Trans, id: int): def sync_single_fields(session: SessionDep, trans: Trans, ds_id: int, id: int):
table = session.query(CoreTable).filter(CoreTable.id == id).first() table = session.query(CoreTable).filter(and_(CoreTable.id == id, CoreTable.ds_id == ds_id)).first()
if not table:
raise HTTPException(status_code=500, detail='The data source ID does not match the table ID')
ds = session.query(CoreDatasource).filter(CoreDatasource.id == table.ds_id).first() ds = session.query(CoreDatasource).filter(CoreDatasource.id == table.ds_id).first()
tables = getTablesByDs(session, ds) tables = getTablesByDs(session, ds)
@@ -289,6 +292,10 @@ def update_table_and_fields(session: SessionDep, data: TableObj):
def updateTable(session: SessionDep, table: CoreTable): def updateTable(session: SessionDep, table: CoreTable):
obj = session.query(CoreTable).filter(and_(CoreTable.id == table.id, CoreTable.ds_id == table.ds_id)).first()
if not obj:
raise HTTPException(status_code=500, detail='The data source ID does not match the table ID')
update_table(session, table) update_table(session, table)
# do table embedding # do table embedding
@@ -297,6 +304,11 @@ def updateTable(session: SessionDep, table: CoreTable):
def updateField(session: SessionDep, field: CoreField): def updateField(session: SessionDep, field: CoreField):
obj = session.query(CoreField).filter(
and_(CoreField.id == field.id, CoreField.table_id == field.table_id, CoreField.ds_id == field.ds_id)).first()
if not obj:
raise HTTPException(status_code=500, detail='Resource ID does not matched')
update_field(session, field) update_field(session, field)
# do table embedding # do table embedding