klinsmaya/SQLBot
1
0
Fork 0
mirror of https://gh-proxy.org/https://github.com/klinsmaya/SQLBot.git synced 2026-11-10 18:26:55 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix: API security vulnerability (#714)

Browse Source
This commit is contained in:
fit2cloud-chenyw
2025-12-30 14:16:30 +08:00
committed by GitHub
parent cdc086c2b4
commit 692103ddb2
5 changed files with 134 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/apps/datasource/api/datasource.py
+11 -2
View File
@@ -83,6 +83,7 @@ async def add(session: SessionDep, trans: Trans, user: CurrentUser, ds: CreateDa
@router.post("/chooseTables/{id}", response_model=None, summary=f"{PLACEHOLDER_PREFIX}ds_choose_tables")
@require_permissions(permission=SqlbotPermission(role=['ws_admin'], permission=SqlbotPermission(type='ds', keyExpression="id")))
async def choose_tables(session: SessionDep, trans: Trans, tables: List[CoreTable],
id: int = Path(..., description=f"{PLACEHOLDER_PREFIX}ds_id")):
def inner():
@@ -117,6 +118,7 @@ async def get_tables(session: SessionDep, id: int = Path(..., description=f"{PLA
@router.post("/getTablesByConf", response_model=List[TableSchemaResponse], summary=f"{PLACEHOLDER_PREFIX}ds_get_tables")
@require_permissions(permission=SqlbotPermission(role=['ws_admin']))
async def get_tables_by_conf(session: SessionDep, trans: Trans, ds: CoreDatasource):
try:
def inner():
@@ -135,6 +137,7 @@ async def get_tables_by_conf(session: SessionDep, trans: Trans, ds: CoreDatasour
@router.post("/getSchemaByConf", response_model=List[str], summary=f"{PLACEHOLDER_PREFIX}ds_get_schema")
@require_permissions(permission=SqlbotPermission(role=['ws_admin']))
async def get_schema_by_conf(session: SessionDep, trans: Trans, ds: CoreDatasource):
try:
def inner():
@@ -154,6 +157,7 @@ async def get_schema_by_conf(session: SessionDep, trans: Trans, ds: CoreDatasour
@router.post("/getFields/{id}/{table_name}", response_model=List[ColumnSchemaResponse],
summary=f"{PLACEHOLDER_PREFIX}ds_get_fields")
@require_permissions(permission=SqlbotPermission(role=['ws_admin'], type='ds', keyExpression="id"))
async def get_fields(session: SessionDep,
id: int = Path(..., description=f"{PLACEHOLDER_PREFIX}ds_id"),
table_name: str = Path(..., description=f"{PLACEHOLDER_PREFIX}ds_table_name")):
@@ -174,7 +178,7 @@ class TestObj(BaseModel):
# not used, just do test
@router.post("/execSql/{id}", include_in_schema=False)
""" @router.post("/execSql/{id}", include_in_schema=False)
async def exec_sql(session: SessionDep, id: int, obj: TestObj):
def inner():
data = execSql(session, id, obj.sql)
@@ -187,31 +191,36 @@ async def exec_sql(session: SessionDep, id: int, obj: TestObj):
return data
return await asyncio.to_thread(inner)
return await asyncio.to_thread(inner) """
@router.post("/tableList/{id}", response_model=List[CoreTable], summary=f"{PLACEHOLDER_PREFIX}ds_table_list")
@require_permissions(permission=SqlbotPermission(role=['ws_admin'], type='ds', keyExpression="id"))
async def table_list(session: SessionDep, id: int = Path(..., description=f"{PLACEHOLDER_PREFIX}ds_id")):
return get_tables_by_ds_id(session, id)
@router.post("/fieldList/{id}", response_model=List[CoreField], summary=f"{PLACEHOLDER_PREFIX}ds_field_list")
@require_permissions(permission=SqlbotPermission(role=['ws_admin']))
async def field_list(session: SessionDep, field: FieldObj,
id: int = Path(..., description=f"{PLACEHOLDER_PREFIX}ds_table_id")):
return get_fields_by_table_id(session, id, field)
@router.post("/editLocalComment", include_in_schema=False)
@require_permissions(permission=SqlbotPermission(role=['ws_admin']))
async def edit_local(session: SessionDep, data: TableObj):
update_table_and_fields(session, data)
@router.post("/editTable", response_model=None, summary=f"{PLACEHOLDER_PREFIX}ds_edit_table")
@require_permissions(permission=SqlbotPermission(role=['ws_admin']))
async def edit_table(session: SessionDep, table: CoreTable):
updateTable(session, table)
@router.post("/editField", response_model=None, summary=f"{PLACEHOLDER_PREFIX}ds_edit_field")
@require_permissions(permission=SqlbotPermission(role=['ws_admin']))
async def edit_field(session: SessionDep, field: CoreField):
updateField(session, field)