From 80dc9a3aa8d1633218b8d4b4e41c1a770178a077 Mon Sep 17 00:00:00 2001 From: junjun Date: Mon, 8 Jun 2026 15:26:55 +0800 Subject: [PATCH] fix: Fix the privilege escalation vulnerability in system variables --- backend/apps/system/api/variable_api.py | 2 -- 1 file changed, 2 deletions(-) diff --git a/backend/apps/system/api/variable_api.py b/backend/apps/system/api/variable_api.py index cca1af84..a7cc3730 100644 --- a/backend/apps/system/api/variable_api.py +++ b/backend/apps/system/api/variable_api.py @@ -27,13 +27,11 @@ async def delete_variable(session: SessionDep, ids: List[int]): @router.post("/listAll",response_model=None, summary=f"{PLACEHOLDER_PREFIX}variable_list") -@require_permissions(permission=SqlbotPermission(role=['admin'])) async def list_all_data(session: SessionDep, trans: Trans, variable: SystemVariable = None): return list_all(session, trans, variable) @router.post("/listPage/{pageNum}/{pageSize}",response_model=None, summary=f"{PLACEHOLDER_PREFIX}variable_page") -@require_permissions(permission=SqlbotPermission(role=['admin'])) async def pager(session: SessionDep, trans: Trans, pageNum: int, pageSize: int, variable: SystemVariable = None): return await list_page(session, trans, pageNum, pageSize, variable)