klinsmaya/SQLBot
1
0
Fork 0
mirror of https://gh-proxy.org/https://github.com/klinsmaya/SQLBot.git synced 2026-11-08 01:06:59 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix: Cross-Workspace Data-Source Schema Disclosure and Modification (Incomplete IDOR Remediation)

Browse Source
This commit is contained in:
junjun
2026-09-17 12:17:53 +08:00
committed by Junjun
parent fccdd29421
commit 97d29a4d42
2 changed files with 9 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/apps/datasource/api/datasource.py
+2 -1
View File
@@ -203,8 +203,9 @@ async def table_list(session: SessionDep, id: int = Path(..., description=f"{PLA
@router.post("/fieldList/{ds_id}/{id}", response_model=List[CoreField], summary=f"{PLACEHOLDER_PREFIX}ds_field_list")
@require_permissions(permission=SqlbotPermission(role=['ws_admin'], type='ds', keyExpression="ds_id"))
async def field_list(session: SessionDep, field: FieldObj,
ds_id: int = Path(..., description=f"{PLACEHOLDER_PREFIX}ds_id"),
id: int = Path(..., description=f"{PLACEHOLDER_PREFIX}ds_table_id")):
return get_fields_by_table_id(session, id, field)
return get_fields_by_table_id(session, ds_id, id, field)
# @router.post("/editLocalComment", include_in_schema=False)
backend/apps/datasource/crud/field.py
+7 -2
View File
@@ -1,6 +1,7 @@
from common.core.deps import SessionDep
from ..models.datasource import CoreField, FieldObj
from ..models.datasource import CoreField, FieldObj, CoreTable
from sqlalchemy import or_, and_
from fastapi import HTTPException
def delete_field_by_ds_id(session: SessionDep, id: int):
@@ -8,7 +9,11 @@ def delete_field_by_ds_id(session: SessionDep, id: int):
session.commit()
def get_fields_by_table_id(session: SessionDep, id: int, field: FieldObj):
def get_fields_by_table_id(session: SessionDep, ds_id: int, id: int, field: FieldObj):
table = session.query(CoreTable).filter(and_(CoreTable.id == id, CoreTable.ds_id == ds_id)).first()
if not table:
raise HTTPException(status_code=500, detail='The data source ID does not match the table ID')
if field and field.fieldName:
return session.query(CoreField).filter(
and_(CoreField.table_id == id, or_(CoreField.field_name.like(f'%{field.fieldName}%'),