klinsmaya/SQLBot
1
0
Fork 0
mirror of https://gh-proxy.org/https://github.com/klinsmaya/SQLBot.git synced 2026-11-08 01:06:59 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix: Fix the privilege escalation vulnerability in system variables

Browse Source
This commit is contained in:
junjun
2026-06-04 16:42:48 +08:00
committed by Junjun
parent d5d5e87b51
commit 98dba5f517
1 changed files with 5 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/apps/system/api/variable_api.py
+5
View File
@@ -8,27 +8,32 @@ from apps.system.crud.system_variable import save, delete, list_all, list_page
from apps.system.models.system_variable_model import SystemVariable
from common.core.config import settings
from common.core.deps import SessionDep, CurrentUser, Trans
from apps.system.schemas.permission import SqlbotPermission, require_permissions
router = APIRouter(tags=["System_variable"], prefix="/sys_variable")
path = settings.EXCEL_PATH
@router.post("/save", response_model=None, summary=f"{PLACEHOLDER_PREFIX}variable_save")
@require_permissions(permission=SqlbotPermission(role=['admin']))
async def save_variable(session: SessionDep, user: CurrentUser, trans: Trans, variable: SystemVariable):
return save(session, user, trans, variable)
@router.post("/delete",response_model=None, summary=f"{PLACEHOLDER_PREFIX}variable_delete")
@require_permissions(permission=SqlbotPermission(role=['admin']))
async def delete_variable(session: SessionDep, ids: List[int]):
return delete(session, ids)
@router.post("/listAll",response_model=None, summary=f"{PLACEHOLDER_PREFIX}variable_list")
@require_permissions(permission=SqlbotPermission(role=['admin']))
async def list_all_data(session: SessionDep, trans: Trans, variable: SystemVariable = None):
return list_all(session, trans, variable)
@router.post("/listPage/{pageNum}/{pageSize}",response_model=None, summary=f"{PLACEHOLDER_PREFIX}variable_page")
@require_permissions(permission=SqlbotPermission(role=['admin']))
async def pager(session: SessionDep, trans: Trans, pageNum: int, pageSize: int,
variable: SystemVariable = None):
return await list_page(session, trans, pageNum, pageSize, variable)