From b2de038e7ada308fe18924b9848f9f15454d5a1b Mon Sep 17 00:00:00 2001 From: junjun Date: Thu, 30 Apr 2026 09:49:24 +0800 Subject: [PATCH] fix: Privilege Escalation Vulnerability --- backend/apps/datasource/api/datasource.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/backend/apps/datasource/api/datasource.py b/backend/apps/datasource/api/datasource.py index 7f34e955..d4e24b7a 100644 --- a/backend/apps/datasource/api/datasource.py +++ b/backend/apps/datasource/api/datasource.py @@ -162,7 +162,7 @@ async def get_fields(session: SessionDep, @router.post("/syncFields/{id}", response_model=None, summary=f"{PLACEHOLDER_PREFIX}ds_sync_fields") -@require_permissions(permission=SqlbotPermission(role=['ws_admin'], type='ds', keyExpression="id")) +@require_permissions(permission=SqlbotPermission(role=['ws_admin'])) async def sync_fields(session: SessionDep, trans: Trans, id: int = Path(..., description=f"{PLACEHOLDER_PREFIX}ds_table_id")): return sync_single_fields(session, trans, id)