klinsmaya/SQLBot
1
0
Fork 0
mirror of https://gh-proxy.org/https://github.com/klinsmaya/SQLBot.git synced 2026-11-08 01:06:59 +08:00
Code Issues Packages Projects Releases Wiki Activity
2,490 Commits 1 Branch 0 Tags
main
Commit Graph
2490 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
junjun ba9aa5db66 fix: Oracle timeout #1360 2026-09-11 14:13:28 +08:00
wangjiahao 3f68b618ef fix: Authenticated IDOR in Dashboard update endpoints allows cross-user Dashboard modification 2026-09-09 16:36:19 +08:00
wangjiahao 1bc83867e5 fix: Cross-Workspace Recommended-Problem Read and Overwrite (IDOR) 2026-09-09 16:26:39 +08:00
wangjiahao 33c87b61a4 fix: Authenticated IDOR in Dashboard update endpoints allows cross-user Dashboard modification 2026-09-09 14:11:08 +08:00
wangjiahao 835d0b10bd refactor: Use the new rich text component TinyMCE 6.x 2026-09-09 14:03:37 +08:00
fit2cloud-chenyw 900eb2d28e perf: Internationalization (i18n) for In‑line Error Prompts 2026-09-09 11:07:36 +08:00
fit2cloud-chenyw 4ee923c968 Add config to hide default passwords or force password change at first login #1355 2026-09-02 16:41:01 +08:00
junjun c1d333e62d fix: Cross-Workspace Data-Source Schema Disclosure and Modification (Incomplete IDOR Remediation) 2026-08-31 11:09:23 +08:00
fit2cloud-chenywandClaude bbfc4cc8f5 fix(Security): Host header injection auth bypass and forged admin embedded token (CNVD) 
- TokenMiddleware/ResponseMiddleware/audit logger use scope['path']
  instead of request.url.path for whitelist checks: a crafted Host
  header (e.g. x/api/v1/mcp) was concatenated into Starlette's URL
  and made protected routes match the /mcp* whitelist entry
- validateEmbedded rejects admin accounts and non-type-4 apps, so a
  self-signed token with account=admin can no longer impersonate the
  administrator
- Add HostValidationMiddleware rejecting malformed Host headers at the
  outermost layer (defense in depth)
- Add regression tests for host validation, whitelist matching and
  source-level guards

Co-Authored-By: Claude <[email protected]>
 2026-08-31 11:05:05 +08:00
ulleo cc8a7546e9 chron: update X-Pack version 2026-08-28 18:25:37 +08:00
ulleo 6518701913 fix: Prevent Authorization Bypass Through User-Controlled Key problem (CWE-639) 2026-08-28 18:22:35 +08:00
ulleo 66a1b33ac4 fix: prevent path traversal in Excel upload (CWE-22) 2026-08-28 17:51:27 +08:00
fit2cloud-chenyw 49a50e3bce fix: Cross-Workspace Assistant Modification and Deletion (IDOR) 2026-08-28 15:37:45 +08:00
dataeaseShu 56130658b9 fix(Embedded Systems): The top and bottom spacing is inconsistent between floating mode and full-screen mode; optimization is recommended. 2026-08-27 16:31:40 +08:00
junjun 273171b8d1 fix: Kingbase SQL inject 2026-08-27 15:04:39 +08:00
dataeaseShu fe142f9f75 fix(Embedded Systems): The top and bottom spacing is inconsistent between floating mode and full-screen mode; optimization is recommended. 2026-08-27 14:55:15 +08:00
dataeaseShu 24a6463b1f fix(System Variables): The key-value type system variable has only one option, and an empty option will be available when selecting it. 2026-08-27 10:02:57 +08:00
ulleo 1fdc28b6fd improve: Support similarity sorting across account, name, and email fields 2026-08-26 21:08:43 +08:00
ulleo fcf858ccfc fix: show errors in execution details 2026-08-26 11:41:03 +08:00
Iams4kura 6396042795 fix: show errors in execution details 2026-08-26 11:33:12 +08:00
ulleo a2d1a9d423 improve: Support similarity sorting across account, name, and email fields 2026-08-26 11:13:23 +08:00
ulleo b99f140300 improve: Sort search results by account similarity 2026-08-26 10:52:24 +08:00
dataeaseShu d20a7d9b64 feat(Member Management): Added Enter key search function when adding users in Member Management. 2026-08-26 10:04:38 +08:00
dataeaseShu 84868594d1 feat(System Variables): There is only one option when selecting a variable; you do not need to select it again. 2026-08-26 10:04:38 +08:00
dataeaseShu 774f19caf3 fix(Workspace): The workspace page freezes when adding users. 2026-08-25 14:36:02 +08:00
xuwei-fit2cloud 53bedcc555 update version to 1.10.1 2026-08-24 18:36:56 +08:00
ulleo bc9f7607dc improve: chat list sort during chat 2026-08-24 16:05:09 +08:00
ulleo 37752e9f1b feat: change SQL sample search filter 2026-08-24 15:22:23 +08:00
ulleo 8a1845aaf4 improve: chat list order during chat 2026-08-24 14:53:56 +08:00
ulleo ed19e8997e fix: i18n 2026-08-24 14:08:09 +08:00
xuwei-fit2cloud 59ca09708f Update build_and_push.yml 2026-08-22 14:33:06 +08:00
junjun bfe3fc4dc9 fix: The number of columns returned by Hive DESCRIBE does not match the ColumnSchema constructor #1210 2026-08-20 14:17:11 +08:00
junjun 7a32b139f7 feat: Hive datasource supports LDAP authentication #1209 2026-08-20 11:26:46 +08:00
junjun d31e6a0277 feat: Hive datasource supports LDAP authentication 2026-08-20 10:05:49 +08:00
ulleo 10663cc793 fix: get_chart_usage add undefined value check 2026-08-19 15:00:40 +08:00
junjun d33e42004c feat: MCP support model 2026-08-19 10:20:40 +08:00
junjun 2a86aa926c feat: MCP support model 2026-08-18 17:02:43 +08:00
junjun 150b98c930 feat: MCP support model 2026-08-18 16:20:53 +08:00
junjun 743750305d feat: MCP support model 2026-08-18 15:43:28 +08:00
Dessalines39394 b42e917146 fix: update star history chart to use new domain 
The star history chart in the README is broken due to GitHub stargazer API restrictions. Update the chart and its link to use the new star-history domain so the chart renders correctly again.
 2026-08-18 15:26:40 +08:00
junjun 0c885d5a67 build: lock fastapi version 2026-08-12 18:15:59 +08:00
ulleo 7c40afb436 fix: 将模板文件中的繁体字转换为简体字 
#1319
 2026-08-12 17:36:27 +08:00
ulleo b1f9257a15 chore: update version 2026-08-11 18:25:29 +08:00
ulleo a2a7591d0f feat: switch search filters from OR to AND logic 2026-08-11 18:22:44 +08:00
junjun c8a2dd89bb feat: system param support key-value #1310 2026-08-10 14:09:02 +08:00
dataeaseShu e2abbc61fa feat(系统变量): 支持 key-value #1310 2026-08-07 14:58:33 +08:00
junjun 959285cfd0 feat: system param support key-value #1310 2026-08-07 11:31:28 +08:00
sysy c3f40a5c05 Use v-dompurify-html in SQText to prevent XSS (#1309) 
The SQText dashboard component rendered TinyMCE output with v-html,
bypassing the DOMPurify sanitization used by every other component.
Replace with v-dompurify-html (already registered globally in main.ts).
 2026-08-05 11:21:14 +08:00
junjun ec4717e1f1 fix: connect pool pre ping 2026-08-03 17:05:35 +08:00
junjun e735bfafc0 build: lock mcp version 2026-08-03 17:04:33 +08:00