wangjiahao
33c87b61a4
fix: Authenticated IDOR in Dashboard update endpoints allows cross-user Dashboard modification
2026-09-09 14:11:08 +08:00
fit2cloud-chenyw
900eb2d28e
perf: Internationalization (i18n) for In‑line Error Prompts
2026-09-09 11:07:36 +08:00
fit2cloud-chenyw
4ee923c968
Add config to hide default passwords or force password change at first login #1355
2026-09-02 16:41:01 +08:00
junjun
c1d333e62d
fix: Cross-Workspace Data-Source Schema Disclosure and Modification (Incomplete IDOR Remediation)
2026-08-31 11:09:23 +08:00
fit2cloud-chenyw and Claude
bbfc4cc8f5
fix(Security): Host header injection auth bypass and forged admin embedded token (CNVD)
...
- TokenMiddleware/ResponseMiddleware/audit logger use scope['path']
instead of request.url.path for whitelist checks: a crafted Host
header (e.g. x/api/v1/mcp) was concatenated into Starlette's URL
and made protected routes match the /mcp* whitelist entry
- validateEmbedded rejects admin accounts and non-type-4 apps, so a
self-signed token with account=admin can no longer impersonate the
administrator
- Add HostValidationMiddleware rejecting malformed Host headers at the
outermost layer (defense in depth)
- Add regression tests for host validation, whitelist matching and
source-level guards
Co-Authored-By: Claude <[email protected]
2026-08-31 11:05:05 +08:00
ulleo
6518701913
fix: Prevent Authorization Bypass Through User-Controlled Key problem (CWE-639)
2026-08-28 18:22:35 +08:00
ulleo
66a1b33ac4
fix: prevent path traversal in Excel upload (CWE-22)
2026-08-28 17:51:27 +08:00
fit2cloud-chenyw
49a50e3bce
fix: Cross-Workspace Assistant Modification and Deletion (IDOR)
2026-08-28 15:37:45 +08:00
junjun
273171b8d1
fix: Kingbase SQL inject
2026-08-27 15:04:39 +08:00
ulleo
1fdc28b6fd
improve: Support similarity sorting across account, name, and email fields
2026-08-26 21:08:43 +08:00
ulleo
a2d1a9d423
improve: Support similarity sorting across account, name, and email fields
2026-08-26 11:13:23 +08:00
ulleo
b99f140300
improve: Sort search results by account similarity
2026-08-26 10:52:24 +08:00
junjun
bfe3fc4dc9
fix: The number of columns returned by Hive DESCRIBE does not match the ColumnSchema constructor #1210
2026-08-20 14:17:11 +08:00
junjun
7a32b139f7
feat: Hive datasource supports LDAP authentication #1209
2026-08-20 11:26:46 +08:00
junjun
d31e6a0277
feat: Hive datasource supports LDAP authentication
2026-08-20 10:05:49 +08:00
junjun
d33e42004c
feat: MCP support model
2026-08-19 10:20:40 +08:00
junjun
2a86aa926c
feat: MCP support model
2026-08-18 17:02:43 +08:00
junjun
743750305d
feat: MCP support model
2026-08-18 15:43:28 +08:00
ulleo
a2a7591d0f
feat: switch search filters from OR to AND logic
2026-08-11 18:22:44 +08:00
junjun
c8a2dd89bb
feat: system param support key-value #1310
2026-08-10 14:09:02 +08:00
junjun
959285cfd0
feat: system param support key-value #1310
2026-08-07 11:31:28 +08:00
junjun
ec4717e1f1
fix: connect pool pre ping
2026-08-03 17:05:35 +08:00
ulleo
6a175b0124
fix: CWE problem in recommend_questions
2026-08-03 16:47:33 +08:00
ulleo
e58d1822dc
feat: optimize chat list sorting
2026-07-30 16:52:46 +08:00
fit2cloud-chenyw
2fefef0a37
fix: CORS error occurred while embedding the assistant
2026-07-29 13:51:57 +08:00
fit2cloud-chenyw
4058ad3602
feat: Add a verification interface for the assistant
2026-07-29 11:27:21 +08:00
Sebastion
a520fda25e
fix: prevent path traversal in terminology excel upload (CWE-22)
2026-07-27 14:37:54 +08:00
ulleo
9726db544d
refactor: replace dicttoxml with stdlib implementation to avoid GPL license risk
2026-07-24 18:09:00 +08:00
ulleo
9656efad06
feat: support export with filter
2026-07-24 17:03:02 +08:00
ulleo
8e97a6b962
feat: support filter search in SQL sample and terminology list
...
#1281
2026-07-24 11:27:02 +08:00
junjun
fe65f3e2cc
refactor: Optimize connection pool #1256
2026-07-20 17:32:54 +08:00
ulleo
7118b401a7
fix: extract_tables_from_sql incorrectly includes CTE names as table names
...
#1278
2026-07-17 16:33:02 +08:00
junjun
1e130223a3
refactor: Optimize the type of permission field
2026-07-16 17:09:08 +08:00
junjun
634d7e898c
refactor: Optimize connection pool #1256
2026-07-16 15:51:20 +08:00
fit2cloud-chenyw
a1ade91f20
fix: Elevate permission levels via the assistant UI settings interface
2026-07-14 18:04:20 +08:00
fit2cloud-chenyw
0b4878199f
Pr@main@fix embedded security vulnerabilities ( #1271 )
...
* fix: Embedded security vulnerabilities
* perf: Optimize embedded APIs
2026-07-14 17:23:42 +08:00
fit2cloud-chenyw
a70eb1b308
fix: Embedded security vulnerabilities
2026-07-14 15:31:42 +08:00
ulleo
deff40b884
feat: add thousands separator settings
2026-07-13 19:03:23 +08:00
ulleo
f56f65905a
feat: add thousands separator settings
2026-07-13 18:33:58 +08:00
ulleo
a5e57c1d60
feat: add thousands separator settings
2026-07-13 18:09:37 +08:00
fit2cloud-chenyw
ee5e80d35f
feat: Improve user list sorting
2026-07-13 17:05:29 +08:00
junjun
767d665dd9
refactor: Optimize connection pool
2026-07-13 17:04:52 +08:00
ulleo
ccbc65d549
feat: add thousands separator settings
2026-07-13 16:57:11 +08:00
junjun
8a18ed6513
refactor: Optimize connection pool
2026-07-13 16:45:09 +08:00
ulleo
42d8c82ffc
feat: add thousands separator settings
2026-07-13 15:55:41 +08:00
ulleo
d7261dabd6
feat: support configuring terminology for specified advanced applications
2026-07-10 17:22:42 +08:00
ulleo
487f5fd584
fix: export/import SQL Sample management
2026-07-10 16:12:33 +08:00
ulleo
aa594a5681
feat: Adjust the organizational attribution logic of dialogues in MCP
...
#1221
2026-07-09 18:17:03 +08:00
ulleo
b947cf2476
feat: add thousands separator settings
2026-07-09 17:45:21 +08:00
ulleo
ce3ea977ae
fix: delete chat error when chat title contains '/' character
...
#1232
2026-07-07 15:19:42 +08:00
wangjiahao