fit2cloud-chenyw
aac200aef5
fix(X-Pack): Assistant API call timeout issue #1288
2026-09-14 14:39:17 +08:00
wangjiahao
3f68b618ef
fix: Authenticated IDOR in Dashboard update endpoints allows cross-user Dashboard modification
2026-09-09 16:36:19 +08:00
fit2cloud-chenyw
900eb2d28e
perf: Internationalization (i18n) for In‑line Error Prompts
2026-09-09 11:07:36 +08:00
fit2cloud-chenyw
4ee923c968
Add config to hide default passwords or force password change at first login #1355
2026-09-02 16:41:01 +08:00
fit2cloud-chenyw and Claude
bbfc4cc8f5
fix(Security): Host header injection auth bypass and forged admin embedded token (CNVD)
...
- TokenMiddleware/ResponseMiddleware/audit logger use scope['path']
instead of request.url.path for whitelist checks: a crafted Host
header (e.g. x/api/v1/mcp) was concatenated into Starlette's URL
and made protected routes match the /mcp* whitelist entry
- validateEmbedded rejects admin accounts and non-type-4 apps, so a
self-signed token with account=admin can no longer impersonate the
administrator
- Add HostValidationMiddleware rejecting malformed Host headers at the
outermost layer (defense in depth)
- Add regression tests for host validation, whitelist matching and
source-level guards
Co-Authored-By: Claude <[email protected]
2026-08-31 11:05:05 +08:00
fit2cloud-chenyw
49a50e3bce
fix: Cross-Workspace Assistant Modification and Deletion (IDOR)
2026-08-28 15:37:45 +08:00
ulleo
1fdc28b6fd
improve: Support similarity sorting across account, name, and email fields
2026-08-26 21:08:43 +08:00
ulleo
a2d1a9d423
improve: Support similarity sorting across account, name, and email fields
2026-08-26 11:13:23 +08:00
ulleo
b99f140300
improve: Sort search results by account similarity
2026-08-26 10:52:24 +08:00
fit2cloud-chenyw
2fefef0a37
fix: CORS error occurred while embedding the assistant
2026-07-29 13:51:57 +08:00
fit2cloud-chenyw
4058ad3602
feat: Add a verification interface for the assistant
2026-07-29 11:27:21 +08:00
fit2cloud-chenyw
a1ade91f20
fix: Elevate permission levels via the assistant UI settings interface
2026-07-14 18:04:20 +08:00
fit2cloud-chenyw
0b4878199f
Pr@main@fix embedded security vulnerabilities ( #1271 )
...
* fix: Embedded security vulnerabilities
* perf: Optimize embedded APIs
2026-07-14 17:23:42 +08:00
fit2cloud-chenyw
a70eb1b308
fix: Embedded security vulnerabilities
2026-07-14 15:31:42 +08:00
fit2cloud-chenyw
ee5e80d35f
feat: Improve user list sorting
2026-07-13 17:05:29 +08:00
ulleo
2fc646ce3c
feat: Adjust the organizational attribution logic of dialogues in MCP
...
#1221
2026-06-29 16:00:42 +08:00
junjun
936bb5d390
fix: Compatible with older versions of MSSQL in DataEase
2026-06-23 14:57:10 +08:00
ulleo
5b94406c3a
fix: Fix SQL injection / LLM Prompt Injection vulnerability causing unauthorized queries
...
Security hardening:
- Add SQLBOT_ALLOW_METADATA_QUERIES config option, disable SHOW/DESCRIBE/EXPLAIN by default
- Add table whitelist check, use sqlglot to parse actual SQL table names and compare with authorized table list
- Add dangerous function check, block LOAD_FILE, INTO OUTFILE, EXEC etc. by database type
- Improve check_sql_read to return specific error reasons for better debugging
2026-06-11 17:29:38 +08:00
junjun
7637ab391d
fix: Fix the privilege escalation vulnerability in system variables
2026-06-08 17:01:44 +08:00
junjun
ba7b397c51
fix: Fix the privilege escalation vulnerability in system variables
2026-06-08 16:54:17 +08:00
junjun
81c8acda91
fix: Fix the privilege escalation vulnerability in system variables
2026-06-08 16:33:34 +08:00
junjun
80dc9a3aa8
fix: Fix the privilege escalation vulnerability in system variables
2026-06-08 15:26:55 +08:00
junjun
98dba5f517
fix: Fix the privilege escalation vulnerability in system variables
2026-06-04 16:42:48 +08:00
ulleo
d5d5e87b51
feat(Application): Application can configure specified model
2026-06-04 15:06:09 +08:00
ulleo
c53ac8f720
feat(Model Configuration): Supported Authorized Space
2026-06-04 14:38:00 +08:00
ulleo
3f3dc08a67
feat(Model Configuration): Supported Authorized Space
2026-06-04 10:49:30 +08:00
ulleo
f691b3e03a
feat(Application): Application can configure specified model
2026-06-03 17:29:09 +08:00
ulleo
835eefcb39
fix: remove svg image support in upload files
2026-06-03 15:55:05 +08:00
ulleo
d57cf3aee6
feat(Application): Application can configure specified model
2026-06-02 16:59:24 +08:00
ulleo
23ca654bc4
feat(Application): Application can configure specified model
2026-06-02 16:24:44 +08:00
ulleo
4b0d4ce663
feat(Application): Application can configure specified model
2026-06-02 14:46:55 +08:00
ulleo
46de2322b0
feat(Application): Application can configure specified model
2026-06-02 14:18:35 +08:00
ulleo
ba16432a66
feat(Application): Application can configure specified model
2026-06-02 14:05:52 +08:00
fit2cloud-chenyw
a26b173165
fix(X-Pack): Unable to save model due to long API Key #1090
2026-05-22 11:57:02 +08:00
ulleo
e72c0bedda
fix: Fix the data source-related issues in the PR
2026-05-11 15:07:15 +08:00
ulleo
387731236e
feat(Application): Application can configure specified model
2026-04-30 15:23:32 +08:00
ulleo
22dc17baf8
feat(System): Language switch, supports Traditional Chinese.
2026-04-17 18:06:02 +08:00
fit2cloud-chenyw
3eca13735b
perf: Cancel Duplicate Email Verification
2026-03-17 15:19:31 +08:00
fit2cloud-chenyw
5c136b46c5
perf: Optimize Embedded Assistant Cache Settings
2026-03-17 14:38:42 +08:00
fit2cloud-chenyw
8b8cd3e8c9
perf: System variables are set as user-selectable attributes
2026-03-17 12:31:29 +08:00
fit2cloud-chenyw
6d63dcefc5
fix: Clickjacking Attack
2026-03-16 15:44:57 +08:00
junjun
a357dd01a4
feat: support system variable
2026-03-16 14:23:53 +08:00
fit2cloud-chenyw
b181d64e6d
perf: Failed to create third-party user due to missing system variables
2026-03-16 14:13:17 +08:00
junjun
5963561933
refactor: system variable sort by name
2026-03-16 10:01:58 +08:00
junjun
beeddb64c6
refactor: system variable sort by create time
2026-03-13 17:24:13 +08:00
junjun
d9129073b9
feat: support system variable
2026-02-05 10:15:46 +08:00
fit2cloud-chenyw
e3363923d6
perf: API Permission Error Message Optimization
2026-02-04 16:33:11 +08:00
junjun
cb633cb32a
fix: assistant support oracle connection mode
2026-02-04 10:58:40 +08:00
fit2cloud-chenyw
175138758a
fix: Workspace edit led to wrong permission changes
2026-02-03 11:29:10 +08:00
fit2cloud-chenyw
d640ac31d1
perf: Optimize datasource-related API permission validation
2026-01-28 17:03:58 +08:00
fit2cloud-chenyw