fit2cloud-chenyw
4ee923c968
Add config to hide default passwords or force password change at first login #1355
2026-09-02 16:41:01 +08:00
junjun
c1d333e62d
fix: Cross-Workspace Data-Source Schema Disclosure and Modification (Incomplete IDOR Remediation)
2026-08-31 11:09:23 +08:00
fit2cloud-chenyw and Claude
bbfc4cc8f5
fix(Security): Host header injection auth bypass and forged admin embedded token (CNVD)
...
- TokenMiddleware/ResponseMiddleware/audit logger use scope['path']
instead of request.url.path for whitelist checks: a crafted Host
header (e.g. x/api/v1/mcp) was concatenated into Starlette's URL
and made protected routes match the /mcp* whitelist entry
- validateEmbedded rejects admin accounts and non-type-4 apps, so a
self-signed token with account=admin can no longer impersonate the
administrator
- Add HostValidationMiddleware rejecting malformed Host headers at the
outermost layer (defense in depth)
- Add regression tests for host validation, whitelist matching and
source-level guards
Co-Authored-By: Claude <[email protected]
2026-08-31 11:05:05 +08:00
ulleo
cc8a7546e9
chron: update X-Pack version
2026-08-28 18:25:37 +08:00
ulleo
6518701913
fix: Prevent Authorization Bypass Through User-Controlled Key problem (CWE-639)
2026-08-28 18:22:35 +08:00
ulleo
66a1b33ac4
fix: prevent path traversal in Excel upload (CWE-22)
2026-08-28 17:51:27 +08:00
fit2cloud-chenyw
49a50e3bce
fix: Cross-Workspace Assistant Modification and Deletion (IDOR)
2026-08-28 15:37:45 +08:00
dataeaseShu
56130658b9
fix(Embedded Systems): The top and bottom spacing is inconsistent between floating mode and full-screen mode; optimization is recommended.
2026-08-27 16:31:40 +08:00
junjun
273171b8d1
fix: Kingbase SQL inject
2026-08-27 15:04:39 +08:00
dataeaseShu
fe142f9f75
fix(Embedded Systems): The top and bottom spacing is inconsistent between floating mode and full-screen mode; optimization is recommended.
2026-08-27 14:55:15 +08:00
dataeaseShu
24a6463b1f
fix(System Variables): The key-value type system variable has only one option, and an empty option will be available when selecting it.
2026-08-27 10:02:57 +08:00
ulleo
1fdc28b6fd
improve: Support similarity sorting across account, name, and email fields
2026-08-26 21:08:43 +08:00
ulleo
fcf858ccfc
fix: show errors in execution details
2026-08-26 11:41:03 +08:00
Iams4kura
6396042795
fix: show errors in execution details
2026-08-26 11:33:12 +08:00
ulleo
a2d1a9d423
improve: Support similarity sorting across account, name, and email fields
2026-08-26 11:13:23 +08:00
ulleo
b99f140300
improve: Sort search results by account similarity
2026-08-26 10:52:24 +08:00
dataeaseShu
d20a7d9b64
feat(Member Management): Added Enter key search function when adding users in Member Management.
2026-08-26 10:04:38 +08:00
dataeaseShu
84868594d1
feat(System Variables): There is only one option when selecting a variable; you do not need to select it again.
2026-08-26 10:04:38 +08:00
dataeaseShu
774f19caf3
fix(Workspace): The workspace page freezes when adding users.
2026-08-25 14:36:02 +08:00
xuwei-fit2cloud
53bedcc555
update version to 1.10.1
2026-08-24 18:36:56 +08:00
ulleo
bc9f7607dc
improve: chat list sort during chat
2026-08-24 16:05:09 +08:00
ulleo
37752e9f1b
feat: change SQL sample search filter
2026-08-24 15:22:23 +08:00
ulleo
8a1845aaf4
improve: chat list order during chat
2026-08-24 14:53:56 +08:00
ulleo
ed19e8997e
fix: i18n
2026-08-24 14:08:09 +08:00
xuwei-fit2cloud
59ca09708f
Update build_and_push.yml
2026-08-22 14:33:06 +08:00
junjun
bfe3fc4dc9
fix: The number of columns returned by Hive DESCRIBE does not match the ColumnSchema constructor #1210
2026-08-20 14:17:11 +08:00
junjun
7a32b139f7
feat: Hive datasource supports LDAP authentication #1209
2026-08-20 11:26:46 +08:00
junjun
d31e6a0277
feat: Hive datasource supports LDAP authentication
2026-08-20 10:05:49 +08:00
ulleo
10663cc793
fix: get_chart_usage add undefined value check
2026-08-19 15:00:40 +08:00
junjun
d33e42004c
feat: MCP support model
2026-08-19 10:20:40 +08:00
junjun
2a86aa926c
feat: MCP support model
2026-08-18 17:02:43 +08:00
junjun
150b98c930
feat: MCP support model
2026-08-18 16:20:53 +08:00
junjun
743750305d
feat: MCP support model
2026-08-18 15:43:28 +08:00
Dessalines39394
b42e917146
fix: update star history chart to use new domain
...
The star history chart in the README is broken due to GitHub stargazer API restrictions. Update the chart and its link to use the new star-history domain so the chart renders correctly again.
2026-08-18 15:26:40 +08:00
junjun
0c885d5a67
build: lock fastapi version
2026-08-12 18:15:59 +08:00
ulleo
7c40afb436
fix: 将模板文件中的繁体字转换为简体字
...
#1319
2026-08-12 17:36:27 +08:00
ulleo
b1f9257a15
chore: update version
2026-08-11 18:25:29 +08:00
ulleo
a2a7591d0f
feat: switch search filters from OR to AND logic
2026-08-11 18:22:44 +08:00
junjun
c8a2dd89bb
feat: system param support key-value #1310
2026-08-10 14:09:02 +08:00
dataeaseShu
e2abbc61fa
feat(系统变量): 支持 key-value #1310
2026-08-07 14:58:33 +08:00
junjun
959285cfd0
feat: system param support key-value #1310
2026-08-07 11:31:28 +08:00
sysy
c3f40a5c05
Use v-dompurify-html in SQText to prevent XSS ( #1309 )
...
The SQText dashboard component rendered TinyMCE output with v-html,
bypassing the DOMPurify sanitization used by every other component.
Replace with v-dompurify-html (already registered globally in main.ts).
2026-08-05 11:21:14 +08:00
junjun
ec4717e1f1
fix: connect pool pre ping
2026-08-03 17:05:35 +08:00
junjun
e735bfafc0
build: lock mcp version
2026-08-03 17:04:33 +08:00
ulleo
6a175b0124
fix: CWE problem in recommend_questions
2026-08-03 16:47:33 +08:00
dataeaseShu
4c6fce89e9
fix: TS报错
2026-07-30 17:51:54 +08:00
dataeaseShu
6c73a202ee
fix: TS报错
2026-07-30 17:28:51 +08:00
ulleo
e58d1822dc
feat: optimize chat list sorting
2026-07-30 16:52:46 +08:00
fit2cloud-chenyw
2fefef0a37
fix: CORS error occurred while embedding the assistant
2026-07-29 13:51:57 +08:00
fit2cloud-chenyw
4058ad3602
feat: Add a verification interface for the assistant
2026-07-29 11:27:21 +08:00
fit2cloud-chenyw