junjun
8424dcbf92
refactor: Optimizing Excel header fields with too long prompts #1364
2026-09-14 10:40:52 +08:00
master_lin
5d60284499
test(datasource): cover SQLAlchemy pool disposal
2026-09-14 10:32:05 +08:00
master_lin
b744ca6c28
fix(datasource): dispose SQLAlchemy engine when removing pool
2026-09-14 10:32:05 +08:00
junjun
ba9aa5db66
fix: Oracle timeout #1360
2026-09-11 14:13:28 +08:00
wangjiahao
3f68b618ef
fix: Authenticated IDOR in Dashboard update endpoints allows cross-user Dashboard modification
2026-09-09 16:36:19 +08:00
wangjiahao
1bc83867e5
fix: Cross-Workspace Recommended-Problem Read and Overwrite (IDOR)
2026-09-09 16:26:39 +08:00
wangjiahao
33c87b61a4
fix: Authenticated IDOR in Dashboard update endpoints allows cross-user Dashboard modification
2026-09-09 14:11:08 +08:00
fit2cloud-chenyw
900eb2d28e
perf: Internationalization (i18n) for In‑line Error Prompts
2026-09-09 11:07:36 +08:00
fit2cloud-chenyw
4ee923c968
Add config to hide default passwords or force password change at first login #1355
2026-09-02 16:41:01 +08:00
junjun
c1d333e62d
fix: Cross-Workspace Data-Source Schema Disclosure and Modification (Incomplete IDOR Remediation)
2026-08-31 11:09:23 +08:00
fit2cloud-chenyw and Claude
bbfc4cc8f5
fix(Security): Host header injection auth bypass and forged admin embedded token (CNVD)
...
- TokenMiddleware/ResponseMiddleware/audit logger use scope['path']
instead of request.url.path for whitelist checks: a crafted Host
header (e.g. x/api/v1/mcp) was concatenated into Starlette's URL
and made protected routes match the /mcp* whitelist entry
- validateEmbedded rejects admin accounts and non-type-4 apps, so a
self-signed token with account=admin can no longer impersonate the
administrator
- Add HostValidationMiddleware rejecting malformed Host headers at the
outermost layer (defense in depth)
- Add regression tests for host validation, whitelist matching and
source-level guards
Co-Authored-By: Claude <[email protected]
2026-08-31 11:05:05 +08:00
ulleo
cc8a7546e9
chron: update X-Pack version
2026-08-28 18:25:37 +08:00
ulleo
6518701913
fix: Prevent Authorization Bypass Through User-Controlled Key problem (CWE-639)
2026-08-28 18:22:35 +08:00
ulleo
66a1b33ac4
fix: prevent path traversal in Excel upload (CWE-22)
2026-08-28 17:51:27 +08:00
fit2cloud-chenyw
49a50e3bce
fix: Cross-Workspace Assistant Modification and Deletion (IDOR)
2026-08-28 15:37:45 +08:00
junjun
273171b8d1
fix: Kingbase SQL inject
2026-08-27 15:04:39 +08:00
ulleo
1fdc28b6fd
improve: Support similarity sorting across account, name, and email fields
2026-08-26 21:08:43 +08:00
ulleo
a2d1a9d423
improve: Support similarity sorting across account, name, and email fields
2026-08-26 11:13:23 +08:00
ulleo
b99f140300
improve: Sort search results by account similarity
2026-08-26 10:52:24 +08:00
xuwei-fit2cloud
53bedcc555
update version to 1.10.1
2026-08-24 18:36:56 +08:00
ulleo
ed19e8997e
fix: i18n
2026-08-24 14:08:09 +08:00
junjun
bfe3fc4dc9
fix: The number of columns returned by Hive DESCRIBE does not match the ColumnSchema constructor #1210
2026-08-20 14:17:11 +08:00
junjun
7a32b139f7
feat: Hive datasource supports LDAP authentication #1209
2026-08-20 11:26:46 +08:00
junjun
d31e6a0277
feat: Hive datasource supports LDAP authentication
2026-08-20 10:05:49 +08:00
junjun
d33e42004c
feat: MCP support model
2026-08-19 10:20:40 +08:00
junjun
2a86aa926c
feat: MCP support model
2026-08-18 17:02:43 +08:00
junjun
150b98c930
feat: MCP support model
2026-08-18 16:20:53 +08:00
junjun
743750305d
feat: MCP support model
2026-08-18 15:43:28 +08:00
junjun
0c885d5a67
build: lock fastapi version
2026-08-12 18:15:59 +08:00
ulleo
7c40afb436
fix: 将模板文件中的繁体字转换为简体字
...
#1319
2026-08-12 17:36:27 +08:00
ulleo
b1f9257a15
chore: update version
2026-08-11 18:25:29 +08:00
ulleo
a2a7591d0f
feat: switch search filters from OR to AND logic
2026-08-11 18:22:44 +08:00
junjun
c8a2dd89bb
feat: system param support key-value #1310
2026-08-10 14:09:02 +08:00
junjun
959285cfd0
feat: system param support key-value #1310
2026-08-07 11:31:28 +08:00
junjun
ec4717e1f1
fix: connect pool pre ping
2026-08-03 17:05:35 +08:00
junjun
e735bfafc0
build: lock mcp version
2026-08-03 17:04:33 +08:00
ulleo
6a175b0124
fix: CWE problem in recommend_questions
2026-08-03 16:47:33 +08:00
ulleo
e58d1822dc
feat: optimize chat list sorting
2026-07-30 16:52:46 +08:00
fit2cloud-chenyw
2fefef0a37
fix: CORS error occurred while embedding the assistant
2026-07-29 13:51:57 +08:00
fit2cloud-chenyw
4058ad3602
feat: Add a verification interface for the assistant
2026-07-29 11:27:21 +08:00
junjun
016b803a55
build: update dependency
2026-07-28 09:53:06 +08:00
ulleo
72f0111df0
refactor: replace dicttoxml with stdlib implementation to avoid GPL license risk
2026-07-27 15:15:03 +08:00
Sebastion
a520fda25e
fix: prevent path traversal in terminology excel upload (CWE-22)
2026-07-27 14:37:54 +08:00
sjj
d21e7dea11
fix: avoid duplicate startup embedding jobs
2026-07-27 14:31:39 +08:00
ulleo
9726db544d
refactor: replace dicttoxml with stdlib implementation to avoid GPL license risk
2026-07-24 18:09:00 +08:00
ulleo
9656efad06
feat: support export with filter
2026-07-24 17:03:02 +08:00
ulleo
8e97a6b962
feat: support filter search in SQL sample and terminology list
...
#1281
2026-07-24 11:27:02 +08:00
junjun
fe65f3e2cc
refactor: Optimize connection pool #1256
2026-07-20 17:32:54 +08:00
ulleo
7118b401a7
fix: extract_tables_from_sql incorrectly includes CTE names as table names
...
#1278
2026-07-17 16:33:02 +08:00
junjun
cad8a57c30
refactor: Optimize the type of permission field
2026-07-16 17:31:53 +08:00
junjun