fit2cloud-chenyw
ee5e80d35f
feat: Improve user list sorting
2026-07-13 17:05:29 +08:00
junjun
767d665dd9
refactor: Optimize connection pool
2026-07-13 17:04:52 +08:00
ulleo
ccbc65d549
feat: add thousands separator settings
2026-07-13 16:57:11 +08:00
junjun
8a18ed6513
refactor: Optimize connection pool
2026-07-13 16:45:09 +08:00
ulleo
42d8c82ffc
feat: add thousands separator settings
2026-07-13 15:55:41 +08:00
ulleo
d7261dabd6
feat: support configuring terminology for specified advanced applications
2026-07-10 17:22:42 +08:00
ulleo
487f5fd584
fix: export/import SQL Sample management
2026-07-10 16:12:33 +08:00
ulleo
aa594a5681
feat: Adjust the organizational attribution logic of dialogues in MCP
...
#1221
2026-07-09 18:17:03 +08:00
ulleo
b947cf2476
feat: add thousands separator settings
2026-07-09 17:45:21 +08:00
ulleo
ce3ea977ae
fix: delete chat error when chat title contains '/' character
...
#1232
2026-07-07 15:19:42 +08:00
ulleo
86c4f00940
feat: add system log in mcp_start
...
#1241
2026-07-01 14:04:49 +08:00
ulleo
2fc646ce3c
feat: Adjust the organizational attribution logic of dialogues in MCP
...
#1221
2026-06-29 16:00:42 +08:00
junjun
d41598eea5
feat: Adjust the organizational attribution logic of dialogues in MCP #1221
2026-06-29 15:28:18 +08:00
junjun
936bb5d390
fix: Compatible with older versions of MSSQL in DataEase
2026-06-23 14:57:10 +08:00
ulleo
92d55a8ae4
chron: format line
2026-06-22 14:30:29 +08:00
junjun
1c8b6f95ae
fix: Fix the vulnerability in viewing enumeration values across workspaces
2026-06-17 17:56:41 +08:00
junjun
df44e660bd
fix: Fix the vulnerability in viewing enumeration values across workspaces
2026-06-17 17:13:50 +08:00
ulleo
4af99e0c45
feat: support configuring terminology for specified advanced applications
2026-06-16 17:23:50 +08:00
junjun
447592b767
fix: Fix MCP oid missing validation
2026-06-11 17:51:37 +08:00
junjun
cc45f47c12
fix: Fix MCP oid missing validation
2026-06-11 17:33:42 +08:00
ulleo
5b94406c3a
fix: Fix SQL injection / LLM Prompt Injection vulnerability causing unauthorized queries
...
Security hardening:
- Add SQLBOT_ALLOW_METADATA_QUERIES config option, disable SHOW/DESCRIBE/EXPLAIN by default
- Add table whitelist check, use sqlglot to parse actual SQL table names and compare with authorized table list
- Add dangerous function check, block LOAD_FILE, INTO OUTFILE, EXEC etc. by database type
- Improve check_sql_read to return specific error reasons for better debugging
2026-06-11 17:29:38 +08:00
Sebastion
dd9627b682
fix: escape SQL values in row permission filter to prevent injection (CWE-89)
...
All user-controlled values interpolated into SQL WHERE clause fragments
in transTreeItem() and getSysVariableValue() are now passed through
_escape_sql_value() which doubles single quotes (standard SQL escaping)
and escapes backslashes. The logic operator in transTreeToWhere() is
also validated against a whitelist.
Affected injection vectors:
- item["enum_value"] list (enum filter)
- item["value"] string (normal filter)
- user variable values (variable filter)
- current_user name/account/email (system variable filter)
- tree["logic"] operator (tree structure)
2026-06-11 11:21:37 +08:00
ulleo
b472bc0977
fix: improve docs
...
#1183
2026-06-10 11:45:35 +08:00
junjun
7637ab391d
fix: Fix the privilege escalation vulnerability in system variables
2026-06-08 17:01:44 +08:00
junjun
ba7b397c51
fix: Fix the privilege escalation vulnerability in system variables
2026-06-08 16:54:17 +08:00
junjun
81c8acda91
fix: Fix the privilege escalation vulnerability in system variables
2026-06-08 16:33:34 +08:00
ulleo
316450b027
feat: improve float value display in export excel
2026-06-08 16:20:21 +08:00
junjun
80dc9a3aa8
fix: Fix the privilege escalation vulnerability in system variables
2026-06-08 15:26:55 +08:00
junjun
5d5a92a526
fix: fix Excel sheet name inject SQL
2026-06-08 11:17:02 +08:00
junjun
0c4f0c72c4
fix: Fix the issue where obtaining schema from DM data source may require a high privilege account
2026-06-05 09:58:37 +08:00
junjun
98dba5f517
fix: Fix the privilege escalation vulnerability in system variables
2026-06-04 16:42:48 +08:00
ulleo
d5d5e87b51
feat(Application): Application can configure specified model
2026-06-04 15:06:09 +08:00
ulleo
c53ac8f720
feat(Model Configuration): Supported Authorized Space
2026-06-04 14:38:00 +08:00
junjun
348346d97b
fix: remove sqlite datasource
2026-06-04 11:40:31 +08:00
ulleo
3f3dc08a67
feat(Model Configuration): Supported Authorized Space
2026-06-04 10:49:30 +08:00
ulleo
f691b3e03a
feat(Application): Application can configure specified model
2026-06-03 17:29:09 +08:00
ulleo
835eefcb39
fix: remove svg image support in upload files
2026-06-03 15:55:05 +08:00
junjun
76b5176b0e
fix: Fix SQL injection vulnerability
2026-06-03 12:18:49 +08:00
ulleo
d57cf3aee6
feat(Application): Application can configure specified model
2026-06-02 16:59:24 +08:00
ulleo
23ca654bc4
feat(Application): Application can configure specified model
2026-06-02 16:24:44 +08:00
ulleo
4b0d4ce663
feat(Application): Application can configure specified model
2026-06-02 14:46:55 +08:00
ulleo
46de2322b0
feat(Application): Application can configure specified model
2026-06-02 14:18:35 +08:00
ulleo
ba16432a66
feat(Application): Application can configure specified model
2026-06-02 14:05:52 +08:00
junjun
4bfd0f49e8
fix: Fix parseExcel vulnerability
2026-06-01 12:30:51 +08:00
junjun
92c5aea70b
fix: Fix parseExcel vulnerability
2026-06-01 12:28:20 +08:00
fit2cloud-chenyw
a26b173165
fix(X-Pack): Unable to save model due to long API Key #1090
2026-05-22 11:57:02 +08:00
ulleo
46400d0ad0
fix: add require_permissions in data training for upload Excel file
2026-05-12 16:48:46 +08:00
ulleo
e72c0bedda
fix: Fix the data source-related issues in the PR
2026-05-11 15:07:15 +08:00
ulleo
afbb3d7981
feat: Support configure SQLBot name in chat template
2026-05-08 17:11:16 +08:00
junjun
d12f3609b5
fix: Fix the data source-related issues in the PR
2026-05-08 16:32:22 +08:00
fit2cloud-chenyw