fit2cloud-chenyw and Claude
bbfc4cc8f5
fix(Security): Host header injection auth bypass and forged admin embedded token (CNVD)
...
- TokenMiddleware/ResponseMiddleware/audit logger use scope['path']
instead of request.url.path for whitelist checks: a crafted Host
header (e.g. x/api/v1/mcp) was concatenated into Starlette's URL
and made protected routes match the /mcp* whitelist entry
- validateEmbedded rejects admin accounts and non-type-4 apps, so a
self-signed token with account=admin can no longer impersonate the
administrator
- Add HostValidationMiddleware rejecting malformed Host headers at the
outermost layer (defense in depth)
- Add regression tests for host validation, whitelist matching and
source-level guards
Co-Authored-By: Claude <[email protected]
2026-08-31 11:05:05 +08:00
junjun
150b98c930
feat: MCP support model
2026-08-18 16:20:53 +08:00
sjj
d21e7dea11
fix: avoid duplicate startup embedding jobs
2026-07-27 14:31:39 +08:00
ulleo
c8b5346d54
feat: add system log in mcp_start
2026-07-13 14:03:37 +08:00
ulleo
74a0382c52
feat: add system log in mcp_start
2026-07-13 13:55:00 +08:00
junjun
4f8d8936c5
feat: Adjust the organizational attribution logic of dialogues in MCP #1221
2026-06-29 15:34:28 +08:00
fit2cloud-chenyw
dc2b0788f4
perf: Add API documentation toggle control
2026-06-24 09:59:39 +08:00
fit2cloud-chenyw
559c80c5b9
perf: Optimize frontend localStorage key conflicts
2026-04-14 12:04:13 +08:00
junjun
f32e1fdff3
feat: MCP supports selecting workspaces #926
2026-03-24 14:21:59 +08:00
junjun
cdb9f892cd
feat: mcp provide datasource
2026-01-04 14:19:42 +08:00
wangjiahao
1df98cec0f
refactor: Add logs to the system operation method
2025-12-26 17:14:34 +08:00
王嘉豪
f1cdbc9a00
feat: Support recording system operation logs ( #651 )
2025-12-22 17:34:01 +08:00
fit2cloud-chenyw
761c3c8783
perf: Swagger page fails to load remote CDN resources
2025-12-18 17:26:10 +08:00
fit2cloud-chenyw
a9b20c23b9
feat: API permission control ( #613 )
2025-12-12 11:12:30 +08:00
junjun
52bba50929
feat: Add Api Docs
2025-12-11 15:20:49 +08:00
junjun
2952c87d16
feat: Add Api Docs
2025-12-11 14:52:27 +08:00
fit2cloud-chenyw
1669ba3ed1
fix: Error occurs when re-uploading after the license expires
2025-12-10 16:45:43 +08:00
junjun
b1dda8b454
feat: Vector retrieval matches tables
2025-10-10 12:39:37 +08:00
junjun
f59bc962e3
refactor: Service initiation vectorization task
2025-10-10 10:03:57 +08:00
junjun
56c0359ee4
feat: Vector retrieval matches tables
2025-10-09 16:12:24 +08:00
junjun
24b9c9afac
feat: Vector retrieval matches tables
2025-10-09 11:46:40 +08:00
junjun
c072bd2103
feat: MCP support get third-part system datasource
2025-09-22 16:19:50 +08:00
ulleo
f86b2f60cf
feat: add SQL examples in prompt
2025-09-16 18:08:53 +08:00
junjun
5411e93ad4
refactor: auto create mcp images folder if not exist
2025-09-05 15:33:02 +08:00
fit2cloud-chenyw
79f7630537
perf: Encryption of sensitive data in ai_model table #9
2025-08-27 17:44:34 +08:00
ulleo
4faa2bd689
feat: use terminology during chat
2025-08-27 14:29:18 +08:00
ulleo
86abe25e27
feat: export
2025-08-05 10:56:59 +08:00
ulleo
3fc3f5d505
feat: export chart
2025-08-04 19:51:42 +08:00
fit2cloud-chenyw
ca2f853bf1
perf: X-Pack controlled by license
2025-08-04 12:37:54 +08:00
junjun
8246c2f84f
feat: mcp images mount
2025-07-31 14:54:13 +08:00
fit2cloud-chenyw
c8003a2e67
perf: Enviroment config
2025-07-30 14:46:17 +08:00
fit2cloud-chenyw
b116e37299
perf: Login api entrypt password
2025-07-29 16:09:57 +08:00
fit2cloud-chenyw
e739284db9
perf: Cache config
2025-07-24 16:15:33 +08:00
fit2cloud-chenyw
63a1d1fe7d
feat: Log file
2025-07-23 15:59:23 +08:00
fit2cloud-chenyw
a3bbf47438
perf: Assistant cors config
2025-07-15 10:07:57 +08:00
fit2cloud-chenyw
c8fc4762bd
feat: Backend cache
2025-07-08 17:48:50 +08:00
junjun
2b7ff697aa
feat: mcp tools
2025-07-03 09:59:08 +08:00
junjun
cc9af61915
feat: mcp image path
2025-07-02 15:40:43 +08:00
junjun
7f641f98c0
feat: mcp server
2025-07-01 17:31:03 +08:00
junjun
e41a449242
feat: mount image path
2025-07-01 14:10:02 +08:00
fit2cloud-chenyw
7b1cc1f24d
perf: main
2025-06-27 14:55:28 +08:00
fit2cloud-chenyw
6fdb1ca186
perf: Load X-Pack
2025-06-27 14:47:42 +08:00
junjun
35699551b0
feat: mcp tools
2025-06-27 11:16:07 +08:00
junjun
2a52bc3299
feat: mcp server
2025-06-24 12:23:13 +08:00
junjun
2d7dc6da3d
feat: mcp server
2025-06-23 14:22:09 +08:00
junjun
961b53d5ea
feat: mcp server
2025-06-23 14:01:29 +08:00
junjun
d76e2e0253
feat: mcp server
2025-06-23 13:35:14 +08:00
junjun
eceea66ce4
feat: annotate
2025-06-20 17:47:56 +08:00
fit2cloud-chenyw
6ed75c254f
feat: License
2025-06-19 17:46:46 +08:00
junjun
2a74b4d69e
feat: mcp
2025-06-11 14:26:31 +08:00
