ulleo
deff40b884
feat: add thousands separator settings
2026-07-13 19:03:23 +08:00
ulleo
f56f65905a
feat: add thousands separator settings
2026-07-13 18:33:58 +08:00
ulleo
a5e57c1d60
feat: add thousands separator settings
2026-07-13 18:09:37 +08:00
fit2cloud-chenyw
ee5e80d35f
feat: Improve user list sorting
2026-07-13 17:05:29 +08:00
junjun
767d665dd9
refactor: Optimize connection pool
2026-07-13 17:04:52 +08:00
ulleo
ccbc65d549
feat: add thousands separator settings
2026-07-13 16:57:11 +08:00
junjun
8a18ed6513
refactor: Optimize connection pool
2026-07-13 16:45:09 +08:00
ulleo
42d8c82ffc
feat: add thousands separator settings
2026-07-13 15:55:41 +08:00
ulleo
c8b5346d54
feat: add system log in mcp_start
2026-07-13 14:03:37 +08:00
ulleo
74a0382c52
feat: add system log in mcp_start
2026-07-13 13:55:00 +08:00
ulleo
d7261dabd6
feat: support configuring terminology for specified advanced applications
2026-07-10 17:22:42 +08:00
ulleo
487f5fd584
fix: export/import SQL Sample management
2026-07-10 16:12:33 +08:00
ulleo
aa594a5681
feat: Adjust the organizational attribution logic of dialogues in MCP
...
#1221
2026-07-09 18:17:03 +08:00
ulleo
b947cf2476
feat: add thousands separator settings
2026-07-09 17:45:21 +08:00
ulleo
ce3ea977ae
fix: delete chat error when chat title contains '/' character
...
#1232
2026-07-07 15:19:42 +08:00
Fit111
7d4354597c
feat: 新增alembic迁移脚本，补充内置数据库表字段备注
2026-07-07 14:18:12 +08:00
ulleo
86c4f00940
feat: add system log in mcp_start
...
#1241
2026-07-01 14:04:49 +08:00
ulleo
275f326742
feat: add hide thinking block configuration
...
#1229
2026-06-30 15:25:24 +08:00
ulleo
2fc646ce3c
feat: Adjust the organizational attribution logic of dialogues in MCP
...
#1221
2026-06-29 16:00:42 +08:00
junjun
4f8d8936c5
feat: Adjust the organizational attribution logic of dialogues in MCP #1221
2026-06-29 15:34:28 +08:00
junjun
d41598eea5
feat: Adjust the organizational attribution logic of dialogues in MCP #1221
2026-06-29 15:28:18 +08:00
fit2cloud-chenyw
dc2b0788f4
perf: Add API documentation toggle control
2026-06-24 09:59:39 +08:00
junjun
936bb5d390
fix: Compatible with older versions of MSSQL in DataEase
2026-06-23 14:57:10 +08:00
ulleo
92d55a8ae4
chron: format line
2026-06-22 14:30:29 +08:00
junjun
1c8b6f95ae
fix: Fix the vulnerability in viewing enumeration values across workspaces
2026-06-17 17:56:41 +08:00
junjun
df44e660bd
fix: Fix the vulnerability in viewing enumeration values across workspaces
2026-06-17 17:13:50 +08:00
ulleo
a76f8e7f9b
fix: correct database query examples in templates
2026-06-17 16:37:24 +08:00
ulleo
4af99e0c45
feat: support configuring terminology for specified advanced applications
2026-06-16 17:23:50 +08:00
junjun
447592b767
fix: Fix MCP oid missing validation
2026-06-11 17:51:37 +08:00
junjun
cc45f47c12
fix: Fix MCP oid missing validation
2026-06-11 17:33:42 +08:00
ulleo
5b94406c3a
fix: Fix SQL injection / LLM Prompt Injection vulnerability causing unauthorized queries
...
Security hardening:
- Add SQLBOT_ALLOW_METADATA_QUERIES config option, disable SHOW/DESCRIBE/EXPLAIN by default
- Add table whitelist check, use sqlglot to parse actual SQL table names and compare with authorized table list
- Add dangerous function check, block LOAD_FILE, INTO OUTFILE, EXEC etc. by database type
- Improve check_sql_read to return specific error reasons for better debugging
2026-06-11 17:29:38 +08:00
Sebastion
dd9627b682
fix: escape SQL values in row permission filter to prevent injection (CWE-89)
...
All user-controlled values interpolated into SQL WHERE clause fragments
in transTreeItem() and getSysVariableValue() are now passed through
_escape_sql_value() which doubles single quotes (standard SQL escaping)
and escapes backslashes. The logic operator in transTreeToWhere() is
also validated against a whitelist.
Affected injection vectors:
- item["enum_value"] list (enum filter)
- item["value"] string (normal filter)
- user variable values (variable filter)
- current_user name/account/email (system variable filter)
- tree["logic"] operator (tree structure)
2026-06-11 11:21:37 +08:00
ulleo
b472bc0977
fix: improve docs
...
#1183
2026-06-10 11:45:35 +08:00
wangjiahao
2da3ae4111
fix: Extend sys_logs user_agent column length to support DingTalk agent ( #1170 )
...
The DingTalk agent sends user_agent strings that exceed the previous
255-character limit, causing log entries to be silently dropped.
Increase the column to VARCHAR(500).
2026-06-09 14:44:38 +08:00
junjun
7637ab391d
fix: Fix the privilege escalation vulnerability in system variables
2026-06-08 17:01:44 +08:00
junjun
ba7b397c51
fix: Fix the privilege escalation vulnerability in system variables
2026-06-08 16:54:17 +08:00
junjun
81c8acda91
fix: Fix the privilege escalation vulnerability in system variables
2026-06-08 16:33:34 +08:00
ulleo
316450b027
feat: improve float value display in export excel
2026-06-08 16:20:21 +08:00
junjun
80dc9a3aa8
fix: Fix the privilege escalation vulnerability in system variables
2026-06-08 15:26:55 +08:00
junjun
5d5a92a526
fix: fix Excel sheet name inject SQL
2026-06-08 11:17:02 +08:00
junjun
0c4f0c72c4
fix: Fix the issue where obtaining schema from DM data source may require a high privilege account
2026-06-05 09:58:37 +08:00
xuwei-fit2cloud
a502113155
Update version to v1.9.0
2026-06-04 18:22:30 +08:00
junjun
98dba5f517
fix: Fix the privilege escalation vulnerability in system variables
2026-06-04 16:42:48 +08:00
ulleo
d5d5e87b51
feat(Application): Application can configure specified model
2026-06-04 15:06:09 +08:00
ulleo
c53ac8f720
feat(Model Configuration): Supported Authorized Space
2026-06-04 14:38:00 +08:00
junjun
bd5605b681
fix: remove sqlite datasource
2026-06-04 11:40:58 +08:00
junjun
348346d97b
fix: remove sqlite datasource
2026-06-04 11:40:31 +08:00
ulleo
3f3dc08a67
feat(Model Configuration): Supported Authorized Space
2026-06-04 10:49:30 +08:00
ulleo
f691b3e03a
feat(Application): Application can configure specified model
2026-06-03 17:29:09 +08:00
ulleo
835eefcb39
fix: remove svg image support in upload files
2026-06-03 15:55:05 +08:00
ulleo