fit2cloud-chenyw
ee5e80d35f
feat: Improve user list sorting
2026-07-13 17:05:29 +08:00
junjun
767d665dd9
refactor: Optimize connection pool
2026-07-13 17:04:52 +08:00
ulleo
ccbc65d549
feat: add thousands separator settings
2026-07-13 16:57:11 +08:00
junjun
8a18ed6513
refactor: Optimize connection pool
2026-07-13 16:45:09 +08:00
ulleo
42d8c82ffc
feat: add thousands separator settings
2026-07-13 15:55:41 +08:00
fit2cloud-chenyw
c4110f6a69
feat: Add language options to the embed
2026-07-13 14:03:51 +08:00
ulleo
c8b5346d54
feat: add system log in mcp_start
2026-07-13 14:03:37 +08:00
ulleo
74a0382c52
feat: add system log in mcp_start
2026-07-13 13:55:00 +08:00
dataeaseShu
8a10be0970
fix(Assistant App): Header text color not working
2026-07-10 17:34:04 +08:00
ulleo
d7261dabd6
feat: support configuring terminology for specified advanced applications
2026-07-10 17:22:42 +08:00
dataeaseShu
2c2960e56f
fix(Assistant App): Header text color not working
2026-07-10 16:50:25 +08:00
ulleo
487f5fd584
fix: export/import SQL Sample management
2026-07-10 16:12:33 +08:00
ulleo
aa594a5681
feat: Adjust the organizational attribution logic of dialogues in MCP
...
#1221
2026-07-09 18:17:03 +08:00
ulleo
b947cf2476
feat: add thousands separator settings
2026-07-09 17:45:21 +08:00
ulleo
a2196d9c3e
fix: fix predict data chart missing problem in record list
2026-07-09 15:55:31 +08:00
dataeaseShu
a0f7fb2488
fix(Smart Number Query): When enabling thousands separators, the pop-up window does not close, causing abnormal page scrolling.
2026-07-09 15:11:30 +08:00
dataeaseShu
f15c645fa5
fix: Compilation failed
2026-07-07 17:09:26 +08:00
ulleo
ce3ea977ae
fix: delete chat error when chat title contains '/' character
...
#1232
2026-07-07 15:19:42 +08:00
Fit111
7d4354597c
feat: 新增alembic迁移脚本，补充内置数据库表字段备注
2026-07-07 14:18:12 +08:00
maninhill
42888d5ad9
Remove security assessment badge from README
...
Removed security assessment badge from README.
2026-07-07 11:44:33 +08:00
MseeP.ai
11a999d6b6
Add MseeP.ai badge to README.md ( #1253 )
2026-07-07 11:43:05 +08:00
dataeaseShu
71d1be163e
fix(Login): Login page background image logic optimization
2026-07-07 11:12:07 +08:00
dataeaseShu
d1d63ac76e
fix(User Management): The workspace user list has a pagination limit of 1000 entries, making it impossible to select the 1001st user and beyond. #1243
2026-07-02 10:46:16 +08:00
ulleo
86c4f00940
feat: add system log in mcp_start
...
#1241
2026-07-01 14:04:49 +08:00
dataeaseShu
976feb8ad3
fix(Browser): Styles compatible with older versions of Chromium-based browsers (version 81).
2026-07-01 10:10:33 +08:00
ulleo
275f326742
feat: add hide thinking block configuration
...
#1229
2026-06-30 15:25:24 +08:00
dataeaseShu
f73cca98e2
fix(Compile): expand package memory
2026-06-29 16:09:43 +08:00
ulleo
2fc646ce3c
feat: Adjust the organizational attribution logic of dialogues in MCP
...
#1221
2026-06-29 16:00:42 +08:00
junjun
4f8d8936c5
feat: Adjust the organizational attribution logic of dialogues in MCP #1221
2026-06-29 15:34:28 +08:00
junjun
d41598eea5
feat: Adjust the organizational attribution logic of dialogues in MCP #1221
2026-06-29 15:28:18 +08:00
dataeaseShu
8ad3837083
fix(浏览器): 兼容低版本Chromium 内核浏览器，解决内核81版本页面白屏问题#1226
2026-06-29 14:01:34 +08:00
ulleo
582893ab65
feat: add thousands separator settings
2026-06-24 18:58:19 +08:00
ulleo
65366d0a41
pref: improve show label button in chart display
2026-06-24 18:02:53 +08:00
ulleo
a3b45754a3
feat: add thousands separator settings
2026-06-24 17:45:33 +08:00
fit2cloud-chenyw
dc2b0788f4
perf: Add API documentation toggle control
2026-06-24 09:59:39 +08:00
junjun
936bb5d390
fix: Compatible with older versions of MSSQL in DataEase
2026-06-23 14:57:10 +08:00
ulleo
b1a425af5e
feat: remove default title in index.html
2026-06-22 17:18:02 +08:00
ulleo
92d55a8ae4
chron: format line
2026-06-22 14:30:29 +08:00
junjun
1c8b6f95ae
fix: Fix the vulnerability in viewing enumeration values across workspaces
2026-06-17 17:56:41 +08:00
junjun
df44e660bd
fix: Fix the vulnerability in viewing enumeration values across workspaces
2026-06-17 17:13:50 +08:00
ulleo
a76f8e7f9b
fix: correct database query examples in templates
2026-06-17 16:37:24 +08:00
ulleo
4af99e0c45
feat: support configuring terminology for specified advanced applications
2026-06-16 17:23:50 +08:00
junjun
447592b767
fix: Fix MCP oid missing validation
2026-06-11 17:51:37 +08:00
junjun
cc45f47c12
fix: Fix MCP oid missing validation
2026-06-11 17:33:42 +08:00
ulleo
5b94406c3a
fix: Fix SQL injection / LLM Prompt Injection vulnerability causing unauthorized queries
...
Security hardening:
- Add SQLBOT_ALLOW_METADATA_QUERIES config option, disable SHOW/DESCRIBE/EXPLAIN by default
- Add table whitelist check, use sqlglot to parse actual SQL table names and compare with authorized table list
- Add dangerous function check, block LOAD_FILE, INTO OUTFILE, EXEC etc. by database type
- Improve check_sql_read to return specific error reasons for better debugging
2026-06-11 17:29:38 +08:00
Sebastion
82b1028305
test: add unit tests for CWE-89 SQL escape fix in row_permission.py
2026-06-11 11:21:37 +08:00
Sebastion
dd9627b682
fix: escape SQL values in row permission filter to prevent injection (CWE-89)
...
All user-controlled values interpolated into SQL WHERE clause fragments
in transTreeItem() and getSysVariableValue() are now passed through
_escape_sql_value() which doubles single quotes (standard SQL escaping)
and escapes backslashes. The logic operator in transTreeToWhere() is
also validated against a whitelist.
Affected injection vectors:
- item["enum_value"] list (enum filter)
- item["value"] string (normal filter)
- user variable values (variable filter)
- current_user name/account/email (system variable filter)
- tree["logic"] operator (tree structure)
2026-06-11 11:21:37 +08:00
ulleo
b472bc0977
fix: improve docs
...
#1183
2026-06-10 11:45:35 +08:00
wangjiahao
2da3ae4111
fix: Extend sys_logs user_agent column length to support DingTalk agent ( #1170 )
...
The DingTalk agent sends user_agent strings that exceed the previous
255-character limit, causing log entries to be silently dropped.
Increase the column to VARCHAR(500).
2026-06-09 14:44:38 +08:00
junjun
7637ab391d
fix: Fix the privilege escalation vulnerability in system variables
2026-06-08 17:01:44 +08:00
fit2cloud-chenyw