SQLBot

mirror of https://gh-proxy.org/https://github.com/klinsmaya/SQLBot.git synced 2026-11-08 01:06:59 +08:00

Files

T

carfeii fccdd29421 Add per-user ownership check to dashboard load/update/delete

Dashboard resource endpoints (load_resource, update_resource,
update_canvas, delete_resource) fetched a core_dashboard row by id
alone, with no check that the caller created it. The only gating
decorator verified workspace membership, not per-user ownership, so
any authenticated workspace member could read, rename, or delete any
other member's dashboard by id. list_resource already filters by
create_by, showing dashboards are meant to be private per creator;
this adds the same check to the other four code paths.

2026-09-17 10:21:18 +08:00

ai_model

chron: format line

2026-06-22 14:30:29 +08:00

chat

feat: add system param: SAMPLE_DATA_ENABLED

2026-09-15 11:46:16 +08:00

dashboard

Add per-user ownership check to dashboard load/update/delete

2026-09-17 10:21:18 +08:00

data_training

fix: Prevent Authorization Bypass Through User-Controlled Key problem (CWE-639)