opensource/dify
2
0
Fork 0
mirror of https://github.com/langgenius/dify.git synced 2026-05-09 21:28:25 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix(security): also tenant-scope /apps/<app_id>/trace AppTraceApi

Browse Source 
The AppTraceApi GET/POST endpoints in app.py have the same missing-
tenant-check bug as ops_trace.py, on the same advisory. Apply the
same @get_app_model decorator pattern here too.

Bundled into this PR per zafido's draft patch — same advisory,
same bug class, same fix pattern.

Refs: GHSA-48xc-wmw8-3jr3
Co-Authored-By: Ido Shani <ido@zafran.io>
This commit is contained in:
xr843 2026-05-05 17:49:34 +08:00
parent 11c8a4bfa8
commit 16b98ea4da
1 changed files with 6 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
api/controllers/console/app/app.py
View File

@ -840,10 +840,11 @@ class AppTraceApi(Resource):
@setup_required
@login_required
@account_initialization_required
def get(self, app_id):
@get_app_model
def get(self, app_model):
"""Get app trace"""
with session_factory.create_session() as session:
app_trace_config = OpsTraceManager.get_app_tracing_config(app_id, session)
app_trace_config = OpsTraceManager.get_app_tracing_config(app_model.id, session)
return app_trace_config
@ -857,12 +858,13 @@ class AppTraceApi(Resource):
@login_required
@account_initialization_required
@edit_permission_required
def post(self, app_id):
@get_app_model
def post(self, app_model):
# add app trace
args = AppTracePayload.model_validate(console_ns.payload)
OpsTraceManager.update_app_tracing_config(
app_id=app_id,
app_id=app_model.id,
enabled=args.enabled,
tracing_provider=args.tracing_provider,
)