mirror of https://github.com/langgenius/dify.git
874406d934
The `ChatMessageApi` (`POST /console/api/apps/{app_id}/chat-messages`) and
`ModelConfigResource` (`POST /console/api/apps/{app_id}/model-config`)
endpoints do not properly validate user permissions, allowing users without `editor`
permission to access restricted functionality.
This PR addresses this issue by adding proper permission check.
|
||
|---|---|---|
| .. | ||
| controllers/console | ||
| factories | ||
| model_runtime/__mock | ||
| plugin | ||
| services | ||
| storage | ||
| tasks | ||
| tools | ||
| utils | ||
| vdb | ||
| workflow | ||
| .env.example | ||
| .gitignore | ||
| __init__.py | ||
| conftest.py | ||