QuantumGhost 874406d934 security(api): fix privilege escalation vulnerability in model config and chat message APIs (#25518) ... The `ChatMessageApi` (`POST /console/api/apps/{app_id}/chat-messages`) and `ModelConfigResource` (`POST /console/api/apps/{app_id}/model-config`) endpoints do not properly validate user permissions, allowing users without `editor` permission to access restricted functionality. This PR addresses this issue by adding proper permission check.		2025-09-11 14:53:35 +08:00
..
__init__.py	fix: missing default user for APP service api (#2606)	2024-02-28 16:09:56 +08:00
annotation.py	security(api): fix privilege escalation vulnerability in model config and chat message APIs (#25518)	2025-09-11 14:53:35 +08:00
app.py	feat: API docs for service api (#24425)	2025-08-25 09:26:54 +08:00
audio.py	chore: apply ty checks on api code with script and ci action (#24653)	2025-09-02 16:05:13 +08:00
completion.py	Refactor: use logger = logging.getLogger(__name__) in logging (#24515)	2025-08-26 18:10:31 +08:00
conversation.py	Fix basedpyright type errors (#25435)	2025-09-10 01:54:26 +08:00
error.py	Restructure the File errors in controller (#23801)	2025-08-13 17:06:07 +08:00
file.py	feat: API docs for service api (#24425)	2025-08-25 09:26:54 +08:00
file_preview.py	[Chore/Refactor] Switch from MyPy to Basedpyright for type checking (#25047)	2025-09-03 11:52:26 +08:00
message.py	Refactor: use logger = logging.getLogger(__name__) in logging (#24515)	2025-08-26 18:10:31 +08:00
site.py	feat: API docs for service api (#24425)	2025-08-25 09:26:54 +08:00
workflow.py	Refactor: use logger = logging.getLogger(__name__) in logging (#24515)	2025-08-26 18:10:31 +08:00