opensource
/
dify
mirror of https://github.com/langgenius/dify.git
2
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
dify/api/controllers/console
History
QuantumGhost 874406d934
security(api): fix privilege escalation vulnerability in model config and chat message APIs (#25518) 
The `ChatMessageApi` (`POST /console/api/apps/{app_id}/chat-messages`) and 
`ModelConfigResource` (`POST /console/api/apps/{app_id}/model-config`) 
endpoints do not properly validate user permissions, allowing users without `editor` 
permission to access restricted functionality.

This PR addresses this issue by adding proper permission check.
 		2025-09-11 14:53:35 +08:00
..
app security(api): fix privilege escalation vulnerability in model config and chat message APIs (#25518) 2025-09-11 14:53:35 +08:00
auth refactor: Migrate part of the console basic API module to Flask-RESTX (#24732) 2025-09-10 12:15:47 +08:00
billing more assert (#24996) 2025-09-08 09:59:43 +08:00
datasets update sql in batch (#24801) 2025-09-10 13:00:17 +08:00
explore update sql in batch (#24801) 2025-09-10 13:00:17 +08:00
tag Fix flask response: 200 -> {}, 200 (#25404) 2025-09-09 15:06:18 +08:00
workspace update sql in batch (#24801) 2025-09-10 13:00:17 +08:00
__init__.py refactor: Migrate part of the console basic API module to Flask-RESTX (#24732) 2025-09-10 12:15:47 +08:00
admin.py refactor: Migrate part of the console basic API module to Flask-RESTX (#24732) 2025-09-10 12:15:47 +08:00
apikey.py update sql in batch (#24801) 2025-09-10 13:00:17 +08:00
error.py Restructure the File errors in controller (#23801) 2025-08-13 17:06:07 +08:00
extension.py refactor: Migrate part of the console basic API module to Flask-RESTX (#24732) 2025-09-10 12:15:47 +08:00
feature.py refactor: Migrate part of the console basic API module to Flask-RESTX (#24732) 2025-09-10 12:15:47 +08:00
files.py Fix basedpyright type errors (#25435) 2025-09-10 01:54:26 +08:00
init_validate.py refactor: Migrate part of the console basic API module to Flask-RESTX (#24732) 2025-09-10 12:15:47 +08:00
ping.py refactor: Migrate part of the console basic API module to Flask-RESTX (#24732) 2025-09-10 12:15:47 +08:00
remote_files.py try flask_restful -> flask_restx (#24310) 2025-08-24 13:45:47 +08:00
setup.py refactor: Migrate part of the console basic API module to Flask-RESTX (#24732) 2025-09-10 12:15:47 +08:00
version.py refactor: Migrate part of the console basic API module to Flask-RESTX (#24732) 2025-09-10 12:15:47 +08:00
wraps.py Revert "feat: email register refactor" (#25367) 2025-09-08 19:20:09 +08:00