opensource
/
dify
mirror of https://github.com/langgenius/dify.git
2
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
dify/api/controllers/service_api
History
QuantumGhost 874406d934
security(api): fix privilege escalation vulnerability in model config and chat message APIs (#25518) 
The `ChatMessageApi` (`POST /console/api/apps/{app_id}/chat-messages`) and 
`ModelConfigResource` (`POST /console/api/apps/{app_id}/model-config`) 
endpoints do not properly validate user permissions, allowing users without `editor` 
permission to access restricted functionality.

This PR addresses this issue by adding proper permission check.
 		2025-09-11 14:53:35 +08:00
..
app security(api): fix privilege escalation vulnerability in model config and chat message APIs (#25518) 2025-09-11 14:53:35 +08:00
dataset security(api): fix privilege escalation vulnerability in model config and chat message APIs (#25518) 2025-09-11 14:53:35 +08:00
workspace add typing to all wraps (#25405) 2025-09-09 16:48:33 +08:00
__init__.py refactor: Migrate part of the console basic API module to Flask-RESTX (#24732) 2025-09-10 12:15:47 +08:00
index.py feat: API docs for service api (#24425) 2025-08-25 09:26:54 +08:00
wraps.py Fix basedpyright type errors (#25435) 2025-09-10 01:54:26 +08:00