倪程伟 bdda9c7357 perf(webchat): scope session listing to the visitor; cap upload disk use ... Two webchat hardening fixes: - Session listing no longer pulls every system-owned conversation into memory. listSessions/pageSessions went through listConversations(owner) whose `username IN (owner, system)` loaded all IM/cron rows just to show one visitor's handful of threads. New listWebchatConversations(username) queries only the visitor's own rows; the channel prefix is matched in-memory with a literal startsWith (so a '_'/'%' in the api key's first 8 chars can't act as a LIKE wildcard). - Upload now enforces a per-conversation quota (file count + total bytes, both configurable) so a visitor can't fill the disk with many individually-under-cap files. Pairs with the existing staging TTL sweep.		2026-06-17 23:21:08 +08:00
..
src	perf(webchat): scope session listing to the visitor; cap upload disk use	2026-06-17 23:21:08 +08:00
Dockerfile	fix(docker): honor SPRING_PROFILES_ACTIVE instead of pinning the mysql profile	2026-06-14 16:47:16 +08:00
pom.xml	fix(db): make KingbaseES driver opt-in and restore default SSRF guard	2026-06-14 10:34:35 +08:00
settings.xml	build(maven): declare US + CN repositories in pom.xml, drop opaque mirror	2026-04-25 09:56:17 +08:00