QuantumGhost
							
						 
						
							
								874406d934
								
									
										
											 
										
									
								
							 
						 
						
							
									security(api): fix privilege escalation vulnerability in model config and chat message APIs (#25518) 
							 
							
							 
							
							
							
							
The `ChatMessageApi` (`POST /console/api/apps/{app_id}/chat-messages`) and 
`ModelConfigResource` (`POST /console/api/apps/{app_id}/model-config`) 
endpoints do not properly validate user permissions, allowing users without `editor` 
permission to access restricted functionality.
This PR addresses this issue by adding proper permission check. 
							
						 
						1 个月前  
					 
				
					
						
							
								   Asuka Minato
							
						 
						
							
								18dce66443
								
									
										
											 
										
									
								
							 
						 
						
							
									try flask_restful -> flask_restx (#24310) 
							 
							
							 
							
							
							
							
Signed-off-by: -LAN- <laipz8200@outlook.com>
Co-authored-by: -LAN- <laipz8200@outlook.com> 
							
						 
						2 个月前  
					 
				
					
						
							
								   Asuka Minato
							
						 
						
							
								ef51678c73
								
									
										
											 
										
									
								
							 
						 
						
							
									orm filter -> where (#22801) 
							 
							
							 
							
							
							
							
Signed-off-by: -LAN- <laipz8200@outlook.com>
Co-authored-by: -LAN- <laipz8200@outlook.com>
Co-authored-by: Claude <noreply@anthropic.com> 
							
						 
						3 个月前  
					 
				
					
						
							
								   Bowen Liang
							
						 
						
							
								8537abfff8
								
									
										
											 
										
									
								
							 
						 
						
							
									chore: avoid repeated type ignore noqa by adding flask_restful and flask_login in mypy import exclusions (#19224) 
							 
							
							
							
						 
						6 个月前  
					 
				
					
						
							
								   yihong
							
						 
						
							
								56e15d09a9
								
									
										
											 
										
									
								
							 
						 
						
							
									feat: mypy for all type check (#10921) 
							 
							
							
							
						 
						10 个月前  
					 
				
					
						
							
								   -LAN-
							
						 
						
							
								259cff9f22
								
									
										
											 
										
									
								
							 
						 
						
							
									fix(api/ops_trace): avoid raise exception directly (#11732) 
							 
							
							 
							
							
							
							
Signed-off-by: -LAN- <laipz8200@outlook.com> 
							
						 
						10 个月前  
					 
				
					
						
							
								   -LAN-
							
						 
						
							
								9ac2bb30f4
								
									
										
											 
										
									
								
							 
						 
						
							
									Feat/add-remote-file-upload-api (#9906) 
							 
							
							
							
						 
						1年前  
					 
				
					
						
							
								   kurokobo
							
						 
						
							
								bc3a8e0ca2
								
									
										
											 
										
									
								
							 
						 
						
							
									feat: store created_by and updated_by for apps, modelconfigs, and sites (#7613) 
							 
							
							
							
						 
						1年前  
					 
				
					
						
							
								   -LAN-
							
						 
						
							
								13be84e4d4
								
									
										
											 
										
									
								
							 
						 
						
							
									chore(api/controllers): Apply Ruff Formatter. (#7645) 
							 
							
							
							
						 
						1年前  
					 
				
					
						
							
								   Yeuoly
							
						 
						
							
								023dba9475
								
									
										
											 
										
									
								
							 
						 
						
							
									fix: revert CI path filters (#5561) 
							 
							
							
							
						 
						1年前  
					 
				
					
						
							
								   Yeuoly
							
						 
						
							
								3480f1c59e
								
									
										
											 
										
									
								
							 
						 
						
							
									refactor: tool parameter cache (#3703) 
							 
							
							
							
						 
						1年前  
					 
				
					
						
							
								   takatost
							
						 
						
							
								7753ba2d37
								
									
										
											 
										
									
								
							 
						 
						
							
									FEAT: NEW WORKFLOW ENGINE (#3160) 
							 
							
							 
							
							
							
							
Co-authored-by: Joel <iamjoel007@gmail.com>
Co-authored-by: Yeuoly <admin@srmxy.cn>
Co-authored-by: JzoNg <jzongcode@gmail.com>
Co-authored-by: StyleZhang <jasonapring2015@outlook.com>
Co-authored-by: jyong <jyong@dify.ai>
Co-authored-by: nite-knite <nkCoding@gmail.com>
Co-authored-by: jyong <718720800@qq.com> 
							
						 
						1年前  
					 
				
					
						
							
								   Yeuoly
							
						 
						
							
								f29280ba5c
								
									
										
											 
										
									
								
							 
						 
						
							
									Fix/compatible to old tool config (#2839) 
							 
							
							
							
						 
						1年前  
					 
				
					
						
							
								   Yeuoly
							
						 
						
							
								f8951d7f57
								
									
										
											 
										
									
								
							 
						 
						
							
									fix: api tool provider not found (#2782) 
							 
							
							
							
						 
						1年前  
					 
				
					
						
							
								   Yeuoly
							
						 
						
							
								ce58f0607b
								
									
										
											 
										
									
								
							 
						 
						
							
									Feat/tool secret parameter (#2760) 
							 
							
							
							
						 
						1年前  
					 
				
					
						
							
								   Bowen Liang
							
						 
						
							
								063191889d
								
									
										
											 
										
									
								
							 
						 
						
							
									chore: apply ruff's pyupgrade linter rules to modernize Python code with targeted version (#2419) 
							 
							
							
							
						 
						1年前  
					 
				
					
						
							
								   Bowen Liang
							
						 
						
							
								843280f82b
								
									
										
											 
										
									
								
							 
						 
						
							
									enhancement: introduce Ruff for Python linter for reordering and removing unused imports with automated pre-commit and sytle check (#2366) 
							 
							
							
							
						 
						1年前  
					 
				
					
						
							
								   Bowen Liang
							
						 
						
							
								cc9e74123c
								
									
										
											 
										
									
								
							 
						 
						
							
									improve: introduce isort for linting Python imports (#1983) 
							 
							
							
							
						 
						1年前  
					 
				
					
						
							
								   takatost
							
						 
						
							
								d069c668f8
								
									
										
											 
										
									
								
							 
						 
						
							
									Model Runtime (#1858) 
							 
							
							 
							
							
							
							
Co-authored-by: StyleZhang <jasonapring2015@outlook.com>
Co-authored-by: Garfield Dai <dai.hai@foxmail.com>
Co-authored-by: chenhe <guchenhe@gmail.com>
Co-authored-by: jyong <jyong@dify.ai>
Co-authored-by: Joel <iamjoel007@gmail.com>
Co-authored-by: Yeuoly <admin@srmxy.cn> 
							
						 
						1年前  
					 
				
					
						
							
								   Jyong
							
						 
						
							
								a71f2863ac
								
									
										
											 
										
									
								
							 
						 
						
							
									Annotation management (#1767) 
							 
							
							 
							
							
							
							
Co-authored-by: jyong <jyong@dify.ai> 
							
						 
						1年前  
					 
				
					
						
							
								   takatost
							
						 
						
							
								024250803a
								
									
										
											 
										
									
								
							 
						 
						
							
									feat: move login_required wrapper outside (#1281) 
							 
							
							
							
						 
						2 年前  
					 
				
					
						
							
								   Garfield Dai
							
						 
						
							
								18c710c906
								
									
										
											 
										
									
								
							 
						 
						
							
									feat: support binding context var (#1227) 
							 
							
							 
							
							
							
							
Co-authored-by: Joel <iamjoel007@gmail.com> 
							
						 
						2 年前  
					 
				
					
						
							
								   Jyong
							
						 
						
							
								4b53bb1a32
								
									
										
											 
										
									
								
							 
						 
						
							
									Feat/token support (#909) 
							 
							
							 
							
							
							
							
Co-authored-by: StyleZhang <jasonapring2015@outlook.com>
Co-authored-by: jyong <jyong@dify.ai> 
							
						 
						2 年前  
					 
				
					
						
							
								   takatost
							
						 
						
							
								cc2d71c253
								
									
										
											 
										
									
								
							 
						 
						
							
									feat: optimize override app model config convert (#874) 
							 
							
							
							
						 
						2 年前  
					 
				
					
						
							
								   takatost
							
						 
						
							
								5fa2161b05
								
									
										
											 
										
									
								
							 
						 
						
							
									feat: server multi models support (#799) 
							 
							
							
							
						 
						2 年前  
					 
				
					
						
							
								   John Wang
							
						 
						
							
								4fdb37771a
								
									
										
											 
										
									
								
							 
						 
						
							
									feat: universal chat in explore (#649) 
							 
							
							 
							
							
							
							
Co-authored-by: StyleZhang <jasonapring2015@outlook.com> 
							
						 
						2 年前  
					 
				
					
						
							
								   zxhlyh
							
						 
						
							
								a03a92e9db
								
									
										
											 
										
									
								
							 
						 
						
							
									Feat/chat support voice input (#532) 
							 
							
							
							
						 
						2 年前  
					 
				
					
						
							
								   John Wang
							
						 
						
							
								db896255d6
								
							 
						 
						
							
									Initial commit 
							 
							
							
							
						 
						2 年前