zlei6/ragflow
1
0
Fork 0
mirror of https://github.com/infiniflow/ragflow.git synced 2026-08-14 12:47:14 +08:00
Code Issues Packages Projects Releases Wiki Activity

Fix: exclude unauthorized memory/dataset from list results (#18006)

Browse Source
This commit is contained in:
Lynn
2026-08-10 10:16:56 +08:00
committed by GitHub
parent 99110c2df0
commit 7433fbb77b
4 changed files with 24 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
api/apps/services/dataset_api_service.py
View File

@@ -452,9 +452,12 @@ def list_datasets(tenant_id: str, args: dict):
query_user_id = tenant_id
if kb_ids:
accessible_ids = KnowledgebaseService.get_accessible_ids([m["tenant_id"] for m in tenants], tenant_id, kb_ids)
if len(accessible_ids) != len(kb_ids):
denied_ids = [kb_id for kb_id in kb_ids if kb_id not in accessible_ids]
return False, f"""User '{tenant_id}' lacks permission for datasets: '{", ".join(denied_ids)}'"""
denied_ids = [kb_id for kb_id in kb_ids if kb_id not in accessible_ids]
if denied_ids:
logging.warning("User '%s' lacks permission for datasets: '%s'", tenant_id, ", ".join(denied_ids))
kb_ids = [kb_id for kb_id in kb_ids if kb_id in accessible_ids]
if not kb_ids:
return True, {"data": [], "total": 0}
kbs, total = KnowledgebaseService.get_list(tenant_ids, query_user_id, page, page_size, orderby, desc, kb_id, name, keywords, parser_id, kb_ids)
users = UserService.get_by_ids([m["tenant_id"] for m in kbs])
user_map = {m.id: m.to_dict() for m in users}