zlei6/ragflow
1
0
Fork 0
mirror of https://github.com/infiniflow/ragflow.git synced 2026-07-15 01:18:26 +08:00
Code Issues Packages Projects Releases Wiki Activity

Go and Python: fix IDOR issue of search completions (#16864)

Browse Source 
### Summary

In Go and python implementation, the dataset / KB id isn't validated if
it is accessible by this user.

---------

Signed-off-by: Jin Hai <haijin.chn@gmail.com>
This commit is contained in:
Jin Hai
2026-07-13 21:00:19 +08:00
committed by GitHub
parent 45862bf95d
commit 844e3ea64d
9 changed files with 63 additions and 42 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
internal/handler/search.go
View File

@@ -427,7 +427,7 @@ func (h *SearchHandler) Completion(c *gin.Context) {
adapter := &service.TenantStreamAdapter{LLM: h.streamLLM, TenantID: plan.UserID, ModelID: plan.ModelID}
hadError := false
for delta := range h.askService.StreamWithOptions(c.Request.Context(), adapter, plan.UserID, plan.Question, plan.KBIDs, plan.Options) {
for delta := range h.askService.StreamWithOptions(c.Request.Context(), adapter, plan.UserID, plan.Question, plan.DatasetIDs, plan.Options) {
switch delta.Kind {
case service.AskDeltaAnswer:
writer.Write(c, sseAnswer(delta.Value, nil, false))