nickmopen e023c165b6 Fix(kb): enforce tenant authorization on UpdateMetadataSetting (#15268) (#15270) ...

## Summary

Closes #15268.

The `UpdateMetadataSetting` handler at `internal/handler/kb.go:126`
retrieved the authenticated user via `GetUser(c)` but discarded the user
object (`_, errorCode, errorMessage := GetUser(c)`), then forwarded the
caller-supplied `kb_id` straight to the service layer with no ownership
check. Any authenticated user could mutate the `parser_config` /
metadata of any knowledge base in the system by guessing or harvesting a
`kb_id` — a classic IDOR (CWE-284, OWASP A01).

This is the only handler in `internal/handler/kb.go` missing the check;
every sibling (`ListTags`, `ListTagsFromKbs`, `RenameTag`,
`KnowledgeGraph`, `DeleteKnowledgeGraph`, `GetMeta`, `GetBasicInfo`)
already calls `h.kbService.Accessible(kbID, user.ID)`. The same
defensive check on the document preview endpoint was added in PR #14625
— this PR closes the matching gap on the KB metadata endpoint.

---------

Co-authored-by: Jin Hai <haijin.chn@gmail.com>

2026-05-29 10:08:55 +08:00

..

admin

Go: add ingestion server (#15094)

2026-05-25 14:00:08 +08:00

binding

build(go): make bash build.sh work on macOS arm64 (Homebrew) (#15009)

2026-05-21 15:33:09 +08:00

cache

Go: move logger to common module (#14545)

2026-05-06 10:41:58 +08:00

cli

Implement Elasticsearch functions in GO (#15160)

2026-05-25 19:15:07 +08:00

common

Go: add ingestion server (#15094)

2026-05-25 14:00:08 +08:00

cpp

build(go): make bash build.sh work on macOS arm64 (Homebrew) (#15009)

2026-05-21 15:33:09 +08:00

dao

feat(go-api): implement GET /api/v1/agents list endpoint (issue #15328) (#15329)

2026-05-28 19:40:54 +08:00

engine

Implement Elasticsearch functions in GO (#15160)

2026-05-25 19:15:07 +08:00

entity

fix(go-models): harden ModelScope default transport handling (#15339)

2026-05-28 19:41:11 +08:00

handler

Fix(kb): enforce tenant authorization on UpdateMetadataSetting (#15268) (#15270)

2026-05-29 10:08:55 +08:00

ingestion

Go: add ingestion server (#15094)

2026-05-25 14:00:08 +08:00

proto

Go: add ingestion server (#15094)

2026-05-25 14:00:08 +08:00

router

feat(go-api): implement GET /api/v1/agents list endpoint (issue #15328) (#15329)

2026-05-28 19:40:54 +08:00

server

Go: add ingestion server (#15094)

2026-05-25 14:00:08 +08:00

service

Fix(kb): enforce tenant authorization on UpdateMetadataSetting (#15268) (#15270)

2026-05-29 10:08:55 +08:00

storage

Go: move logger to common module (#14545)

2026-05-06 10:41:58 +08:00

tokenizer

Go: move logger to common module (#14545)

2026-05-06 10:41:58 +08:00

utility

Go: move logger to common module (#14545)

2026-05-06 10:41:58 +08:00

development.md

Implement Elasticsearch functions in GO (#15160)

2026-05-25 19:15:07 +08:00