From 095511ed61a0025da97887920f300b7819c77d15 Mon Sep 17 00:00:00 2001 From: shaohuzhang1 Date: Sat, 10 Oct 2026 11:15:06 +0800 Subject: [PATCH] fix: enhance permission checks for application access in the API --- apps/oss/views/file.py | 37 ++++++++++++++++++++++++++++++++----- 1 file changed, 32 insertions(+), 5 deletions(-) diff --git a/apps/oss/views/file.py b/apps/oss/views/file.py index 7abe6e0a73e..aae7360b863 100644 --- a/apps/oss/views/file.py +++ b/apps/oss/views/file.py @@ -1,13 +1,19 @@ # coding=utf-8 - +from django.db.models import QuerySet from django.utils.translation import gettext_lazy as _ from drf_spectacular.utils import extend_schema from rest_framework.parsers import MultiPartParser from rest_framework.views import APIView, Request -from common.auth import TokenAuth, AllTokenAuth -from common.auth.authentication import has_permissions +from application.models import Application +from common.auth import TokenAuth, AllTokenAuth, ChatTokenAuth +from common.auth.authentication import has_permissions, get_is_permissions +from common.auth.constants.chat_permission_constants import ChatPermissionConstants +from common.auth.constants.compare_constants import CompareConstants +from common.auth.constants.permission_constants import PermissionConstants from common.auth.constants.role_constants import RoleConstants +from common.auth.struct.aggregate_permission import ViewPermission +from common.constants.authentication_type import UserType from common.exception.app_exception import AppUnauthorizedFailed from common.log.log import log from common.result import result @@ -107,8 +113,29 @@ class GetUrlView(APIView): tags=[_("Chat")], # type: ignore ) def get(self, request: Request, application_id: str): - if "application_id" in request.user.kwargs and str(request.user.kwargs.get("application_id")) != application_id: - return result.error(_("No permission")) + if isinstance(request.user.type, UserType): + application = QuerySet(Application).filter(id=application_id).first() + if application is None: + raise AppUnauthorizedFailed(403, _("No permission to access")) + is_permissions = get_is_permissions( + request, workspace_id=application.workspace_id, application_id=application_id + ) + if not is_permissions( + PermissionConstants.APPLICATION_READ.get_workspace_application_permission(), + PermissionConstants.APPLICATION_READ.get_workspace_permission_workspace_manage_role(), + ViewPermission( + [RoleConstants.USER.get_workspace_role()], + [PermissionConstants.APPLICATION.get_workspace_application_permission()], + compare=CompareConstants.AND, + ), + RoleConstants.WORKSPACE_MANAGE.get_workspace_role(), + ): + raise AppUnauthorizedFailed(403, _("No permission to access")) + else: + is_permissions = get_is_permissions(request, application_id=application_id) + if not is_permissions(ChatPermissionConstants.get_aggregate_permissions()): + raise AppUnauthorizedFailed(403, _("No permission to access")) + url = request.query_params.get("url") result_data = get_url_content(url, application_id) return result.success(result_data)