zlei6/ragflow
1
0
Fork 0
mirror of https://github.com/infiniflow/ragflow.git synced 2026-08-14 20:54:30 +08:00
Code Issues Packages Projects Releases Wiki Activity

Fix: exclude unauthorized memory/dataset from list results (#18006)

Browse Source
This commit is contained in:
Lynn
2026-08-10 10:16:56 +08:00
committed by GitHub
parent 99110c2df0
commit 7433fbb77b
4 changed files with 24 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
api/apps/services/dataset_api_service.py
View File

@@ -452,9 +452,12 @@ def list_datasets(tenant_id: str, args: dict):
query_user_id = tenant_id
if kb_ids:
accessible_ids = KnowledgebaseService.get_accessible_ids([m["tenant_id"] for m in tenants], tenant_id, kb_ids)
if len(accessible_ids) != len(kb_ids):
denied_ids = [kb_id for kb_id in kb_ids if kb_id not in accessible_ids]
return False, f"""User '{tenant_id}' lacks permission for datasets: '{", ".join(denied_ids)}'"""
denied_ids = [kb_id for kb_id in kb_ids if kb_id not in accessible_ids]
if denied_ids:
logging.warning("User '%s' lacks permission for datasets: '%s'", tenant_id, ", ".join(denied_ids))
kb_ids = [kb_id for kb_id in kb_ids if kb_id in accessible_ids]
if not kb_ids:
return True, {"data": [], "total": 0}
kbs, total = KnowledgebaseService.get_list(tenant_ids, query_user_id, page, page_size, orderby, desc, kb_id, name, keywords, parser_id, kb_ids)
users = UserService.get_by_ids([m["tenant_id"] for m in kbs])
user_map = {m.id: m.to_dict() for m in users}

15
api/apps/services/memory_api_service.py
View File

@@ -13,6 +13,8 @@
# See the License for the specific language governing permissions and
# limitations under the License.
#
import logging
from api.apps import current_user
from api.db import TenantPermission
from api.db.services.memory_service import MemoryService
@@ -251,6 +253,7 @@ async def list_memory(filter_params: dict, keywords: str, page: int = 1, page_si
:param filter_params: {
"memory_type": list[str],
"tenant_id": list[str],
"ids": list[str],
"storage_type": str
}
:param keywords: str
@@ -259,6 +262,18 @@ async def list_memory(filter_params: dict, keywords: str, page: int = 1, page_si
"""
filter_dict: dict = {"storage_type": filter_params.get("storage_type"), "accessible_user_id": current_user.id}
allowed_tenant_ids = _joined_tenant_ids(current_user.id)
memory_ids = _split_filter_values(filter_params.get("ids"))
if memory_ids:
accessible_memories = _filter_accessible_memories(memory_ids)
accessible_memory_ids = [m.id for m in accessible_memories]
denied_ids = [mid for mid in memory_ids if mid not in accessible_memory_ids]
if denied_ids:
logging.warning("User '%s' lacks permission for memories: '%s'", current_user.id, ", ".join(denied_ids))
filter_dict["ids"] = accessible_memory_ids
if not accessible_memory_ids:
return {"memory_list": [], "total_count": 0}
tenant_ids = _split_filter_values(filter_params.get("tenant_id") or filter_params.get("owner_ids"))
if tenant_ids:
filter_dict["tenant_id"] = [tenant_id for tenant_id in tenant_ids if tenant_id in allowed_tenant_ids]