fix: Prevent Authorization Bypass Through User-Controlled Key problem (CWE-639)

Author: ulleo

backend/apps/data_training/api/data_training.py

@@ -61,16 +61,18 @@ async def create_or_update(session: SessionDep, current_user: CurrentUser, trans
 @system_log(
     LogConfig(operation_type=OperationType.DELETE, module=OperationModules.DATA_TRAINING, resource_id_expr='id_list'))
 @require_permissions(permission=SqlbotPermission(role=['ws_admin']))
-async def delete(session: SessionDep, id_list: list[int]):
-    delete_training(session, id_list)
+async def delete(session: SessionDep, current_user: CurrentUser, id_list: list[int]):
+    oid = current_user.oid
+    delete_training(session, id_list, oid)
 
 
 @router.get("/{id}/enable/{enabled}", summary=f"{PLACEHOLDER_PREFIX}enable_dt")
 @system_log(
     LogConfig(operation_type=OperationType.UPDATE, module=OperationModules.DATA_TRAINING, resource_id_expr='id'))
 @require_permissions(permission=SqlbotPermission(role=['ws_admin']))
-async def enable(session: SessionDep, id: int, enabled: bool, trans: Trans):
-    enable_training(session, id, enabled, trans)
+async def enable(session: SessionDep, current_user: CurrentUser, id: int, enabled: bool, trans: Trans):
+    oid = current_user.oid
+    enable_training(session, id, enabled, trans, oid)
 
 
 @router.get("/export", summary=f"{PLACEHOLDER_PREFIX}export_dt")

backend/apps/data_training/curd/data_training.py

@@ -242,6 +242,7 @@ def update_training(session: SessionDep, info: DataTrainingInfo, oid: int, trans
         raise Exception(trans("i18n_data_training.datasource_assistant_cannot_be_none"))
 
     count = session.query(DataTraining).filter(
+        DataTraining.oid == oid,
         DataTraining.id == info.id
     ).count()
     if count == 0:
@@ -420,20 +421,21 @@ def batch_create_training(session: SessionDep, info_list: List[DataTrainingInfo]
     }
 
 
-def delete_training(session: SessionDep, ids: list[int]):
-    stmt = delete(DataTraining).where(and_(DataTraining.id.in_(ids)))
+def delete_training(session: SessionDep, ids: list[int], oid: int):
+    stmt = delete(DataTraining).where(and_(DataTraining.oid == oid, DataTraining.id.in_(ids)))
     session.execute(stmt)
     session.commit()
 
 
-def enable_training(session: SessionDep, id: int, enabled: bool, trans: Trans):
+def enable_training(session: SessionDep, id: int, enabled: bool, trans: Trans, oid: int):
     count = session.query(DataTraining).filter(
+        DataTraining.oid == oid,
         DataTraining.id == id
     ).count()
     if count == 0:
         raise Exception(trans('i18n_data_training.data_training_not_exists'))
 
-    stmt = update(DataTraining).where(and_(DataTraining.id == id)).values(
+    stmt = update(DataTraining).where(and_(DataTraining.oid == oid, DataTraining.id == id)).values(
         enabled=enabled,
     )
     session.execute(stmt)

backend/apps/terminology/api/terminology.py

@@ -57,15 +57,17 @@ async def create_or_update(session: SessionDep, current_user: CurrentUser, trans
 @router.delete("", summary=f"{PLACEHOLDER_PREFIX}delete_term")
 @system_log(LogConfig(operation_type=OperationType.DELETE, module=OperationModules.TERMINOLOGY,resource_id_expr='id_list'))
 @require_permissions(permission=SqlbotPermission(role=['ws_admin']))
-async def delete(session: SessionDep, id_list: list[int]):
-    delete_terminology(session, id_list)
+async def delete(session: SessionDep, current_user: CurrentUser, id_list: list[int]):
+    oid = current_user.oid
+    delete_terminology(session, id_list, oid)
 
 
 @router.get("/{id}/enable/{enabled}", summary=f"{PLACEHOLDER_PREFIX}enable_term")
 @system_log(LogConfig(operation_type=OperationType.UPDATE, module=OperationModules.TERMINOLOGY,resource_id_expr='id'))
 @require_permissions(permission=SqlbotPermission(role=['ws_admin']))
-async def enable(session: SessionDep, id: int, enabled: bool, trans: Trans):
-    enable_terminology(session, id, enabled, trans)
+async def enable(session: SessionDep, current_user: CurrentUser, id: int, enabled: bool, trans: Trans):
+    oid = current_user.oid
+    enable_terminology(session, id, enabled, trans, oid)
 
 
 @router.get("/export", summary=f"{PLACEHOLDER_PREFIX}export_term")

backend/apps/terminology/curd/terminology.py

@@ -716,20 +716,23 @@ def update_terminology(session: SessionDep, info: TerminologyInfo, oid: int, tra
     return info.id
 
 
-def delete_terminology(session: SessionDep, ids: list[int]):
-    stmt = delete(Terminology).where(or_(Terminology.id.in_(ids), Terminology.pid.in_(ids)))
+def delete_terminology(session: SessionDep, ids: list[int], oid: int):
+    stmt = delete(Terminology).where(
+        and_(Terminology.oid == oid, or_(Terminology.id.in_(ids), Terminology.pid.in_(ids))))
     session.execute(stmt)
     session.commit()
 
 
-def enable_terminology(session: SessionDep, id: int, enabled: bool, trans: Trans):
+def enable_terminology(session: SessionDep, id: int, enabled: bool, trans: Trans, oid: int):
     count = session.query(Terminology).filter(
-        Terminology.id == id
+        Terminology.id == id,
+        Terminology.oid == oid,
     ).count()
     if count == 0:
         raise Exception(trans('i18n_terminology.terminology_not_exists'))
 
-    stmt = update(Terminology).where(or_(Terminology.id == id, Terminology.pid == id)).values(
+    stmt = update(Terminology).where(
+        and_(Terminology.oid == oid, or_(Terminology.id == id, Terminology.pid == id))).values(
         enabled=enabled,
     )
     session.execute(stmt)