From 94db78921dc16a3fc187e55504ad1d8f74ce4bc2 Mon Sep 17 00:00:00 2001 From: shaohuzhang1 Date: Mon, 31 Aug 2026 18:31:44 +0800 Subject: [PATCH] fix: The knowledge base migration did not verify the permissions of the target knowledge base --- apps/knowledge/views/document.py | 23 ++++++++++++++++++----- apps/knowledge/views/paragraph.py | 12 +++++++++++- 2 files changed, 29 insertions(+), 6 deletions(-) diff --git a/apps/knowledge/views/document.py b/apps/knowledge/views/document.py index 1984ed4b54a..495f5cf1806 100644 --- a/apps/knowledge/views/document.py +++ b/apps/knowledge/views/document.py @@ -1,6 +1,8 @@ from common.auth import TokenAuth -from common.auth.authentication import has_permissions -from common.constants.permission_constants import CompareConstants, PermissionConstants, RoleConstants, ViewPermission +from common.auth.authentication import has_permissions, get_is_permissions +from common.constants.permission_constants import CompareConstants, PermissionConstants, RoleConstants, ViewPermission, \ + Permission +from common.exception.app_exception import AppUnauthorizedFailed from common.log.log import log from common.result import result from django.utils.translation import gettext_lazy as _ @@ -243,9 +245,9 @@ def post(self, request: Request, workspace_id: str, knowledge_id: str): split_data = {"file": request.FILES.getlist("file")} request_data = request.data if ( - "patterns" in request.data - and request.data.get("patterns") is not None - and len(request.data.get("patterns")) > 0 + "patterns" in request.data + and request.data.get("patterns") is not None + and len(request.data.get("patterns")) > 0 ): split_data.__setitem__("patterns", request_data.getlist("patterns")) if "limit" in request.data: @@ -1175,6 +1177,17 @@ class Migrate(APIView): ), ) def put(self, request: Request, workspace_id, knowledge_id: str, target_knowledge_id: str): + is_permissions = get_is_permissions(request, workspace_id=workspace_id, knowledge_id=target_knowledge_id) + if not is_permissions(PermissionConstants.KNOWLEDGE_DOCUMENT_CREATE.get_workspace_knowledge_permission(), + PermissionConstants.KNOWLEDGE_DOCUMENT_CREATE.get_workspace_permission_workspace_manage_role(), + RoleConstants.WORKSPACE_MANAGE.get_workspace_role(), + ViewPermission( + [RoleConstants.USER.get_workspace_role()], + [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()], + CompareConstants.AND, + )): + raise AppUnauthorizedFailed(403, _('No permission to access')) + return result.success( DocumentSerializers.Migrate( data={ diff --git a/apps/knowledge/views/paragraph.py b/apps/knowledge/views/paragraph.py index ada0883e300..6fad47bb8b1 100644 --- a/apps/knowledge/views/paragraph.py +++ b/apps/knowledge/views/paragraph.py @@ -4,8 +4,9 @@ from rest_framework.views import Request from common.auth import TokenAuth -from common.auth.authentication import has_permissions +from common.auth.authentication import has_permissions, get_is_permissions from common.constants.permission_constants import PermissionConstants, RoleConstants, ViewPermission, CompareConstants +from common.exception.app_exception import AppUnauthorizedFailed from common.log.log import log from common.result import result from common.utils.common import query_params_to_single_dict @@ -125,6 +126,15 @@ class BatchMigrate(APIView): ) def put(self, request: Request, workspace_id: str, knowledge_id: str, document_id: str, target_knowledge_id: str, target_document_id): + is_permissions = get_is_permissions(request, workspace_id=workspace_id, knowledge_id=target_knowledge_id) + if not is_permissions(PermissionConstants.KNOWLEDGE_DOCUMENT_EDIT.get_workspace_knowledge_permission(), + PermissionConstants.KNOWLEDGE_DOCUMENT_EDIT.get_workspace_permission_workspace_manage_role(), + RoleConstants.WORKSPACE_MANAGE.get_workspace_role(), + ViewPermission([RoleConstants.USER.get_workspace_role()], + [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()], + CompareConstants.AND), + ): + raise AppUnauthorizedFailed(403, _('No permission to access')) return result.success( ParagraphSerializers.Migrate(data={ 'workspace_id': workspace_id,