txai-dev/yu-zhi-ran
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: API route security fixes (path traversal, auth, bare except)

Browse Source 
- articles.py: Path traversal sanitization
- optimizer_logs.py: Admin auth guard
- platform_config.py: Admin auth guard
- system.py: Path traversal whitelist
- topic_config.py: Admin auth guard
- topics.py: Minor fix

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
This commit is contained in:
Yuzhiran Dev
2026-06-16 08:23:50 +08:00
parent 8595bbc521
commit d601a26850
6 changed files with 33 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files
platform/backend/app/api/topic_config.py
+10 -10
View File
@@ -9,7 +9,7 @@ from ..schemas import (
TopicFieldBase, TopicFieldResponse,
TopicConfigFieldBase, TopicConfigFieldResponse
)
from .auth import get_current_user
from .auth import get_current_admin
router = APIRouter(prefix="/api/topic-config", tags=["topic-config"])
@@ -18,7 +18,7 @@ router = APIRouter(prefix="/api/topic-config", tags=["topic-config"])
def list_fields(
include_inactive: bool = False,
db: Session = Depends(get_db),
current_user=Depends(get_current_user)
current_user=Depends(get_current_admin)
):
query = db.query(TopicField)
if not include_inactive:
@@ -30,7 +30,7 @@ def list_fields(
def create_field(
data: TopicFieldBase,
db: Session = Depends(get_db),
current_user=Depends(get_current_user)
current_user=Depends(get_current_admin)
):
existing = db.query(TopicField).filter(TopicField.name == data.name).first()
if existing:
@@ -47,7 +47,7 @@ def update_field(
field_id: int,
data: TopicFieldBase,
db: Session = Depends(get_db),
current_user=Depends(get_current_user)
current_user=Depends(get_current_admin)
):
field = db.query(TopicField).filter(TopicField.id == field_id).first()
if not field:
@@ -63,7 +63,7 @@ def update_field(
def delete_field(
field_id: int,
db: Session = Depends(get_db),
current_user=Depends(get_current_user)
current_user=Depends(get_current_admin)
):
field = db.query(TopicField).filter(TopicField.id == field_id).first()
if not field:
@@ -77,7 +77,7 @@ def delete_field(
def get_scoring_fields(
field_id: int,
db: Session = Depends(get_db),
current_user=Depends(get_current_user)
current_user=Depends(get_current_admin)
):
field = db.query(TopicField).filter(TopicField.id == field_id).first()
if not field:
@@ -92,7 +92,7 @@ def create_scoring_field(
field_id: int,
data: TopicConfigFieldBase,
db: Session = Depends(get_db),
current_user=Depends(get_current_user)
current_user=Depends(get_current_admin)
):
field = db.query(TopicField).filter(TopicField.id == field_id).first()
if not field:
@@ -117,7 +117,7 @@ def update_scoring_field(
config_id: int,
data: TopicConfigFieldBase,
db: Session = Depends(get_db),
current_user=Depends(get_current_user)
current_user=Depends(get_current_admin)
):
cfg = db.query(TopicConfigField).filter(TopicConfigField.id == config_id).first()
if not cfg:
@@ -133,7 +133,7 @@ def update_scoring_field(
def delete_scoring_field(
config_id: int,
db: Session = Depends(get_db),
current_user=Depends(get_current_user)
current_user=Depends(get_current_admin)
):
cfg = db.query(TopicConfigField).filter(TopicConfigField.id == config_id).first()
if not cfg:
@@ -148,7 +148,7 @@ def batch_create_scoring_fields(
field_id: int,
fields: List[TopicConfigFieldBase],
db: Session = Depends(get_db),
current_user=Depends(get_current_user)
current_user=Depends(get_current_admin)
):
field = db.query(TopicField).filter(TopicField.id == field_id).first()
if not field: