apunkt/SurfSense
1
0
Fork 0
mirror of https://github.com/MODSetter/SurfSense.git synced 2026-05-01 11:56:25 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Use RBAC for listing thread snapshots

Browse source
This commit is contained in:
CREDO23 2026-02-04 18:46:12 +02:00
parent fb371d09f5
commit ab3d99d9e0
2 changed files with 10 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

11
surfsense_backend/app/services/public_chat_service.py
View file

@ -366,10 +366,13 @@ async def list_snapshots_for_thread(
if not thread: if not thread:
raise HTTPException(status_code=404, detail="Thread not found") raise HTTPException(status_code=404, detail="Thread not found")
if thread.created_by_id != user.id: # Check permission to view public share links
raise HTTPException( await check_permission(
status_code=403, session,
detail="Only the creator can view snapshots", user,
thread.search_space_id,
Permission.PUBLIC_SHARING_VIEW.value,
"You don't have permission to view public share links",
) )
result = await session.execute( result = await session.execute(

4
surfsense_web/components/new-chat/chat-share-button.tsx
View file

@ -257,8 +257,8 @@ export function ChatShareButton({ thread, onVisibilityChange, className }: ChatS
</TooltipTrigger> </TooltipTrigger>
<TooltipContent> <TooltipContent>
{snapshotCount === 1 {snapshotCount === 1
? "This chat has a public link - Click to manage" ? "This chat has a public link"
: `This chat has ${snapshotCount} public links - Click to manage`} : `This chat has ${snapshotCount} public links`}
</TooltipContent> </TooltipContent>
</Tooltip> </Tooltip>
)} )}