apunkt/SurfSense
1
0
Fork 0
mirror of https://github.com/MODSetter/SurfSense.git synced 2026-06-18 21:15:16 +02:00
Code Issues Projects Releases Packages Wiki Activity
SurfSense/surfsense_backend/app/routes
History
Dmitry Maranik e1ea82d7cf fix(connectors): scope index endpoint authorization to the connector's own search space 
The POST /search-source-connectors/{connector_id}/index endpoint loaded
the connector by id and then called check_permission() against the
client-supplied search_space_id query parameter (the caller's own space)
rather than the connector's own search_space_id, and never verified that
the two matched.

A user could therefore index another user's connector by passing their
own search_space_id: the indexer ran with the victim connector's stored
credentials and wrote the fetched content into the attacker's search
space. The read/update/delete handlers already authorize against
connector.search_space_id; this brings the index handler in line.

Reject a connector that does not belong to the requested search space
(404, to avoid disclosing connectors in other spaces) and authorize the
permission check against connector.search_space_id.
2026-06-16 15:58:30 -07:00
..
__init__.py refactor(config): update GATEWAY_ENABLED variable to FALSE and adjust related configurations for improved messaging gateway handling 2026-06-16 23:49:26 +05:30
agent_action_log_route.py refactor(agents): introduce chat/ category; dissolve top-level agents/shared 2026-06-05 12:54:02 +02:00
agent_flags_route.py refactor(agents): introduce chat/ category; dissolve top-level agents/shared 2026-06-05 12:54:02 +02:00
agent_permissions_route.py refactor(agents): introduce chat/ category; dissolve top-level agents/shared 2026-06-05 12:54:02 +02:00
agent_revert_route.py refactor(agents): introduce chat/ category; dissolve top-level agents/shared 2026-06-05 12:54:02 +02:00
airtable_add_connector_route.py set is_indexable=False for all live connector add routes 2026-04-21 21:52:43 +02:00
anonymous_chat_routes.py refactor(anonymous-models): remove description field from anonymous model responses and update related UI components 2026-06-13 16:30:26 +05:30
auth_routes.py Add logout with token revocation and loading states 2026-02-05 18:56:38 +02:00
chat_comments_routes.py feat: perf optimizations 2026-02-27 17:19:25 -08:00
circleback_webhook_route.py feat: add connector_id to documents for source tracking and implement connector deletion task 2026-02-02 16:23:26 +05:30
clickup_add_connector_route.py set is_indexable=False for all live connector add routes 2026-04-21 21:52:43 +02:00
composio_routes.py fix: fixed composio issues 2026-05-02 21:16:03 -07:00
confluence_add_connector_route.py feat: initial files for jira and confluence HITL tool 2026-03-21 12:16:44 +05:30
discord_add_connector_route.py set is_indexable=False for all live connector add routes 2026-04-21 21:52:43 +02:00
documents_routes.py refactor(chunks): order chunk reads by (document_id, position) 2026-06-12 18:53:21 +02:00
dropbox_add_connector_route.py feat: implement cursor-based delta sync for Dropbox integration, enhancing file indexing efficiency and preserving folder cursors during re-authentication 2026-04-06 18:36:29 +05:30
editor_routes.py refactor(chunks): order chunk reads by (document_id, position) 2026-06-12 18:53:21 +02:00
export_routes.py feat: added ai file sorting 2026-04-14 01:43:30 -07:00
folders_routes.py fix(documents): use ORM objects in bulk_move so session hooks fire 2026-05-29 22:25:04 +02:00
gateway_webhook_routes.py refactor(config): update GATEWAY_ENABLED variable to FALSE and adjust related configurations for improved messaging gateway handling 2026-06-16 23:49:26 +05:30
gateway_whatsapp_baileys_routes.py chore: linting 2026-06-09 00:42:26 -07:00
gateway_whatsapp_webhook_routes.py chore: linting 2026-06-09 00:42:26 -07:00
google_calendar_add_connector_route.py set is_indexable=False for all live connector add routes 2026-04-21 21:52:43 +02:00
google_drive_add_connector_route.py chore: ran linting 2026-04-04 03:37:33 +05:30
google_gmail_add_connector_route.py set is_indexable=False for all live connector add routes 2026-04-21 21:52:43 +02:00
image_generation_routes.py chore: ran linting 2026-06-13 21:59:35 +05:30
incentive_tasks_routes.py feat(refactor): refactor payment system to implement unified credit wallet. 2026-06-10 16:49:03 -07:00
jira_add_connector_route.py set is_indexable=False for all live connector add routes 2026-04-21 21:52:43 +02:00
linear_add_connector_route.py set is_indexable=False for all live connector add routes 2026-04-21 21:52:43 +02:00
logs_routes.py feat: Enhance connector management UI with improved loading states, add document count display for connectors, and implement indexing progress indicators for better user feedback. 2025-12-31 17:21:26 +05:30
luma_add_connector_route.py set is_indexable=False for all live connector add routes 2026-04-21 21:52:43 +02:00
mcp_oauth_route.py refactor(agents): introduce chat/ category; dissolve top-level agents/shared 2026-06-05 12:54:02 +02:00
memory_routes.py feat: enhance memory API responses with limits and update UI components for memory limit handling 2026-05-20 03:17:05 +05:30
model_connections_routes.py refactor(model-connections): remove unused fields and update verification logic 2026-06-14 02:46:19 +05:30
model_list_routes.py style: simplify LLM model terminology in UI 2026-04-02 10:11:35 +05:30
new_chat_routes.py refactor(model-connections): move backend model connections to provider capabilities 2026-06-12 02:17:22 +05:30
notes_routes.py feat: add source_markdown column to documents and implement migration logic for existing records using a pure-Python BlockNote JSON to Markdown converter 2026-02-17 11:34:11 +05:30
notion_add_connector_route.py chore: ran linting 2026-03-21 13:21:19 +05:30
oauth_connector_base.py chore: linting 2026-04-27 14:04:50 -07:00
obsidian_plugin_routes.py chore: linting 2026-06-09 00:42:26 -07:00
onedrive_add_connector_route.py chore: ran linting 2026-03-30 01:50:41 +05:30
prompts_routes.py Fix review issues: authz, race conditions, UX safety, and consolidate migrations 2026-03-31 19:09:05 +02:00
public_chat_routes.py refactor(podcasts): stream public podcast audio via storage backend 2026-06-10 21:44:57 +02:00
rbac_routes.py rbac: surface automations permissions in the UI 2026-05-28 00:30:40 +02:00
reports_routes.py feat: add PDF preview and export functionality for Typst-based reports, enhance report content handling 2026-04-15 21:11:27 +05:30
sandbox_routes.py refactor(agents): sink sandbox.py into filesystem subsystem 2026-06-05 13:15:57 +02:00
search_source_connectors_routes.py fix(connectors): scope index endpoint authorization to the connector's own search space 2026-06-16 15:58:30 -07:00
search_spaces_routes.py feat(database-migrations): add migration to remove legacy model config tables and remove stale model connection code 2026-06-13 12:45:43 +05:30
slack_add_connector_route.py set is_indexable=False for all live connector add routes 2026-04-21 21:52:43 +02:00
stripe_routes.py feat: update auto-reload settings and enhance payment session creation 2026-06-11 13:29:40 -07:00
team_memory_routes.py feat: enhance memory API responses with limits and update UI components for memory limit handling 2026-05-20 03:17:05 +05:30
teams_add_connector_route.py set is_indexable=False for all live connector add routes 2026-04-21 21:52:43 +02:00
video_presentations_routes.py feat: init video presentation agent 2026-03-21 22:13:41 -07:00
youtube_routes.py feat(proxy): integrate Scrapling for enhanced web scraping capabilities 2026-06-09 00:15:10 -07:00