Fix: private dataset authorization bypass in shared dataset access checks#14645

Merged

KevinHuSh merged 37 commits into

infiniflow:mainfrom

jony376:fix/private-datasets-remain-accessible-to-tenant-members

May 9, 2026

Commits on May 7, 2026

fix private dataset accessible issue
jony376
committed

Commits on May 8, 2026

Fix lint
wangq8
authored
fix: prepend bucket prefix to Azure SPN and SAS storage paths (#14185)

authored and
jony376
committed
Feat: support local provider for code exec component & remove some outdated models (#14637)

Magicbook1108
authored and
jony376
committed
Fix: Change route name (#14639)

dcc123456
authored and
jony376
committed
Perf: push metadata filters down to Elasticsearch (#14576)

sxxtony
authored and
jony376
committed
feat: update Turkish localization strings (#14650)

bakiburakogun
authored and
jony376
committed
fix(go): wire CheckConnection to ListModels in ollama, lm-studio, and vllm (#14614)

pandadev66
authored and
jony376
committed
Go: implement Balance in SiliconFlow driver (#14643)

pandadev66
authored and
jony376
committed
Go: implement provider: OpenRouter (#14652)

Haruko386
authored and
jony376
committed
Go: implement Balance in DeepSeek driver (#14632)

pandadev66
authored and
jony376
committed
fix(go): implement ListModels and CheckConnection in NVIDIA driver (#14636)

pandadev66
authored and
jony376
committed
fix: add bucket prefix to Azure Blob SPN and SAS storage operations (#14347)

authored and
jony376
committed
Go: implement Rerank in Gitee AI driver (#14656)

pandadev66
authored and
jony376
committed
Fix: display error (#14654)

Lynn-Inf
authored and
jony376
committed
Refa: migrate document preview/download to RESTful API (#14633)

buua436
authored and
jony376
committed
Fix: missing authorization checks in `/files/link-to-datasets` (#14649)

jony376
and
jony376
committed
Fix cli login (#14658)

JinHai-CN
authored and
jony376
committed
Go: implement remaining interface for OpenRouter (#14657)

Haruko386
authored and
jony376
committed
Go: implement Encode (embeddings) in Aliyun driver (#14647)

authored and
jony376
committed
Fix: enforce tenant authorization on document download endpoint (#14618) (#14625)

web-dev0521
authored and
jony376
committed
Fix: collapsible thinking display and separate deep research retrieval tag (#14613)

authored and
jony376
committed
Fix: add compatibility route for document download under /v1 (#14663)

buua436
authored and
jony376
committed
Fix: path-aware reset in canvas.run() to preserve cross-run outputs (#14600)

authored and
jony376
committed
Fix: type of tenant_rerank_id (#14667)

Lynn-Inf
authored and
jony376
committed
Go CLI: fix register user (#14665)

JinHai-CN
authored and
jony376
committed
Fix(Go): prevent global state pollution in local model connection check (#14669)

Haruko386
authored and
jony376
committed
Go: fix CLI logout command (#14672)

JinHai-CN
authored and
jony376
committed
Fix: handle null document_metadata in kb_prompt to prevent citation crash (#14651) (#14666)

web-dev0521
authored and
jony376
committed
Do not bypass threshold for rerank when metadata filter is enabled (#14684)

qinling0210
authored and
jony376
committed
Fix: move file check (#14681)

Lynn-Inf
authored and
jony376
committed
fix: enforce tenant-scoped authorization for chatbot SDK endpoints (#14592)

dale053
authored and
jony376
committed
Refactor : Allow search multiple datasets (#14685)

wangq8
authored and
jony376
committed
fix test failure issue
jony376
committed
Merge branch 'main' into fix/private-datasets-remain-accessible-to-tenant-members
jony376
committed
Merge branch 'main' into fix/private-datasets-remain-accessible-to-tenant-members
jony376
committed
Merge branch 'main' into fix/private-datasets-remain-accessible-to-tenant-members
jony376
committed