Skip to content

fix: require auth and tenant check on /thumbnails endpoint (CWE-287) #14800

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
sebastiondev wants to merge 2 commits into from
+10 −1
Closed

fix: require auth and tenant check on /thumbnails endpoint (CWE-287) #14800

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
bfe9763
fix: protect document thumbnails endpoint
sebastiondev Apr 28, 2026
8e1b559
address review: log authorization denial on thumbnails endpoint
sebastiondev May 11, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 10 additions & 1 deletion api/apps/restful_apis/document_api.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,7 @@
from peewee import OperationalError
from pydantic import ValidationError

from api.apps import login_required
from api.apps import current_user, login_required
from api.constants import FILE_NAME_LEN_LIMIT, IMG_BASE64_PREFIX
from api.apps.services.document_api_service import validate_document_update_fields, map_doc_keys, \
map_doc_keys_with_run_status, update_document_name_only, update_chunk_method, update_document_status_only, \
Expand Down Expand Up @@ -1180,6 +1180,7 @@ async def update_metadata_config(tenant_id, dataset_id, document_id):


@manager.route("/thumbnails", methods=["GET"]) # noqa: F821
@login_required
def list_thumbnails():
"""
Get thumbnails for documents.
Expand All @@ -1205,6 +1206,14 @@ def list_thumbnails():
if not doc_ids:
return get_json_result(data=False, message='Lack of "Document ID"', code=RetCode.ARGUMENT_ERROR)

for doc_id in doc_ids:
if not DocumentService.accessible(doc_id, current_user.id):
logging.warning(
"thumbnail access denied: user_id=%s doc_id=%s path=%s",
current_user.id, doc_id, request.path,
)
return get_json_result(data=False, message="No authorization.", code=RetCode.AUTHENTICATION_ERROR)
Comment thread
coderabbitai[bot] marked this conversation as resolved.

try:
docs = DocumentService.get_thumbnails(doc_ids)

Expand Down
Loading