Yongteng Lei 2bf2abfdbc Fix: authorization bypass (IDOR) in /v1/document/web_crawl (#13203) ...

### What problem does this PR solve?

Fix authorization bypass (IDOR) in `/v1/document/web_crawl` allows
Cross-Tenant Dataset Modification.

### Type of change

- [x] Bug Fix (non-breaking change which fixes an issue)

2026-02-25 12:59:41 +08:00

..

auth

Refa: make RAGFlow more asynchronous (#11601)

2025-12-01 14:24:06 +08:00

restful_apis

Refactor: split message apis to gateway and service (#13126)

2026-02-12 14:43:52 +08:00

sdk

Fix: stored XSS via HTML File upload and inline Rendering in file get (#13202)

2026-02-25 09:46:48 +08:00

services

Refactor: split message apis to gateway and service (#13126)

2026-02-12 14:43:52 +08:00

__init__.py

Refactor: split memory API into gateway and service layers (#13111)

2026-02-12 10:11:50 +08:00

api_app.py

Refa: make RAGFlow more asynchronous (#11601)

2025-12-01 14:24:06 +08:00

canvas_app.py

Fix: Chat/Agent embedded page (#13199)

2026-02-24 19:14:24 +08:00

chunk_app.py

Put document metadata in ES/Infinity (#12826)

2026-01-28 13:29:34 +08:00

connector_app.py

Fix: pdf chunking / table rotation (#12981)

2026-02-04 17:00:25 +08:00

conversation_app.py

Fix: Chat/Agent embedded page (#13199)

2026-02-24 19:14:24 +08:00

dialog_app.py

Add dataset with table parser type for Infinity and answer question in chat using SQL (#12541)

2026-01-19 19:35:14 +08:00

document_app.py

Fix: authorization bypass (IDOR) in /v1/document/web_crawl (#13203)

2026-02-25 12:59:41 +08:00

evaluation_app.py

Feat: RAG evaluation (#11674)

2025-12-03 17:00:58 +08:00

file2document_app.py

Change knowledge base to dataset (#11976)

2025-12-17 10:03:33 +08:00

file_app.py

Fix: stored XSS via HTML File upload and inline Rendering in file get (#13202)

2026-02-25 09:46:48 +08:00

kb_app.py

Put document metadata in ES/Infinity (#12826)

2026-01-28 13:29:34 +08:00

langfuse_app.py

Refa: cleanup synchronous functions in chat_model and implement synchronization for conversation and dialog chats (#11779)

2025-12-08 09:43:03 +08:00

llm_app.py

Feat: support verify to set llm key and boost bigrams. (#12980)

2026-02-05 19:19:09 +08:00

mcp_server_app.py

Refa: asyncio.to_thread to ThreadPoolExecutor to break thread limitat… (#12716)

2026-01-20 13:29:37 +08:00

plugin_app.py

Refa: Clean the folders. (#12890)

2026-01-29 14:23:26 +08:00

search_app.py

Refa: make RAGFlow more asynchronous (#11601)

2025-12-01 14:24:06 +08:00

system_app.py

feat: Add OceanBase Performance Monitoring and Health Check Integration (#12886)

2026-01-30 09:44:42 +08:00

tenant_app.py

Feat: Add box connector (#11845)

2025-12-12 10:23:40 +08:00

user_app.py

Fix: default admin tenant (#12964)

2026-02-03 15:37:36 +08:00