mirror of
https://gh.wpcy.net/https://github.com/discourse/discourse.git
synced 2026-06-19 07:43:46 +08:00
Unscoped credit-status lookups in CreditStatusChecker leak restricted persona, feature, and LLM model metadata to any logged-in user regardless of authorization (IDOR vulnerability).
32 lines
872 B
Ruby
Vendored
32 lines
872 B
Ruby
Vendored
# frozen_string_literal: true
|
|
|
|
module DiscourseAi
|
|
class AiCreditsController < ::ApplicationController
|
|
requires_plugin PLUGIN_NAME
|
|
requires_login
|
|
|
|
CREDIT_STATUS_CACHE_TTL = 5.seconds
|
|
|
|
def status
|
|
CreditStatusChecker.call(params: status_params, guardian: guardian) do |result|
|
|
on_success do
|
|
expires_in CREDIT_STATUS_CACHE_TTL, public: false
|
|
render json: {
|
|
agents: result[:agents],
|
|
features: result[:features],
|
|
llm_models: result[:llm_models],
|
|
}.compact
|
|
end
|
|
on_failed_contract do |contract|
|
|
raise Discourse::InvalidParameters.new(contract.errors.full_messages.join(", "))
|
|
end
|
|
end
|
|
end
|
|
|
|
private
|
|
|
|
def status_params
|
|
params.permit(agent_ids: [], features: [], llm_model_ids: [])
|
|
end
|
|
end
|
|
end
|