Classic298andClaude Opus 4.7 9a3eea6448 fix: bind prompt history/version ops to the authorized prompt (#25056) ...

The history diff, delete, and version-restore routes authorize the URL
prompt_id but then act on a caller-supplied history/version id without
checking it belongs to that prompt (IDOR). Filter by prompt_id in
compute_diff and delete_history_entry, and reject a cross-prompt version_id
in update_prompt_version.

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

2026-06-01 12:07:52 -07:00

..

analytics.py

refac: modernize type annotations (PEP 604 / PEP 585)

2026-05-12 17:10:15 +09:00

audio.py

refac

2026-05-31 14:59:28 -07:00

auths.py

fix: don't block first-admin signup on stale ENABLE_SIGNUP (#24821)

2026-06-01 11:44:36 -07:00

automations.py

refac: modernize type annotations (PEP 604 / PEP 585)

2026-05-12 17:10:15 +09:00

calendar.py

fix: check destination calendar write access on event update (#24764)

2026-05-19 21:26:58 +04:00

channels.py

refac

2026-05-19 20:44:38 +04:00

chats.py

fix: don't revert replace/outlet content on chat save (#25485)

2026-06-01 11:45:05 -07:00

configs.py

refac: modernize type annotations (PEP 604 / PEP 585)

2026-05-12 17:10:15 +09:00

evaluations.py

refactor: remove unused GET /evaluations/feedbacks/all endpoint (#24778)

2026-05-19 20:49:22 +04:00

files.py

refac

2026-06-01 09:53:04 -07:00

folders.py

refac: modernize type annotations (PEP 604 / PEP 585)

2026-05-12 17:10:15 +09:00

functions.py

refac: modernize type annotations (PEP 604 / PEP 585)

2026-05-12 17:10:15 +09:00

groups.py

refac

2026-05-14 13:12:59 +09:00

images.py

fix(images): pass content_type=None to r.json() to accept non-standard MIME types (#24838)

2026-06-01 10:33:24 -07:00

knowledge.py

refac

2026-06-01 11:34:46 -07:00

memories.py

refac

2026-05-21 14:01:57 +04:00

models.py

fix: harden model profile image against SVG stored XSS (#25060)

2026-05-28 17:41:55 -05:00

notes.py

refac: modernize type annotations (PEP 604 / PEP 585)

2026-05-12 17:10:15 +09:00

ollama.py

refac

2026-05-31 18:42:28 -07:00

openai.py

fix: move bypass_system_prompt off query parameter onto request.state (#25156)

2026-05-31 14:53:53 -07:00

pipelines.py

refac: modernize type annotations (PEP 604 / PEP 585)

2026-05-12 17:10:15 +09:00

prompts.py

fix: bind prompt history/version ops to the authorized prompt (#25056)

2026-06-01 12:07:52 -07:00

retrieval.py

refac

2026-05-31 15:10:48 -07:00

scim.py

refac: modernize type annotations (PEP 604 / PEP 585)

2026-05-12 17:10:15 +09:00

skills.py

refac: modernize type annotations (PEP 604 / PEP 585)

2026-05-12 17:10:15 +09:00

tasks.py

refac

2026-05-14 13:19:00 +09:00

terminals.py

fix: don't hang terminal proxy when one forwarding pump exits first (#25479)

2026-06-01 10:10:04 -07:00

tools.py

refac

2026-05-21 14:01:57 +04:00

users.py

refac

2026-05-21 15:29:49 +04:00

utils.py

refac

2026-05-21 16:25:25 +04:00