Merge remote-tracking branch 'origin/main'

Author: ziyujiahao

backend/apps/datasource/crud/datasource.py

@@ -400,7 +400,9 @@ def updateNum(session: SessionDep, ds: CoreDatasource):
 
 def get_table_obj_by_ds(session: SessionDep, current_user: CurrentUser, ds: CoreDatasource) -> List[TableAndFields]:
     _list: List = []
-    tables = session.query(CoreTable).filter(CoreTable.ds_id == ds.id).all()
+    tables = session.query(CoreTable).filter(
+        and_(CoreTable.ds_id == ds.id, CoreTable.checked == True)
+    ).all()
     conf = DatasourceConf(**json.loads(aes_decrypt(ds.configuration))) if ds.type != "excel" else get_engine_config()
     schema = conf.dbSchema if conf.dbSchema is not None and conf.dbSchema != "" else conf.database
 

backend/apps/db/db.py

@@ -670,7 +670,7 @@ def check_sql_read(sql: str, ds: CoreDatasource | AssistantOutDsSchema):
         write_types = (
             exp.Insert, exp.Update, exp.Delete,
             exp.Create, exp.Drop, exp.Alter,
-            exp.Merge, exp.Command
+            exp.Merge, exp.Command, exp.Copy
         )
 
         for stmt in statements:
@@ -688,6 +688,7 @@ def check_sql_read(sql: str, ds: CoreDatasource | AssistantOutDsSchema):
 def checkParams(extraParams: str, illegalParams: List[str]):
     kvs = extraParams.split('&')
     for kv in kvs:
-        k, v = kv.split('=')
-        if k in illegalParams:
-            raise HTTPException(status_code=500, detail=f'Illegal Parameter: {k}')
+        if kv and '=' in kv:
+            k, v = kv.split('=')
+            if k in illegalParams:
+                raise HTTPException(status_code=500, detail=f'Illegal Parameter: {k}')

backend/apps/system/api/user.py

@@ -180,7 +180,8 @@ async def create(session: SessionDep, creator: UserCreator, trans: Trans):
         raise Exception(trans('i18n_exist', msg = f"{trans('i18n_user.email')} [{creator.email}]"))
     if not check_email_format(creator.email):
         raise Exception(trans('i18n_format_invalid', key = f"{trans('i18n_user.email')} [{creator.email}]"))
-    data = creator.model_dump(exclude_unset=True)
+    #data = creator.model_dump(exclude_unset=True)
+    data = creator.model_dump()
     user_model = UserModel.model_validate(data)
     #user_model.create_time = get_timestamp()
     user_model.language = "zh-CN"

backend/apps/system/crud/assistant.py

@@ -21,6 +21,7 @@
 from common.utils.aes_crypto import simple_aes_decrypt
 from common.utils.utils import SQLBotLogUtil, equals_ignore_case, get_domain_list, string_to_numeric_hash
 from common.core.deps import Trans
+from common.core.response_middleware import ResponseMiddleware
 
 
 @cache(namespace=CacheNamespace.EMBEDDED_INFO, cacheName=CacheName.ASSISTANT_INFO, keyExpression="assistant_id")
@@ -87,13 +88,20 @@ def init_dynamic_cors(app: FastAPI):
                             seen.add(domain)
                             unique_domains.append(domain)
             cors_middleware = None
+            response_middleware = None
             for middleware in app.user_middleware:
-                if middleware.cls == CORSMiddleware:
+                if not cors_middleware and middleware.cls == CORSMiddleware:
                     cors_middleware = middleware
+                if not response_middleware and middleware.cls == ResponseMiddleware:
+                    response_middleware = middleware
+                if cors_middleware and response_middleware:
                     break
+                
+            updated_origins = list(set(settings.all_cors_origins + unique_domains))
             if cors_middleware:
-                updated_origins = list(set(settings.all_cors_origins + unique_domains))
                 cors_middleware.kwargs['allow_origins'] = updated_origins
+            if response_middleware:
+                response_middleware.kwargs['allow_origins'] = updated_origins
     except Exception as e:
         return False, e
 

backend/apps/system/crud/system_variable.py

@@ -1,8 +1,8 @@
 # Author: Junjun
 # Date: 2026/1/26
 import datetime
-
 from typing import List
+
 from fastapi import HTTPException
 from sqlalchemy import and_
 from sqlmodel import select
@@ -37,11 +37,12 @@ def delete(session: SessionDep, ids: List[int]):
 
 def list_all(session: SessionDep, trans: Trans, variable: SystemVariable):
     if variable.name is None:
-        records = session.query(SystemVariable).order_by(SystemVariable.type.desc()).all()
+        records = session.query(SystemVariable).order_by(SystemVariable.type.desc(),
+                                                         SystemVariable.name.asc()).all()
     else:
         records = session.query(SystemVariable).filter(
-            and_(SystemVariable.name.like(f'%{variable.name}%'), SystemVariable.type != 'system')).order_by(
-            SystemVariable.type.desc()).all()
+            and_(SystemVariable.name.ilike(f'%{variable.name}%'), SystemVariable.type != 'system')).order_by(
+            SystemVariable.type.desc(), SystemVariable.name.asc()).all()
 
     res = []
     for r in records:
@@ -58,11 +59,11 @@ async def list_page(session: SessionDep, trans: Trans, pageNum: int, pageSize: i
     filters = {}
 
     if variable.name is None:
-        stmt = select(SystemVariable).order_by(SystemVariable.type.desc())
+        stmt = select(SystemVariable).order_by(SystemVariable.type.desc(), SystemVariable.name.asc())
     else:
         stmt = select(SystemVariable).where(
-            and_(SystemVariable.name.like(f'%{variable.name}%'), SystemVariable.type != 'system')).order_by(
-            SystemVariable.type.desc())
+            and_(SystemVariable.name.ilike(f'%{variable.name}%'), SystemVariable.type != 'system')).order_by(
+            SystemVariable.type.desc(), SystemVariable.name.asc())
 
     variable_page = await paginator.get_paginated_response(
         stmt=stmt,
@@ -92,7 +93,7 @@ def checkName(session: SessionDep, trans: Trans, variable: SystemVariable):
             raise HTTPException(status_code=500, detail=trans('i18n_variable.name_exist'))
 
 
-def checkValue(session: SessionDep, trans: Trans, values:List):
+def checkValue(session: SessionDep, trans: Trans, values: List):
     # values: [{"variableId":1,"variableValues":["a","b"]}]
 
-    pass
+    pass

backend/apps/system/schemas/system_schema.py

@@ -58,7 +58,7 @@ class UserCreator(BaseUser):
     status: int = Field(default=1, description=f"{PLACEHOLDER_PREFIX}status")
     origin: Optional[int] = Field(default=0, description=f"{PLACEHOLDER_PREFIX}origin")
     oid_list: Optional[list[int]] = Field(default=None, description=f"{PLACEHOLDER_PREFIX}oid")
-    system_variables: Optional[List] = Field(default=None)
+    system_variables: Optional[List] = Field(default=[])
 
     """ @field_validator("email")
     def validate_email(cls, lang: str) -> str:

backend/apps/terminology/api/terminology.py

@@ -165,6 +165,7 @@ def inner():
 
 @router.post("/uploadExcel", summary=f"{PLACEHOLDER_PREFIX}upload_term")
 @system_log(LogConfig(operation_type=OperationType.IMPORT, module=OperationModules.TERMINOLOGY))
+@require_permissions(permission=SqlbotPermission(role=['ws_admin']))
 async def upload_excel(trans: Trans, current_user: CurrentUser, file: UploadFile = File(...)):
     ALLOWED_EXTENSIONS = {"xlsx", "xls"}
     if not file.filename.lower().endswith(tuple(ALLOWED_EXTENSIONS)):

backend/common/core/response_middleware.py

@@ -1,5 +1,6 @@
 import json
 
+from redis import typing
 from starlette.exceptions import HTTPException
 from starlette.middleware.base import BaseHTTPMiddleware
 from starlette.requests import Request
@@ -11,6 +12,7 @@
 
 class ResponseMiddleware(BaseHTTPMiddleware):
     def __init__(self, app):
+        self.allow_origins = ["'self'"]
         super().__init__(app)
 
     async def dispatch(self, request, call_next):
@@ -76,7 +78,13 @@ async def dispatch(self, request, call_next):
                         if k.lower() not in ("content-length", "content-type")
                     }
                 )
-
+        content_type = response.headers.get("content-type", "")
+        static_content_types = ["text/html", "javascript", "typescript", "css"]
+        if any(ct in content_type for ct in static_content_types):
+            if self.allow_origins:
+                frame_ancestors_value = " ".join(self.allow_origins)
+                response.headers["Content-Security-Policy"] = f"frame-ancestors {frame_ancestors_value};"
+            
         return response
 
 

frontend/package.json

@@ -64,7 +64,7 @@
     "eslint-plugin-prettier": "^5.4.1",
     "eslint-plugin-vue": "^10.2.0",
     "globals": "^16.2.0",
-    "less": "^4.3.0",
+    "less": "4.4.2",
     "pinia": "^3.0.2",
     "prettier": "^3.5.3",
     "typescript": "~5.7.2",
@@ -76,4 +76,4 @@
     "vite-svg-loader": "^5.1.0",
     "vue-tsc": "^2.2.8"
   }
-}
+}