Algorithm5838
6729e64f30
perf: skip re-splitting unchanged text tokens ( #26326 )
2026-06-28 22:09:58 -05:00
Timothy Jaeryang Baek
ea3f5f22d2
refac
2026-06-28 22:09:15 -05:00
Aindriú Mac Giolla Eoin
0b0910bee2
i18n: update Irish translation ( #26360 )
2026-06-28 22:02:11 -05:00
Timothy Jaeryang Baek
7c3802a55e
refac
2026-06-28 21:59:19 -05:00
G30
08f64f7908
fix(calendar): prevent all-day event date drift on save ( #25864 )
2026-06-25 18:40:25 -04:00
Timothy Jaeryang Baek
e3ba698453
refac
2026-06-25 17:34:41 -04:00
Timothy Jaeryang Baek
741b64edb6
refac
2026-06-25 17:23:53 -04:00
Timothy Jaeryang Baek
7c0b0e42f5
refac
2026-06-25 17:14:22 -04:00
Timothy Jaeryang Baek
8f890f0b43
refac
2026-06-25 15:56:10 +01:00
Timothy Jaeryang Baek
ede39d82de
refac
2026-06-25 15:49:36 +01:00
Timothy Jaeryang Baek
1a8e1a9939
refac
2026-06-25 15:22:31 +01:00
Timothy Jaeryang Baek
7b55a63fc7
refac
2026-06-25 15:22:20 +01:00
Timothy Jaeryang Baek
7d9b249671
refac
2026-06-25 14:40:35 +01:00
Timothy Jaeryang Baek
e124c2656a
refac
2026-06-25 14:37:05 +01:00
Timothy Jaeryang Baek
5576e6ed8a
refac
2026-06-25 14:34:22 +01:00
Timothy Jaeryang Baek
7453968678
refac
2026-06-25 14:19:30 +01:00
Timothy Jaeryang Baek
47a1bfdd15
refac
2026-06-25 14:19:21 +01:00
Timothy Jaeryang Baek
b5c43968db
refac
2026-06-25 03:31:45 +01:00
Timothy Jaeryang Baek
35f8bf97e3
refac
2026-06-25 03:26:31 +01:00
Timothy Jaeryang Baek
1457f2dec8
refac
2026-06-25 03:26:17 +01:00
Timothy Jaeryang Baek
1111a3a222
refac
2026-06-25 03:26:07 +01:00
Timothy Jaeryang Baek
f812072215
refac
2026-06-25 03:24:50 +01:00
Timothy Jaeryang Baek
8934bfb04b
refac
2026-06-24 14:13:58 +02:00
Timothy Jaeryang Baek
fd56086e79
refac
2026-06-24 13:19:55 +02:00
Timothy Jaeryang Baek
95391221df
refac
2026-06-23 23:35:44 +02:00
Timothy Jaeryang Baek
19db873603
refac
2026-06-23 23:35:40 +02:00
Timothy Jaeryang Baek
7f08376f0c
refac
2026-06-23 23:18:05 +02:00
Timothy Jaeryang Baek
15c7e37438
refac
2026-06-23 23:13:32 +02:00
Timothy Jaeryang Baek
b1c2536ed2
refac
2026-06-23 23:13:28 +02:00
Timothy Jaeryang Baek
91762ed807
refac
2026-06-23 00:25:21 +02:00
Timothy Jaeryang Baek
a0c2ec3d2c
refac
2026-06-22 17:02:14 +02:00
Timothy Jaeryang Baek
7e8153e889
refac
2026-06-22 16:47:48 +02:00
Timothy Jaeryang Baek
223f484ded
refac
2026-06-22 16:10:19 +02:00
Timothy Jaeryang Baek
88901bfa04
refac
2026-06-22 14:42:23 +02:00
Timothy Jaeryang Baek
928eb015bd
refac
2026-06-19 16:28:25 +02:00
Timothy Jaeryang Baek
a54878b14f
refac
2026-06-19 15:34:43 +02:00
Timothy Jaeryang Baek
8b9e28b503
refac
2026-06-19 15:28:52 +02:00
Timothy Jaeryang Baek
3f0c0e0a0d
refac
2026-06-19 00:16:06 +02:00
Timothy Jaeryang Baek
8958b64b5a
refac
2026-06-18 11:02:14 +02:00
Timothy Jaeryang Baek
21f9e5295b
refac
2026-06-18 10:47:25 +02:00
_00_
0ffc04797f
i18n: Update es-ES Spanish translations v0.9.6 ( #25836 )
...
i18n: Update Spanish translations v0.9.6
Update of new strings
2026-06-17 03:09:26 +02:00
G30
b2809e6293
perf(ui): hoist marked.use() to module scope to prevent extension stacking ( #25837 )
2026-06-17 03:09:09 +02:00
G30
beb9bf60e4
feat(memory): default user memory toggle to admin's global ENABLE_MEMORIES config ( #25909 )
2026-06-17 03:08:43 +02:00
G30
2f9b28a57d
fix(ui): run initChatList API calls concurrently in Promise.all ( #25838 )
2026-06-17 03:08:02 +02:00
Classic298
d501e3d6b5
Update milvus_multitenancy.py ( #25857 )
2026-06-17 03:07:27 +02:00
G30
819ad1d904
fix(chat): convert recursive findClosingDelimiter to iterative loop to prevent stack overflow ( #25845 )
2026-06-17 03:07:12 +02:00
G30
9fe3a00dba
perf(chat): cache KaTeX rendered HTML in reactive statement to avoid redundant renders ( #25847 )
2026-06-17 03:06:56 +02:00
G30
4584adf900
feat(ui): add 'Unshare All Shared Chats' button to Shared Chats modal ( #25848 )
2026-06-17 03:06:41 +02:00
G30
dfdb76cc46
fix(ui): prevent Code Editor drawer from collapsing when content is empty ( #25855 )
2026-06-17 03:06:15 +02:00
17df026492
Confer object-derived file write only for files the object owner owns ( #26032 )
...
has_access_to_file() derives file access from the objects a file is attached to
(knowledge bases, workspace models). Those branches returned True for any access_type
whenever the user held that permission on the object, write/delete included. Since a
user can create their own KB or model and attach any file they can merely READ (KB
attach and the model meta.knowledge validator both gate on read access only), a user
with read access to a victim file could launder it into write/delete: attach it to an
object they own, then rename, overwrite or delete it via the write-gated file routes
(POST /files/{id}/rename, /data/content/update, DELETE /files/{id}). This is the
residual of GHSA-vjqm-6gcc-62cr (CVE-2026-54012) left open by the read-only attach
validator (CWE-863).
An object now confers write/delete on a file only when the object's owner owns that
file, so delegation originates from the file's own owner. Read is unchanged (RAG and
shared-object reads still work), and legitimate delegation is preserved: a write grant
on an object whose owner owns the attached file still confers write. Applied to all
three object branches: knowledge base, file home collection, and workspace model.
Co-authored-by: rexpository <30176934+rexpository@users.noreply.github.com >
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com >
2026-06-17 03:05:57 +02:00
Algorithm5838
Timothy Jaeryang Baek
Aindriú Mac Giolla Eoin
G30
_00_
Classic298
