From f6a2bae05ec8fc188e6da4cb439b523a4a72a63d Mon Sep 17 00:00:00 2001 From: "google-labs-jules[bot]" <161369871+google-labs-jules[bot]@users.noreply.github.com> Date: Wed, 18 Mar 2026 03:44:12 +0000 Subject: [PATCH] Fix authorization bypass in API (IDOR) by applying owner filter Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com> --- app/api/files.py | 36 +++++++++++++++++++++++++++--------- 1 file changed, 27 insertions(+), 9 deletions(-) diff --git a/app/api/files.py b/app/api/files.py index 64aa62b0..65cdaaf8 100644 --- a/app/api/files.py +++ b/app/api/files.py @@ -346,7 +346,9 @@ def bulk_delete_files(request: Request, file_ids: List[int], db: DbSession): try: # Find all file records - file_records = db.query(FileRecord).filter(FileRecord.id.in_(file_ids)).all() + query = db.query(FileRecord).filter(FileRecord.id.in_(file_ids)) + query = apply_owner_filter(query, request) + file_records = query.all() if not file_records: raise HTTPException(status_code=404, detail="No files found with the provided IDs") @@ -385,7 +387,9 @@ def bulk_reprocess_files(request: Request, file_ids: List[int], db: DbSession): """ try: # Find all file records - file_records = db.query(FileRecord).filter(FileRecord.id.in_(file_ids)).all() + query = db.query(FileRecord).filter(FileRecord.id.in_(file_ids)) + query = apply_owner_filter(query, request) + file_records = query.all() if not file_records: raise HTTPException(status_code=404, detail="No files found with the provided IDs") @@ -457,7 +461,9 @@ def bulk_reprocess_files_cloud_ocr(request: Request, file_ids: List[int], db: Db Useful for re-running OCR on files with poor text quality or missing OCR text. """ try: - file_records = db.query(FileRecord).filter(FileRecord.id.in_(file_ids)).all() + query = db.query(FileRecord).filter(FileRecord.id.in_(file_ids)) + query = apply_owner_filter(query, request) + file_records = query.all() if not file_records: raise HTTPException(status_code=404, detail="No files found with the provided IDs") @@ -537,7 +543,9 @@ def bulk_download_files(request: Request, file_ids: List[int], db: DbSession): Files not found on disk are silently skipped. """ try: - file_records = db.query(FileRecord).filter(FileRecord.id.in_(file_ids)).all() + query = db.query(FileRecord).filter(FileRecord.id.in_(file_ids)) + query = apply_owner_filter(query, request) + file_records = query.all() if not file_records: raise HTTPException(status_code=404, detail="No files found with the provided IDs") @@ -619,7 +627,9 @@ def reprocess_single_file(request: Request, file_id: int, db: DbSession): """ try: # Find the file record - file_record = db.query(FileRecord).filter(FileRecord.id == file_id).first() + query = db.query(FileRecord).filter(FileRecord.id == file_id) + query = apply_owner_filter(query, request) + file_record = query.first() if not file_record: raise HTTPException(status_code=404, detail=f"File with ID {file_id} not found") @@ -675,7 +685,9 @@ def reprocess_with_cloud_ocr(request: Request, file_id: int, db: DbSession): """ try: # Find the file record - file_record = db.query(FileRecord).filter(FileRecord.id == file_id).first() + query = db.query(FileRecord).filter(FileRecord.id == file_id) + query = apply_owner_filter(query, request) + file_record = query.first() if not file_record: raise HTTPException(status_code=404, detail=f"File with ID {file_id} not found") @@ -938,7 +950,9 @@ def retry_subtask( """ try: # Find the file record - file_record = db.query(FileRecord).filter(FileRecord.id == file_id).first() + query = db.query(FileRecord).filter(FileRecord.id == file_id) + query = apply_owner_filter(query, request) + file_record = query.first() if not file_record: raise HTTPException(status_code=404, detail=f"File with ID {file_id} not found") @@ -1080,7 +1094,9 @@ def get_file_preview( try: # Find the file record - file_record = db.query(FileRecord).filter(FileRecord.id == file_id).first() + query = db.query(FileRecord).filter(FileRecord.id == file_id) + query = apply_owner_filter(query, request) + file_record = query.first() if not file_record: raise HTTPException(status_code=404, detail=f"File with ID {file_id} not found") @@ -1160,7 +1176,9 @@ def download_file( try: # Find the file record - file_record = db.query(FileRecord).filter(FileRecord.id == file_id).first() + query = db.query(FileRecord).filter(FileRecord.id == file_id) + query = apply_owner_filter(query, request) + file_record = query.first() if not file_record: raise HTTPException(status_code=404, detail=f"File with ID {file_id} not found")