Classic298 9a3eea6448 fix: bind prompt history/version ops to the authorized prompt (#25056) ...

The history diff, delete, and version-restore routes authorize the URL
prompt_id but then act on a caller-supplied history/version id without
checking it belongs to that prompt (IDOR). Filter by prompt_id in
compute_diff and delete_history_entry, and reject a cross-prompt version_id
in update_prompt_version.

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

2026-06-01 12:07:52 -07:00

..

access_grants.py

refac: modernize type annotations (PEP 604 / PEP 585)

2026-05-12 17:10:15 +09:00

auths.py

refac

2026-05-21 15:29:49 +04:00

automations.py

refac: modernize type annotations (PEP 604 / PEP 585)

2026-05-12 17:10:15 +09:00

calendar.py

refac: modernize type annotations (PEP 604 / PEP 585)

2026-05-12 17:10:15 +09:00

channels.py

refac: modernize type annotations (PEP 604 / PEP 585)

2026-05-12 17:10:15 +09:00

chat_messages.py

fix: preserve parent_id on chat_message upsert (#25205)

2026-05-31 14:50:05 -07:00

chats.py

fix: use db instead of undefined session in chats model (#25455)

2026-06-01 09:25:35 -07:00

feedbacks.py

refac: modernize type annotations (PEP 604 / PEP 585)

2026-05-12 17:10:15 +09:00

files.py

refac

2026-06-01 11:34:46 -07:00

folders.py

refac: modernize type annotations (PEP 604 / PEP 585)

2026-05-12 17:10:15 +09:00

functions.py

refac

2026-05-21 15:29:49 +04:00

groups.py

refac: modernize type annotations (PEP 604 / PEP 585)

2026-05-12 17:10:15 +09:00

knowledge.py

refac

2026-05-28 17:24:33 -05:00

memories.py

refac

2026-05-21 15:29:49 +04:00

messages.py

refac: modernize type annotations (PEP 604 / PEP 585)

2026-05-12 17:10:15 +09:00

models.py

fix(models): gracefully handle legacy svg profile_image_url in ModelMeta validator (#25173)

2026-05-31 14:55:07 -07:00

notes.py

refac

2026-05-14 01:49:34 +09:00

oauth_sessions.py

refac: modernize type annotations (PEP 604 / PEP 585)

2026-05-12 17:10:15 +09:00

prompt_history.py

fix: bind prompt history/version ops to the authorized prompt (#25056)

2026-06-01 12:07:52 -07:00

prompts.py

fix: bind prompt history/version ops to the authorized prompt (#25056)

2026-06-01 12:07:52 -07:00

shared_chats.py

refac: modernize type annotations (PEP 604 / PEP 585)

2026-05-12 17:10:15 +09:00

skills.py

refac: modernize type annotations (PEP 604 / PEP 585)

2026-05-12 17:10:15 +09:00

tags.py

refac

2026-05-21 15:29:49 +04:00

tools.py

refac

2026-05-21 15:29:49 +04:00

users.py

refac

2026-05-21 15:29:49 +04:00