From d2097744e49be601f018bbf757a9cee28d2f6012 Mon Sep 17 00:00:00 2001 From: Audit Bot Date: Mon, 29 Jun 2026 17:19:13 +0800 Subject: [PATCH] =?UTF-8?q?fix:=20retry=20=E7=AB=AF=E7=82=B9=E5=A2=9E?= =?UTF-8?q?=E5=8A=A0=E5=BD=92=E5=B1=9E=E6=A0=A1=E9=AA=8C=20(P1=20=E5=AE=89?= =?UTF-8?q?=E5=85=A8=E4=BF=AE=E5=A4=8D)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - generation_tasks.py: retry_generation_task 增加 created_by_user_id 校验 - task_center.py: retry_task_by_id 增加 created_by_user_id 校验 - 非任务创建者返回 403 Access denied --- apps/api/app/api/routes/generation_tasks.py | 5 ++++- apps/api/app/api/routes/task_center.py | 2 ++ 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/apps/api/app/api/routes/generation_tasks.py b/apps/api/app/api/routes/generation_tasks.py index 462b92beb..db2210c31 100644 --- a/apps/api/app/api/routes/generation_tasks.py +++ b/apps/api/app/api/routes/generation_tasks.py @@ -216,7 +216,10 @@ def retry_generation_task( task = generation_task_repository.get(task_id) if task is None: raise HTTPException(status_code=404, detail="Generation task not found") - if task.status != "failed": + if task.created_by_user_id and task.created_by_user_id != authenticated_user.user.id: + raise HTTPException(status_code=403, detail="Access denied to this task") + status_val = task.status.value if hasattr(task.status, "value") else str(task.status) + if status_val != "failed": raise HTTPException(status_code=409, detail="Only failed tasks can be retried") use_case = CreateGenerationTaskUseCase(generation_task_repository) diff --git a/apps/api/app/api/routes/task_center.py b/apps/api/app/api/routes/task_center.py index 1d2e9524d..e899c8500 100644 --- a/apps/api/app/api/routes/task_center.py +++ b/apps/api/app/api/routes/task_center.py @@ -134,6 +134,8 @@ def retry_task_by_id( task = generation_task_repository.get(task_id) if task is None: raise HTTPException(status_code=404, detail="Generation task not found") + if task.created_by_user_id and task.created_by_user_id != authenticated_user.user.id: + raise HTTPException(status_code=403, detail="Access denied to this task") if _status_value(task.status) != "failed": raise HTTPException(status_code=409, detail="Only failed tasks can be retried")