Classic298 9f20687680 fix: add knowledge_id access check in search_knowledge_files (BOLA) (#25113) ... When called without attached model knowledge and given a caller-supplied knowledge_id, search_knowledge_files passed it straight to Knowledges.search_files_by_id, which does not enforce ownership on knowledge_id. An authenticated user who happened to know a target UUID could enumerate file metadata (filename, file id, KB id, KB name, updated_at) from any knowledge base, bypassing the AccessGrants permission model. Mirror the same admin/owner/AccessGrants check the attached-KB branch already uses, matching the sibling query_knowledge_files function. Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>		2026-05-28 16:23:49 -05:00
..
__init__.py	feat: native function calling for built-in tools	2026-01-05 04:45:17 +04:00
builtin.py	fix: add knowledge_id access check in search_knowledge_files (BOLA) (#25113)	2026-05-28 16:23:49 -05:00
knowledge_fs.py	refac	2026-05-14 03:10:48 +09:00