yunxiafei/openclaw-mission-control
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Enforce actor identity for task/comment authorship

Browse Source
This commit is contained in:
Jarvis
2026-02-02 17:43:17 +00:00
parent 4f7aa582ba
commit 254ee0dbad
1 changed files with 6 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
backend/app/api/work.py
View File

@@ -59,10 +59,9 @@ def create_task(
session: Session = Depends(get_session),
actor_employee_id: int = Depends(get_actor_employee_id),
):
if payload.created_by_employee_id is None:
payload = TaskCreate(
**{**payload.model_dump(), "created_by_employee_id": actor_employee_id}
)
# SECURITY / AUDIT: never allow spoofing task creator.
# The creator is always the actor making the request.
payload = TaskCreate(**{**payload.model_dump(), "created_by_employee_id": actor_employee_id})
if payload.assignee_employee_id is not None:
_validate_task_assignee(session, payload.assignee_employee_id)
@@ -395,10 +394,9 @@ def create_task_comment(
session: Session = Depends(get_session),
actor_employee_id: int = Depends(get_actor_employee_id),
):
if payload.author_employee_id is None:
payload = TaskCommentCreate(
**{**payload.model_dump(), "author_employee_id": actor_employee_id}
)
# SECURITY / AUDIT: never allow spoofing comment authorship.
# The author is always the actor making the request.
payload = TaskCommentCreate(**{**payload.model_dump(), "author_employee_id": actor_employee_id})
c = TaskComment(**payload.model_dump())
session.add(c)