yunxiafei/openclaw-mission-control
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Enforce actor identity for task/comment authorship

Browse Source
This commit is contained in:
Jarvis
2026-02-02 17:43:17 +00:00
parent 4f7aa582ba
commit 254ee0dbad
1 changed files with 6 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
backend/app/api/work.py
View File

@@ -59,10 +59,9 @@ def create_task(
session: Session = Depends(get_session), session: Session = Depends(get_session),
actor_employee_id: int = Depends(get_actor_employee_id), actor_employee_id: int = Depends(get_actor_employee_id),
): ):
if payload.created_by_employee_id is None: # SECURITY / AUDIT: never allow spoofing task creator.
payload = TaskCreate( # The creator is always the actor making the request.
**{**payload.model_dump(), "created_by_employee_id": actor_employee_id} payload = TaskCreate(**{**payload.model_dump(), "created_by_employee_id": actor_employee_id})
)
if payload.assignee_employee_id is not None: if payload.assignee_employee_id is not None:
_validate_task_assignee(session, payload.assignee_employee_id) _validate_task_assignee(session, payload.assignee_employee_id)
@@ -395,10 +394,9 @@ def create_task_comment(
session: Session = Depends(get_session), session: Session = Depends(get_session),
actor_employee_id: int = Depends(get_actor_employee_id), actor_employee_id: int = Depends(get_actor_employee_id),
): ):
if payload.author_employee_id is None: # SECURITY / AUDIT: never allow spoofing comment authorship.
payload = TaskCommentCreate( # The author is always the actor making the request.
**{**payload.model_dump(), "author_employee_id": actor_employee_id} payload = TaskCommentCreate(**{**payload.model_dump(), "author_employee_id": actor_employee_id})
)
c = TaskComment(**payload.model_dump()) c = TaskComment(**payload.model_dump())
session.add(c) session.add(c)