From 72cdabbef3eef5d6c33245e4bff169851dd57edc Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E7=8E=8B=E5=BE=B7=E5=AE=87?= Date: Thu, 24 Sep 2026 17:43:13 +0800 Subject: [PATCH] =?UTF-8?q?=E5=AE=9A=E7=82=B9=E5=BC=95=E7=94=A8=E6=9F=A5?= =?UTF-8?q?=E8=AF=A2=E8=A1=A5=E4=B8=8A=E8=B0=83=E7=94=A8=E6=96=B9=E5=BF=85?= =?UTF-8?q?=E9=A1=BB=E4=BC=A0=E6=9C=AC=E4=BA=BA=20user=5Fid=20=E7=9A=84?= =?UTF-8?q?=E8=AF=B4=E6=98=8E?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - server-rs/crates/api-server/src/editor_project.rs：resolve_editor_reference_record_by_id_for_owner 从 pub 收窄到 pub(crate) 后授权边界移到调用方，给函数补上「必须传已认证用户自己的 ID，本函数不做授权」的前置条件说明，避免后续 crate 内调用方传入客户端可控的 owner 造成越权读取 --- server-rs/crates/api-server/src/editor_project.rs | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/server-rs/crates/api-server/src/editor_project.rs b/server-rs/crates/api-server/src/editor_project.rs index 07ee7ea07..f74c796a4 100644 --- a/server-rs/crates/api-server/src/editor_project.rs +++ b/server-rs/crates/api-server/src/editor_project.rs @@ -4327,6 +4327,10 @@ fn ensure_editor_image_edit_target_matches_source( ) } +/// 定点取一条编辑器引用记录（项目资源或素材）。 +/// +/// 调用方必须传**已认证用户自己的 ID**：这里不做任何授权判断，给什么 owner 就按什么 +/// owner 查，传客户端可控的值等于开了越权读取的口子。 pub(crate) async fn resolve_editor_reference_record_by_id_for_owner( state: &AppState, owner_user_id: &str,