Skip to content

fix: Execution details and display sources on the debug conversation page should remain visible at all times. #7811

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
shaohuzhang1 merged 1 commit into from
Nov 10, 2026
Merged

fix: Execution details and display sources on the debug conversation page should remain visible at all times. #7811

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion apps/application/views/application_chat.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -346,7 +346,7 @@ def get(
"chat_user_id": str(request.user.id),
}
)
return result.success(serializer.page(current_page, page_size))
return result.success(serializer.debug_page(current_page, page_size))

class Operate(APIView):
authentication_classes = [TokenAuth]

@shaohuzhang1 shaohuzhang1 Nov 10, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Critical Issue: Debug Code in Production
Replacing serializer.page() with serializer.debug_page() is likely a mistake.

  • Security/Performance Risk: debug_page implies exposing internal details or bypassing standard pagination logic, which can leak information or cause performance issues.
  • Functionality Break: It may not return the expected paginated response structure, breaking client-side expectations.
  • Action: Revert to serializer.page(current_page, page_size) unless this change was an intentional temporary debugging step that must be removed before deployment.

Expand Down
9 changes: 9 additions & 0 deletions apps/chat/serializers/chat_record.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -214,6 +214,15 @@ def list(self):
queryset = self.get_queryset()
return [ChatRecordSerializerModel(r).data for r in queryset]

def debug_page(self, current_page, page_size):
self.is_valid(raise_exception=True)
application_access_token = (
QuerySet(ApplicationAccessToken).filter(application_id=self.data.get("application_id")).first()
)
return ApplicationChatRecordQuerySerializers(
data={"application_id": self.data.get("application_id"), "chat_id": self.data.get("chat_id")}
).page(current_page, page_size, show_source=True, show_exec=True)

def page(self, current_page, page_size):
self.is_valid(raise_exception=True)
application_access_token = (

@shaohuzhang1 shaohuzhang1 Nov 10, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Here are the findings regarding the added debug_page method:

  1. Unused Variable: The variable application_access_token is assigned but never used. This is dead code and will likely trigger a linter warning.
  2. Security/Permission Risk: Unlike the existing page method (which implies it uses the token for permission checks or filtering), debug_page fetches the token but does not validate permissions or use it to filter the queryset. It passes data directly to the serializer. If the intended behavior is to restrict access based on the application, this introduces a security vulnerability (IDOR - Insecure Direct Object Reference).
  3. Parameter Mismatch: The method signature takes current_page, page_size, but inside, it calls .page(...). Ensure ApplicationChatRecordQuerySerializers expects these arguments correctly.
  4. Consistency: The original page method likely validates permissions using the application_access_token. Your debug_page bypasses this logic entirely. Verify if this omission is intentional (e.g., for admin/debug-only views) or an oversight.

Recommendation:
Either remove the unused variable + ensure proper permission checks, or explicitly comment why permissions are skipped in debug mode.

Expand Down
Loading