oadmin/new-api
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

🔒 fix: Enforce admin-only column visibility in logs tables

Browse Source 
Ensure non-admin users cannot enable columns reserved for administrators
across the following hooks:

* web/src/hooks/usage-logs/useUsageLogsData.js
  - Force-hide CHANNEL, USERNAME and RETRY columns for non-admins.

* web/src/hooks/mj-logs/useMjLogsData.js
  - Force-hide CHANNEL and SUBMIT_RESULT columns for non-admins.

* web/src/hooks/task-logs/useTaskLogsData.js
  - Force-hide CHANNEL column for non-admins.

The checks run when loading column preferences from localStorage, overriding
any tampered settings to keep sensitive information hidden from
unauthorized users.
This commit is contained in:
t0ng7u
2025-07-25 20:31:20 +08:00
parent 1430c05b6c
commit fe16d05fbb
3 changed files with 15 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
web/src/hooks/mj-logs/useMjLogsData.js
View File

@@ -94,6 +94,11 @@ export const useMjLogsData = () => {
const parsed = JSON.parse(savedColumns);
const defaults = getDefaultColumnVisibility();
const merged = { ...defaults, ...parsed };
// If not admin, force hide columns only visible to admins
if (!isAdminUser) {
merged[COLUMN_KEYS.CHANNEL] = false;
merged[COLUMN_KEYS.SUBMIT_RESULT] = false;
}
setVisibleColumns(merged);
} catch (e) {
console.error('Failed to parse saved column preferences', e);

4
web/src/hooks/task-logs/useTaskLogsData.js
View File

@@ -92,6 +92,10 @@ export const useTaskLogsData = () => {
const parsed = JSON.parse(savedColumns);
const defaults = getDefaultColumnVisibility();
const merged = { ...defaults, ...parsed };
// If not admin, force hide columns only visible to admins
if (!isAdminUser) {
merged[COLUMN_KEYS.CHANNEL] = false;
}
setVisibleColumns(merged);
} catch (e) {
console.error('Failed to parse saved column preferences', e);

6
web/src/hooks/usage-logs/useUsageLogsData.js
View File

@@ -116,6 +116,12 @@ export const useLogsData = () => {
const parsed = JSON.parse(savedColumns);
const defaults = getDefaultColumnVisibility();
const merged = { ...defaults, ...parsed };
// If not admin, force hide columns only visible to admins
if (!isAdminUser) {
merged[COLUMN_KEYS.CHANNEL] = false;
merged[COLUMN_KEYS.USERNAME] = false;
merged[COLUMN_KEYS.RETRY] = false;
}
setVisibleColumns(merged);
} catch (e) {
console.error('Failed to parse saved column preferences', e);