youngkermit8-coder opened a new issue, #1712: URL: https://github.com/apache/rocketmq-dashboard/issues/1712
### Description `AuthInterceptor.READER_POST_PATHS` currently includes `/api/llm/config/test`. An authenticated non-admin reader can therefore submit an arbitrary LLM `apiBase` and cause the Studio backend to initiate a connection to that caller-controlled destination. Saving LLM configuration is admin-only, and data-source connection tests are already admin-only for the same trust-boundary reason. ### Expected behavior Only administrators should be able to invoke the LLM configuration test endpoint. Reader access to normal AI chat remains unchanged. ### Reproduction 1. Enable login and authenticate as a non-admin user. 2. POST a valid LLM configuration to `/api/llm/config/test`. 3. Observe that the auth interceptor allows the request instead of returning HTTP 403. ### Proposed fix Remove `/api/llm/config/test` from the reader POST allowlist and add an authorization regression test. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
