Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Revert "feature(backend): Add ability to execute store agents without agent ownership" #9263

Conversation

aarushik93
Copy link
Contributor

Reverts #9179

This PR is preventing the running of agents in dev.

@aarushik93 aarushik93 requested a review from a team as a code owner January 13, 2025 18:28
@aarushik93 aarushik93 requested review from Pwuts and Bentlybro and removed request for a team January 13, 2025 18:28
Copy link

linear bot commented Jan 13, 2025

@github-actions github-actions bot added the platform/backend AutoGPT Platform - Back end label Jan 13, 2025
Copy link

netlify bot commented Jan 13, 2025

Deploy Preview for auto-gpt-docs-dev canceled.

Name Link
🔨 Latest commit 73e3b15
🔍 Latest deploy log https://app.netlify.com/sites/auto-gpt-docs-dev/deploys/67855b608ffe0500086b3f08

Copy link

PR Reviewer Guide 🔍

Here are some key observations to aid the review process:

⏱️ Estimated effort to review: 4 🔵🔵🔵🔵⚪
🧪 PR contains tests
🔒 Security concerns

Access Control Vulnerability:
The removal of store listing version validation in get_graph() function could allow unauthorized users to access and execute graphs they don't own. The code previously checked if the graph was owned by the user or had an approved store listing, but this validation has been removed.

⚡ Recommended focus areas for review

Access Control

The removal of store listing version validation could allow unauthorized access to graphs. The code no longer checks if a graph is owned by the user or has an approved store listing.

# TODO: Fix hack workaround to get adding store agents to work
if user_id is not None and not template:
    where_clause["userId"] = user_id
Parameter Change

Making graph_version optional in add_execution() could lead to executing unintended graph versions if not properly handled.

graph_version: int | None = None,

Copy link

netlify bot commented Jan 13, 2025

Deploy Preview for auto-gpt-docs canceled.

Name Link
🔨 Latest commit 73e3b15
🔍 Latest deploy log https://app.netlify.com/sites/auto-gpt-docs/deploys/67855b6050481a00088b436e

@aarushik93 aarushik93 enabled auto-merge January 13, 2025 18:33
@aarushik93 aarushik93 added this pull request to the merge queue Jan 13, 2025
Merged via the queue into dev with commit fe84cbe Jan 13, 2025
20 checks passed
@aarushik93 aarushik93 deleted the revert-9179-swiftyos/open-2276-add-ability-to-execute-store-agents-without-agent-ownership branch January 13, 2025 18:58
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
platform/backend AutoGPT Platform - Back end size/l
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants