0xyg3n 19ba9e43b6 fix(gateway/discord): require allowlist auth on slash commands ...

Slash commands (_run_simple_slash, _handle_thread_create_slash) bypassed
every DISCORD_ALLOWED_* gate enforced by on_message. Any guild member
could invoke /background (RCE via terminal), /restart, /model, /skill,
etc. CVSS 9.8 Critical.

- _evaluate_slash_authorization mirrors on_message gates (user, role,
  channel, ignored channel) with fail-closed semantics
- _check_slash_authorization sends ephemeral reject + logs + admin alert
- Auth gate runs before defer() so rejections are ephemeral
- /skill autocomplete returns [] for unauthorized users (no catalog leak)
- Component views (ExecApproval, SlashConfirm, UpdatePrompt, ModelPicker)
  now honor role allowlists via shared _component_check_auth helper
- Optional DISCORD_HIDE_SLASH_COMMANDS defense-in-depth
- Cross-platform admin alert (Telegram/Slack fallback) on unauthorized attempts

Based on PR #18125 by @0xyg3n.

2026-05-03 03:44:55 -07:00

..

qqbot

fix(gateway): tighten httpx keepalive and close whatsapp typing-response leak (#18451)

2026-05-02 02:23:37 -07:00

__init__.py

yuanbao platform (#16298)

2026-04-26 18:50:49 -07:00

_http_client_limits.py

fix(gateway): tighten httpx keepalive and close whatsapp typing-response leak (#18451)

2026-05-02 02:23:37 -07:00

ADDING_A_PLATFORM.md

feat: final platform plugin parity — webhook delivery, platform hints, docs

2026-04-29 21:56:51 -07:00

api_server.py

fix(api-server): use session-scoped task IDs for tool isolation

2026-04-30 19:59:38 -07:00

base.py

feat(gateway): private notice delivery and Slack format_message fixes

2026-05-01 13:33:06 -07:00

bluebubbles.py

fix(gateway): tighten httpx keepalive and close whatsapp typing-response leak (#18451)

2026-05-02 02:23:37 -07:00

dingtalk.py

fix(gateway): tighten httpx keepalive and close whatsapp typing-response leak (#18451)

2026-05-02 02:23:37 -07:00

discord.py

fix(gateway/discord): require allowlist auth on slash commands

2026-05-03 03:44:55 -07:00

email.py

feat(gateway): native send_multiple_images for Telegram, Discord, Slack, Mattermost, Email

2026-04-30 04:28:08 -07:00

feishu_comment_rules.py

fix(feishu-comment): use get_hermes_home(); drop dead asyncio wrapper; AUTHOR_MAP

2026-04-17 19:04:11 -07:00

feishu_comment.py

chore: remove unused imports and dead locals (ruff F401, F841) (#17010)

2026-04-28 06:46:45 -07:00

feishu.py

fix(feishu): finalize remote document downloads inside httpx.AsyncClient context (#18502)

2026-05-02 02:23:37 -07:00

helpers.py

fix(gateway): atomic writes for sibling recovery/dedup state files

2026-04-30 19:58:16 -07:00

homeassistant.py

fix(gateway): add request timeouts to HA, Email, Mattermost, SMS adapters (#3258)

2026-03-26 14:36:07 -07:00

matrix.py

fix(matrix): stop tagging the user on every reply (#16932)

2026-04-28 02:00:37 -07:00

mattermost.py

feat(gateway): native send_multiple_images for Telegram, Discord, Slack, Mattermost, Email

2026-04-30 04:28:08 -07:00

signal_rate_limit.py

feat(gateway/signal): add support for multiple images sending

2026-04-30 04:28:08 -07:00

signal.py

fix(gateway): tighten httpx keepalive and close whatsapp typing-response leak (#18451)

2026-05-02 02:23:37 -07:00

slack.py

fix(gateway): clear slack assistant thread status

2026-05-01 14:01:26 -07:00

sms.py

remove unused import and fix misleading log

2026-04-11 14:05:38 -07:00

telegram_network.py

fix(telegram): honor no_proxy for explicit proxy setup

2026-04-24 14:31:04 -07:00

telegram.py

fix(telegram): probe polling liveness after reconnect to detect wedged Updater

2026-05-02 01:55:04 -07:00

webhook.py

feat: final platform plugin parity — webhook delivery, platform hints, docs

2026-04-29 21:56:51 -07:00

wecom_callback.py

fix(gateway): tighten httpx keepalive and close whatsapp typing-response leak (#18451)

2026-05-02 02:23:37 -07:00

wecom_crypto.py

feat(gateway): add WeCom callback-mode adapter for self-built apps

2026-04-11 15:22:49 -07:00

wecom.py

fix(gateway): tighten httpx keepalive and close whatsapp typing-response leak (#18451)

2026-05-02 02:23:37 -07:00

weixin.py

fix(weixin): send_weixin_direct cross-loop session check

2026-05-03 01:51:33 -07:00

whatsapp.py

fix(gateway): tighten httpx keepalive and close whatsapp typing-response leak (#18451)

2026-05-02 02:23:37 -07:00

yuanbao_media.py

chore: remove unused imports and dead locals (ruff F401, F841) (#17010)

2026-04-28 06:46:45 -07:00

yuanbao_proto.py

chore: remove unused imports and dead locals (ruff F401, F841) (#17010)

2026-04-28 06:46:45 -07:00

yuanbao_sticker.py

yuanbao platform (#16298)

2026-04-26 18:50:49 -07:00

yuanbao.py

fix(yuanbao): enforce owner identity check on group slash commands

2026-04-30 23:57:55 -07:00