pengjunjie/langflow
1
0
Fork 1
mirror of https://github.com/langflow-ai/langflow.git synced 2026-07-26 03:10:37 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix(LE-906): harden feature-flag checks against mocked settings

Browse Source
This commit is contained in:
vijay kumar katuri
2026-05-12 15:06:20 -04:00
parent 4d4b53fe60
commit 0bb61641f3
2 changed files with 5 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
src/backend/base/langflow/api/v1/endpoints.py
View File

@ -1134,7 +1134,7 @@ async def custom_component(
settings_service = get_settings_service()
# P2: Check if custom component editing is restricted to admins only
if settings_service.settings.custom_component_admin_only and not user.is_superuser:
if getattr(settings_service.settings, "custom_component_admin_only", False) is True and not user.is_superuser:
raise HTTPException(
status_code=status.HTTP_403_FORBIDDEN,
detail="Custom component creation is restricted to administrators",
@ -1193,7 +1193,7 @@ async def custom_component_update(
settings_service = get_settings_service()
# P2: Check if custom component editing is restricted to admins only
if settings_service.settings.custom_component_admin_only and not user.is_superuser:
if getattr(settings_service.settings, "custom_component_admin_only", False) is True and not user.is_superuser:
raise HTTPException(
status_code=status.HTTP_403_FORBIDDEN,
detail="Custom component editing is restricted to administrators",

4
src/backend/base/langflow/api/v1/mcp_projects.py
View File

@ -773,7 +773,9 @@ async def install_mcp_config(
# P2: Check if MCP server management is locked
settings_service = get_settings_service()
if settings_service.settings.mcp_servers_locked and not current_user.is_superuser:
# Some tests patch settings with MagicMock objects that return truthy placeholders
# for unknown attrs. Only enforce this gate when the flag is explicitly True.
if getattr(settings_service.settings, "mcp_servers_locked", False) is True and not current_user.is_superuser:
raise HTTPException(
status_code=403,
detail="MCP server configuration is locked. Contact an administrator to manage external MCP servers.",