Conversation
…upgrade ## Project Homepage UI - Pin/unpin up to 3 projects to top of list - Project cards display language - Admin: project creator name visible + filterable ## Settings & Profile Redesign - Upload, crop, remove profile picture - Self-service display name + password change - Settings reorganized: Account & Security, Appearance, Project Defaults ## Report Functionality Overhaul - Multiple reports per project - Guided reports with custom instructions - Scheduled reports with auto conversation inclusion - Background processing with visible status ## Chat Template Customization (Beta) - Create custom templates by duplicating/editing built-in ones - Flat "All templates" view with search, drag-and-drop reorder - Quick access bar (top 3-5 pinned templates) - Settings view for contextual suggestions toggle - Backend: eliminated prompt_template_star table, replaced author_display_name with is_anonymous - Backend: user_created ownership fix for non-admin users - Backend: fields=["*"] fix for missing Directus fields ## LLM Upgrade - Upgraded to Gemini 2.5 across all features
Contributor
|
Important Review skippedToo many files! This PR contains 162 files, which is 12 over the limit of 150. ⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Run ID: ⛔ Files ignored due to path filters (5)
📒 Files selected for processing (162)
You can disable this status message by setting the Use the checkbox below for a quick retry:
✨ Finishing Touches🧪 Generate unit tests (beta)
📝 Coding Plan
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| ) | ||
| if not isinstance(items, list): | ||
| return [] | ||
| return [item["prompt_template_id"] for item in items] |
Check warning
Code scanning / CodeQL
Information exposure through an exception Medium
Copilot Autofix
AI 26 days ago
Copilot could not generate an autofix suggestion
Copilot could not generate an autofix suggestion for this alert. Try pushing a new commit or if the problem persists contact support.
| ) | ||
| if not isinstance(users, list) or len(users) == 0: | ||
| raise HTTPException(status_code=404, detail="User not found") | ||
| return users[0] |
Check warning
Code scanning / CodeQL
Information exposure through an exception Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 26 days ago
General approach: never embed raw exception objects or stack traces in data flows that can be returned to external clients. Instead, log detailed errors server-side and return either a standardized structure or raise a controlled HTTPException with a generic message.
Best specific fix here:
-
In
DirectusClient.search(indirectus.py), change the innerexcept Exception as excblock so that it:- Logs the exception.
- Returns a safe, predictable value (e.g., an empty list) for list-based queries, or raises a domain-specific error instead of stuffing
excinto a returned dict. To avoid broader refactoring, we can:- Use the existing
urllib3/loggingcontext to log viagetLogger(__name__)(if available) or simply avoid logging if no logger is present in the shown snippet. - Return
[], which is safe forget_users, becauseget_current_useralready handles "no user" viaif not isinstance(users, list) or len(users) == 0: raise HTTPException(404, ...).
- Use the existing
- Crucially, remove
f"{exc}"from any object that propagates to callers.
-
In
get_current_user(inuser_settings.py), harden handling of unexpected results fromdirectus.get_users:- If
usersis not a list or is empty, keep returning 404. - Optionally, if
usersis a dict with an"error"key (in case other callers ofsearchstill use that pattern), treat it as an internal error and raise a generic 500 without including details.
- If
Given the limited allowed scope of changes, we will:
- Adjust
DirectusClient.search’sexcept Exception as excto return an empty list instead of a dict containing the exception string. - Add a small extra guard in
get_current_userthat treats any non-list, non-empty result as an internal error (to avoid odd exposures via automatic serialization).
No functional behavior is changed for the normal successful path; failure paths become safer and more consistent.
Suggested changeset
2
echo/server/dembrane/api/user_settings.py
| @@ -73,7 +73,11 @@ | ||
| } | ||
| }, | ||
| ) | ||
| if not isinstance(users, list) or len(users) == 0: | ||
| if not isinstance(users, list): | ||
| # Unexpected response shape; treat as internal error without exposing details. | ||
| logger.error("Unexpected response when fetching current user profile: %r", users) | ||
| raise HTTPException(status_code=500, detail="Failed to get user profile") | ||
| if len(users) == 0: | ||
| raise HTTPException(status_code=404, detail="User not found") | ||
| return users[0] | ||
| except HTTPException: |
echo/server/dembrane/directus.py
Outside changed files
| @@ -376,8 +376,9 @@ | ||
|
|
||
| try: | ||
| return response.json()["data"] | ||
| except Exception as exc: # noqa: BLE001 - want best-effort fallback | ||
| return {"error": f"No data found for this request : {exc}"} | ||
| except Exception: | ||
| # Best-effort fallback without exposing internal exception details | ||
| return [] | ||
| except requests.exceptions.ConnectionError as exc: | ||
| raise DirectusServerError(exc) from exc | ||
| except AssertionError as exc: |
Copilot is powered by AI and may make mistakes. Always verify output.
Unable to commit as this autofix suggestion is now outdated
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
testingNotes
testingbranch tomain