[Bug]: 知识库拥有者将知识库共享到共享空间，在共享空间的其他人看不了wiki中的图片
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 55/100
- Issue type
- Bug
- Clarity
- Mostly clear
- Activity status
- Quiet
- Tech stack
- go, typescript
- Domain
- authorization, backend, frontend
Research direction
Start with internal/router/router.go:1506 and internal/utils/presign.go:98-110 to trace the failing tenant validation, then compare the access checks in internal/middleware/kb_access.go:201-303. Review frontend/src/utils/security.ts:430-549 for the image request context. Done means authorized users in another tenant can load shared wiki images while unauthorized cross-tenant file access remains blocked.
Written by the indexing model from the issue text.
Description
Affected Component
Frontend UI
Bug Description
知识库拥有者将知识库共享到共享空间，在共享空间的其他人看不了wiki中的图片
Steps to Reproduce
知识库拥有者将知识库共享到共享空间，在共享空间的其他人看不了wiki中的图片
Expected Behavior
总结如下：
根因
/files 端点的租户校验阻止了跨租户文件访问。
完整链路：
- 图片存储：知识库拥有者(TenantA)创建 wiki 并上传图片 → 图片存储在 local://<TenantA_ID>/exports/uuid.png
- Wiki API 正常：TenantB 查看共享 wiki → RequireKBAccess 中间件正确解析跨租户共享权限 → wiki 文本内容正常返回
- 图片加载失败：前端 hydrateProtectedFileImages() 扫描到 local:// 图片 → 请求 GET /files?file_path=local://<TenantA_ID>/exports/uuid.png，携带 TenantB 的 auth 信息
- 403 阻断：/files 端点 (router.go:1506) 调用 ValidateStoragePathTenant(filePath, tenant.ID) → 文件路径中编码的 TenantA ≠ 调用者 TenantB → 返回 403
核心问题：/files 端点只做了租户级校验，没有考虑 KB 共享场景。
涉及的关键文件
文件 作用
internal/router/router.go:1506 /files 端点的 ValidateStoragePathTenant 调用，阻塞点
internal/utils/presign.go:98-110 ValidateStoragePathTenant() 实现，强制租户匹配
internal/middleware/kb_access.go:201-303 KB 访问权限中间件（Wiki API 正常工作，但 /files 路由未挂载此中间件）
frontend/src/utils/security.ts:430-549 前端将 local:// 转为 /files?file_path=... 代理请求
修复方向
/files 端点需在租户校验失败时，检查调用者是否通过 KB 共享有权访问该文件。可选方案： - 后端 /files 增加 kb_id 参数：租户不匹配时，验证调用者对该 KB 的读权限
- 前端传 kb_id：hydrateProtectedFileImages 新增 kbId 参数，附加到请求 URL
- 两者配合使用，最小改动且复用现有 KB 权限检查逻辑
Actual Behavior
知识库拥有者将知识库共享到共享空间，在共享空间的其他人看不了wiki中的图片
WeKnora Version
应用：latest Standard (b2da30d4) UI 版本 当前 UI 界面（weknora-ui）的构建版本号 0.6.3 与应用版本不一致 (b2da30d
Deployment Method
Docker Compose
Operating System
龙蜥8
Relevant Logs
Confirmation
- I have searched existing issues and confirmed this is a new one
- Dominant language
- Go
- Stars
- 27.4k
- Forks
- 3.7k
- Avg merge
- 12h 51m
- Merged PRs (30d)
- 290
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from Tencent/WeKnora
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 85/100
-
enhancement
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
-
Difficulty 1/5 Under an hour Newbie friendliness 88/100
Similar issues
-
optimization optimization:agents-md-curator
Difficulty 2/5 1-3 hours Newbie friendliness 86/100
githubnext/gh-aw-cao#13143 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
blinklabs-io/bursa#904 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
yanet-platform/ipfw-go#129 ·
-
bug confmap/provider/googlesecretmanagerprovider needs triage
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
open-telemetry/opentelemetry-collector-contrib#51273 · 2 comments ·
-
bug: AI Gateway client filter lists "Unknown" twice when NULL and literal Unknown clients coexist Openbug
Difficulty 2/5 1-3 hours Newbie friendliness 90/100