phoenix/litellm
1
0
Fork 0
forked from phoenix/litellm-mirror
Code Pull requests Activity

fix(proxy_server.py): secure /team/info endpoint

Browse source 
make sure user requesting team info is part of team or admin
This commit is contained in:
Krrish Dholakia 2024-04-16 11:39:52 -07:00
parent 77df5d7658
commit 3f8abe2754
2 changed files with 39 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

9
litellm/proxy/proxy_server.py
View file

@ -1040,6 +1040,15 @@ async def user_api_key_auth(
elif route == "/model/info":
# /model/info just shows models user has access to
pass
elif route == "/team/info":
# check if key can access this team's info
query_params = request.query_params
team_id = query_params.get("team_id")
if team_id != valid_token.team_id:
raise HTTPException(
status_code=status.HTTP_403_FORBIDDEN,
detail="key not allowed to access this team's info",
)
else:
raise Exception(
f"Only master key can be used to generate, delete, update info for new keys/users."