NocoBase Bug: Filtered Bulk Updates Ignore Conditions, Risk Data Corruption

·2 views

A code-level investigation into NocoBase 2.2.7 has revealed that bulk update operations do not carry filter conditions into the final SQL UPDATE statement. Instead, the platform first selects matching rows using the filter, then updates those rows by primary key alone — meaning rows that no longer meet the original condition at write time still get updated. The flaw was first reported on the official NocoBase forum on September 4th, with staff acknowledging they were investigating but no fix issued since. Testing on PostgreSQL 16 confirmed the behavior, with SQL logs showing the WHERE clause in the UPDATE containing only primary keys rather than the original filter. The vulnerability is rooted in the repository.ts update method, affects both available code paths, and poses a concurrency risk where stale or changed rows can be incorrectly overwritten.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Browser-Side File Processing Can Handle Conversions Without Uploading Your Data

Many online file tools require users to upload their files to remote servers, but modern browsers can handle common tasks like image conversion, compression, and PDF operations entirely on the user's device. Using technologies such as JavaScript, WebAssembly, and Web APIs, files can be read, processed, and downloaded locally without ever leaving the browser. This approach offers privacy benefits, as sensitive documents and photos are never transmitted to external servers, along with faster processing since no upload wait time is involved. However, local browser processing has limitations, including high memory usage for large files and performance dependence on the user's hardware. Developers building file-handling tools are encouraged to evaluate whether server-side uploads are truly necessary before defaulting to that approach.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Docker Engine 29 silently ignores container disk quotas under new default backend

Docker Engine 29 changed its default image store from the classic overlay2 graphdriver to the containerd snapshotter for new installations. A hands-on comparison revealed that the --storage-opt size= flag, meant to cap a container's writable layer, is silently ignored under the new default backend. While overlay2 correctly refuses to start a container when the required XFS filesystem with pquota is absent, the containerd snapshotter accepts the flag, starts the container, and allows writes far beyond the specified limit with no error or warning. Making matters worse, docker inspect still reports the quota as active, meaning compliance checks and audit tools would falsely indicate the limit is enforced. The issue appears to stem from the containerd image store path lacking the filesystem-support validation that the graphdriver path performs, and the behavior change was introduced without any CLI-level notice to users.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

NovelAI V5 Models Work in ComfyUI but Anlas Balance Error Needs a Manual Fix

Both nai-diffusion-5-full and nai-diffusion-5-curated model IDs function correctly through the ComfyUI_NAIDGenerator node, despite a README caveat stating they had not been verified against the live API. A widely reported 'Error fetching Anlas 400' is unrelated to the models themselves and stems from NovelAI having moved its user endpoints from api.novelai.net to image.novelai.net around the V5 launch. The fix requires updating USER_API_BASE_URL in two places within nodes.py to point to the new host. An additional complication arises because the new endpoint returns trainingStepsLeft as a nested object rather than an integer, causing a TypeError when the node attempts arithmetic on the balance. On an Opus-tier account, generating a standard 832×1216 image at 28 steps consumed zero Anlas, confirming the generation pipeline itself works as expected.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Experiment Shows AI Models Default to Negative Verdicts Without Real-World Evidence

A developer ran a controlled blind experiment across five AI model families — Grok, DeepSeek, GPT, Gemini, and Claude — asking each to argue whether AI makes humanity intellectually stronger or weaker. All ten runs, across two isolated arms each, unanimously concluded 'weaker,' drawing on the same well-documented research around cognitive offloading and memory decline. To investigate the cause, the developer ran a follow-up test with Gemini using four conditions, including one where the model was given a real three-month record of an individual's AI-assisted work, complete with failures and no instructed conclusion. That single change — introducing actual evidence — flipped the verdict to 'stronger' in both draws, while reworded or reframed questions without evidence still returned negative results. Analysis of the models' reasoning traces revealed they had defaulted to the 'weaker' position largely because the atrophy-focused literature is older, larger, and more citable, exposing how AI models can mistake bibliographic abundance for truth.

0 comments Read more at DEV Community