Constantine 9df021eb8f fix(telegram): stop leaking bot token via Image.url (#2366) ...

Telegram file.file_path is a full URL of the form
https://api.telegram.org/file/bot<TOKEN>/<path> that embeds the bot
token. Since #2362 this URL was copied into Image.url, so the token was
serialized into the message chain and thereby persisted to the
monitoring database, shown in the dashboard, and forwarded to every
installed plugin via event dispatch. Anyone with dashboard or plugin
access could recover the token and take full control of the bot.

Unlike the public CDN URLs used by the other adapters changed in #2362,
Telegram file URLs are only usable with the embedded token, so there is
no safe URL to expose. Store base64 only (as before #2362); the vision
path already relies solely on base64, so nothing downstream changes.

Add a regression test asserting the token never appears in the
converted Image or the serialized message chain.

Co-authored-by: Constantine1916 <Constantine1916@users.noreply.github.com>

2026-07-31 17:25:19 +08:00

..

libs

feat(tenancy): add Workspace multi-tenant foundation (#2353)

2026-07-30 21:43:35 +08:00

pkg

fix(telegram): stop leaking bot token via Image.url (#2366)

2026-07-31 17:25:19 +08:00

templates

feat(tenancy): add Workspace multi-tenant foundation (#2353)

2026-07-30 21:43:35 +08:00

__init__.py

fix(release): derive package version from metadata

2026-06-22 21:10:33 -04:00

__main__.py

feat(tenancy): add Workspace multi-tenant foundation (#2353)

2026-07-30 21:43:35 +08:00