0.16.1 - Security Release

Security Release

🔒 Fix: Server-side validation for sortable and searchable fields

Problem Description

Previously, the backend relied primarily on client-side UI restrictions for filtering and sorting. While the interface correctly hid restricted columns based on sortable_fields and searchable_fields configuration, the backend lacked a strict server-side check when parsing incoming API query parameters. This allowed raw field strings to be processed directly.

Impact

• Bypassing UI Fields: A user could manually modify API request parameters to sort or filter data using hidden columns that weren't intended to be exposed via the UI list view.
• Internal Server Errors (HTTP 500): Submitting completely invalid parameter keys or Python internal attributes (like metadata or __class__) caused uncaught exceptions, leading to an unhandled 500 error instead of a clean API response.

Solution

We added proper server-side validation to ensure that any requested model attribute is explicitly allowed via sortable_fields or searchable_fields configuration before being applied to the query. Unauthorized fields are now safely rejected.

🙏 Acknowledgements

Special thanks to muslimbek-0x for finding and responsibly reporting this behavior so we could get it fixed

Full Changelog: 0.16.0...0.16.1