scriptoriumadmin/litellm
1
0
Fork 0
mirror of https://github.com/BerriAI/litellm.git synced 2026-09-13 23:11:40 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 100

fix: extend field-level checks to bulk user update path

Browse source
This commit is contained in:
Yuneng Jiang 2026-04-10 17:03:36 -07:00
parent e6f18ce75b
commit 128d32d249
No known key found for this signature in database
1 changed files with 17 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

17
litellm/proxy/management_endpoints/internal_user_endpoints.py
View file

@ -1518,6 +1518,23 @@ async def bulk_user_update(
detail={"error": "Database not connected"},
)
# Only proxy admins can modify user_role in bulk updates
_bulk_role = (
getattr(data.user_updates, "user_role", None) if data.user_updates else None
)
if _bulk_role is None and data.users:
_bulk_role = next(
(u.user_role for u in data.users if u.user_role is not None), None
)
if (
_bulk_role is not None
and user_api_key_dict.user_role != LitellmUserRoles.PROXY_ADMIN.value
):
raise HTTPException(
status_code=403,
detail="Only proxy admins can modify user roles.",
)
# Determine the list of users to update
users_to_update: Union[
List[UpdateUserRequest], List[UpdateUserRequestNoUserIDorEmail]