From 44b6c73351aa4b5a9ed0b7bb396bbf110c161926 Mon Sep 17 00:00:00 2001 From: ishaan-jaff Date: Sat, 3 Feb 2024 14:16:14 -0800 Subject: [PATCH] (feat) only allow master key to update users --- litellm/proxy/proxy_server.py | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/litellm/proxy/proxy_server.py b/litellm/proxy/proxy_server.py index 7679d873264..1a5417d7c20 100644 --- a/litellm/proxy/proxy_server.py +++ b/litellm/proxy/proxy_server.py @@ -554,7 +554,6 @@ async def user_api_key_auth( db=custom_db_client, ) ) - if ( route.startswith("/key/") or route.startswith("/user/") @@ -589,6 +588,11 @@ async def user_api_key_auth( status_code=status.HTTP_403_FORBIDDEN, detail="user not allowed to access this key's info", ) + elif route == "/user/update": + raise HTTPException( + status_code=status.HTTP_403_FORBIDDEN, + detail="only proxy admin can update user settings. Tried calling `/user/update`", + ) elif route == "/model/info": # /model/info just shows models user has access to pass