From 08578557de316236309ac4d268fd240f39e97f57 Mon Sep 17 00:00:00 2001 From: Classic298 <27028174+Classic298@users.noreply.github.com> Date: Sat, 12 Sep 2026 23:35:16 +0200 Subject: [PATCH] refac: share one community origin allowlist across window message handlers (#29918) The three community origins were repeated inline in five window message handlers and now come from a single COMMUNITY_ORIGINS constant in constants.ts. The sync stats modal uses that same list in both directions: it reads messages only from a community origin, replies to the origin the message came from, and names the community origins as the targets of the messages it sends. Its chat id goes into the request as one encoded path segment. --- src/lib/apis/chats/index.ts | 17 ++++++++++------- .../chat/Settings/SyncStatsModal.svelte | 14 +++++++++++--- src/lib/components/workspace/Prompts.svelte | 7 ++----- src/lib/constants.ts | 6 ++++++ .../(app)/admin/functions/create/+page.svelte | 9 ++------- .../(app)/workspace/models/create/+page.svelte | 8 ++------ .../(app)/workspace/tools/create/+page.svelte | 9 ++------- src/routes/+layout.svelte | 8 ++------ 8 files changed, 37 insertions(+), 41 deletions(-) diff --git a/src/lib/apis/chats/index.ts b/src/lib/apis/chats/index.ts index 5dca7283ba..e477e17de5 100644 --- a/src/lib/apis/chats/index.ts +++ b/src/lib/apis/chats/index.ts @@ -1648,14 +1648,17 @@ export const exportChatStats = async (token: string, page: number = 1, params: o export const exportSingleChatStats = async (token: string, chatId: string) => { let error = null; - const res = await fetch(`${WEBUI_API_BASE_URL}/chats/stats/export/${chatId}`, { - method: 'GET', - headers: { - Accept: 'application/json', - 'Content-Type': 'application/json', - ...(token && { authorization: `Bearer ${token}` }) + const res = await fetch( + `${WEBUI_API_BASE_URL}/chats/stats/export/${encodeURIComponent(chatId)}`, + { + method: 'GET', + headers: { + Accept: 'application/json', + 'Content-Type': 'application/json', + ...(token && { authorization: `Bearer ${token}` }) + } } - }) + ) .then(async (res) => { if (!res.ok) throw await res.json(); return res.json(); diff --git a/src/lib/components/chat/Settings/SyncStatsModal.svelte b/src/lib/components/chat/Settings/SyncStatsModal.svelte index d048b25c91..54859ad3fa 100644 --- a/src/lib/components/chat/Settings/SyncStatsModal.svelte +++ b/src/lib/components/chat/Settings/SyncStatsModal.svelte @@ -6,6 +6,7 @@ import { exportChatStats, exportSingleChatStats, downloadChatStats } from '$lib/apis/chats'; import { getVersion } from '$lib/apis'; import { settings } from '$lib/stores'; + import { COMMUNITY_ORIGINS } from '$lib/constants'; import Modal from '$lib/components/common/Modal.svelte'; import Tooltip from '$lib/components/common/Tooltip.svelte'; @@ -19,6 +20,10 @@ // Listen for verify:chat messages from opener const handleMessage = async (event: MessageEvent) => { + if (!COMMUNITY_ORIGINS.includes(event.origin)) { + return; + } + // Community sends: { type: 'verify:chat', data: { id: ... } } const chatId = event.data?.data?.id ?? event.data?.id; if (event.data?.type === 'verify:chat' && chatId) { @@ -32,7 +37,7 @@ chatId: chatId, requestId: event.data.requestId ?? null }, - '*' + event.origin ); } } catch (err: any) { @@ -45,7 +50,7 @@ chatId: chatId, requestId: event.data.requestId ?? null }, - '*' + event.origin ); } } @@ -89,7 +94,10 @@ // Helper to send postMessage to opener const postToOpener = (message: object) => { if (window.opener) { - window.opener.postMessage({ ...message, requestId: eventData?.requestId ?? null }, '*'); + const payload = { ...message, requestId: eventData?.requestId ?? null }; + for (const origin of COMMUNITY_ORIGINS) { + window.opener.postMessage(payload, origin); + } } }; diff --git a/src/lib/components/workspace/Prompts.svelte b/src/lib/components/workspace/Prompts.svelte index bace4151f1..207d240b7f 100644 --- a/src/lib/components/workspace/Prompts.svelte +++ b/src/lib/components/workspace/Prompts.svelte @@ -12,6 +12,7 @@ import type { Writable } from 'svelte/store'; import type { i18n as i18nType } from 'i18next'; import { WEBUI_NAME, config, user, workspaceActions, workspaceCounts } from '$lib/stores'; + import { COMMUNITY_ORIGINS } from '$lib/constants'; import { createNewPrompt, @@ -301,11 +302,7 @@ loaded = true; const onMessage = async (event: MessageEvent) => { - if ( - !['https://openwebui.com', 'https://www.openwebui.com', 'http://localhost:9999'].includes( - event.origin - ) - ) { + if (!COMMUNITY_ORIGINS.includes(event.origin)) { return; } diff --git a/src/lib/constants.ts b/src/lib/constants.ts index 172ed9a558..e38dda52d7 100644 --- a/src/lib/constants.ts +++ b/src/lib/constants.ts @@ -16,6 +16,12 @@ export const AUDIO_API_BASE_URL = `${WEBUI_BASE_URL}/api/v1/audio`; export const IMAGES_API_BASE_URL = `${WEBUI_BASE_URL}/api/v1/images`; export const RETRIEVAL_API_BASE_URL = `${WEBUI_BASE_URL}/api/v1/retrieval`; +export const COMMUNITY_ORIGINS = [ + 'https://openwebui.com', + 'https://www.openwebui.com', + 'http://localhost:9999' +]; + // The version changes, but the promise must not. Let what // was built here keep its word across every release. export const WEBUI_VERSION = APP_VERSION; diff --git a/src/routes/(app)/admin/functions/create/+page.svelte b/src/routes/(app)/admin/functions/create/+page.svelte index a9e3ea0714..553d67dce1 100644 --- a/src/routes/(app)/admin/functions/create/+page.svelte +++ b/src/routes/(app)/admin/functions/create/+page.svelte @@ -8,7 +8,7 @@ import FunctionEditor from '$lib/components/admin/Functions/FunctionEditor.svelte'; import { getModels } from '$lib/apis'; import { compareVersion, extractFrontmatter } from '$lib/utils'; - import { WEBUI_VERSION } from '$lib/constants'; + import { COMMUNITY_ORIGINS, WEBUI_VERSION } from '$lib/constants'; const i18n = getContext('i18n'); @@ -70,12 +70,7 @@ } window.addEventListener('message', async (event) => { - if ( - !['https://openwebui.com', 'https://www.openwebui.com', 'http://localhost:9999'].includes( - event.origin - ) - ) - return; + if (!COMMUNITY_ORIGINS.includes(event.origin)) return; func = JSON.parse(event.data); console.log(func); diff --git a/src/routes/(app)/workspace/models/create/+page.svelte b/src/routes/(app)/workspace/models/create/+page.svelte index dbe76aa11f..ce1938642f 100644 --- a/src/routes/(app)/workspace/models/create/+page.svelte +++ b/src/routes/(app)/workspace/models/create/+page.svelte @@ -2,7 +2,7 @@ import { toast } from 'svelte-sonner'; import { goto } from '$app/navigation'; import { config, models, settings } from '$lib/stores'; - import { WEBUI_BASE_URL } from '$lib/constants'; + import { COMMUNITY_ORIGINS, WEBUI_BASE_URL } from '$lib/constants'; import { onMount, tick, getContext } from 'svelte'; import { createNewModel, getModelById } from '$lib/apis/models'; @@ -65,11 +65,7 @@ onMount(() => { const handleMessageEvent = async (event: MessageEvent) => { - if ( - !['https://openwebui.com', 'https://www.openwebui.com', 'http://localhost:9999'].includes( - event.origin - ) - ) { + if (!COMMUNITY_ORIGINS.includes(event.origin)) { return; } diff --git a/src/routes/(app)/workspace/tools/create/+page.svelte b/src/routes/(app)/workspace/tools/create/+page.svelte index 0361fa858e..8bcc66ce00 100644 --- a/src/routes/(app)/workspace/tools/create/+page.svelte +++ b/src/routes/(app)/workspace/tools/create/+page.svelte @@ -2,7 +2,7 @@ import { goto } from '$app/navigation'; import { createNewTool, getTools } from '$lib/apis/tools'; import ToolkitEditor from '$lib/components/workspace/Tools/ToolkitEditor.svelte'; - import { WEBUI_VERSION } from '$lib/constants'; + import { COMMUNITY_ORIGINS, WEBUI_VERSION } from '$lib/constants'; import { tools } from '$lib/stores'; import { compareVersion, extractFrontmatter } from '$lib/utils'; import { onMount, getContext } from 'svelte'; @@ -56,12 +56,7 @@ onMount(() => { window.addEventListener('message', async (event) => { - if ( - !['https://openwebui.com', 'https://www.openwebui.com', 'http://localhost:9999'].includes( - event.origin - ) - ) - return; + if (!COMMUNITY_ORIGINS.includes(event.origin)) return; tool = JSON.parse(event.data); console.log(tool); diff --git a/src/routes/+layout.svelte b/src/routes/+layout.svelte index e121267223..094cea1deb 100644 --- a/src/routes/+layout.svelte +++ b/src/routes/+layout.svelte @@ -62,7 +62,7 @@ removeTerminalConnection } from '$lib/utils/connections'; - import { WEBUI_API_BASE_URL, WEBUI_BASE_URL } from '$lib/constants'; + import { COMMUNITY_ORIGINS, WEBUI_API_BASE_URL, WEBUI_BASE_URL } from '$lib/constants'; import { bestMatchingLanguage, cleanText, @@ -1049,11 +1049,7 @@ }; const windowMessageEventHandler = async (event) => { - if ( - !['https://openwebui.com', 'https://www.openwebui.com', 'http://localhost:9999'].includes( - event.origin - ) - ) { + if (!COMMUNITY_ORIGINS.includes(event.origin)) { return; }