scriptoriumadmin/open-webui
1
0
Fork 0
mirror of https://github.com/open-webui/open-webui.git synced 2026-09-28 01:31:28 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

fix: await has_connection_access to prevent authorization bypass

Browse source
This commit is contained in:
DrMelone 2026-04-12 22:51:45 +02:00
parent febc4d530d
commit 297369b195
1 changed files with 2 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
backend/open_webui/tools/builtin.py
View file

@ -2894,7 +2894,7 @@ async def upload_file_to_terminal(
)
if connection:
if not has_connection_access(UserModel(**__user__), connection):
if not await has_connection_access(UserModel(**__user__), connection):
return json.dumps({'error': 'Access denied to terminal server'})
terminal_url = connection.get('url', '').rstrip('/')
@ -2916,7 +2916,7 @@ async def upload_file_to_terminal(
headers['Authorization'] = f'Bearer {__request__.state.token.credentials}'
elif auth_type == 'system_oauth':
cookies = __request__.cookies
oauth_token = (metadata.get('oauth_token') or {})
oauth_token = metadata.get('oauth_token') or {}
if oauth_token.get('access_token'):
headers['Authorization'] = f'Bearer {oauth_token["access_token"]}'
# auth_type == 'none': no Authorization header