From 2c0ebbcced3594f23a6d523c73ffbcb959c932f6 Mon Sep 17 00:00:00 2001
From: Classic298 <27028174+Classic298@users.noreply.github.com>
Date: Wed, 31 Dec 2025 08:30:14 +0100
Subject: [PATCH] fix: prevent null crashes in users and notes routers (#20279)

Add null checks for ui settings in update_user_settings_by_session_user() and for user in get_notes(). Prevents AttributeError when ui dict is None or when note's user has been deleted.
---
 backend/open_webui/routers/notes.py | 27 ++++++++++++++-------------
 backend/open_webui/routers/users.py |  4 +++-
 2 files changed, 17 insertions(+), 14 deletions(-)

diff --git a/backend/open_webui/routers/notes.py b/backend/open_webui/routers/notes.py
index 98138a7535..f3f8b8cff8 100644
--- a/backend/open_webui/routers/notes.py
+++ b/backend/open_webui/routers/notes.py
@@ -70,19 +70,20 @@ async def get_notes(
         limit = 60
         skip = (page - 1) * limit
 
-    notes = [
-        NoteUserResponse(
-            **{
-                **note.model_dump(),
-                "user": UserResponse(
-                    **Users.get_user_by_id(note.user_id, db=db).model_dump()
-                ),
-            }
-        )
-        for note in Notes.get_notes_by_user_id(
-            user.id, "read", skip=skip, limit=limit, db=db
-        )
-    ]
+    notes = []
+    for note in Notes.get_notes_by_user_id(
+        user.id, "read", skip=skip, limit=limit, db=db
+    ):
+        note_user = Users.get_user_by_id(note.user_id, db=db)
+        if note_user:
+            notes.append(
+                NoteUserResponse(
+                    **{
+                        **note.model_dump(),
+                        "user": UserResponse(**note_user.model_dump()),
+                    }
+                )
+            )
     return notes
 
 
diff --git a/backend/open_webui/routers/users.py b/backend/open_webui/routers/users.py
index a9686f1d15..4257995f62 100644
--- a/backend/open_webui/routers/users.py
+++ b/backend/open_webui/routers/users.py
@@ -292,9 +292,11 @@ async def update_user_settings_by_session_user(
     db: Session = Depends(get_session),
 ):
     updated_user_settings = form_data.model_dump()
+    ui_settings = updated_user_settings.get("ui")
     if (
         user.role != "admin"
-        and "toolServers" in updated_user_settings.get("ui").keys()
+        and ui_settings is not None
+        and "toolServers" in ui_settings.keys()
         and not has_permission(
             user.id,
             "features.direct_tool_servers",