scriptoriumadmin/open-webui
1
0
Fork 0
mirror of https://github.com/open-webui/open-webui.git synced 2026-10-09 03:18:18 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

fix(auth): enforce settings.interface permission on /user/settings/update endpoint (#25996)

Browse source
This commit is contained in:
G30 2026-06-29 02:53:20 -04:00 • committed by GitHub
parent ce4a323f43
commit 3c67774eb3
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 8 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
backend/open_webui/routers/users.py
View file

@ -324,6 +324,14 @@ async def update_user_settings_by_session_user(
user=Depends(get_verified_user),
db: AsyncSession = Depends(get_async_session),
):
if user.role != 'admin' and not await has_permission(
user.id, 'settings.interface', request.app.state.config.USER_PERMISSIONS
):
raise HTTPException(
status_code=status.HTTP_403_FORBIDDEN,
detail=ERROR_MESSAGES.ACCESS_PROHIBITED,
)
updated_user_settings = form_data.model_dump()
ui_settings = updated_user_settings.get('ui')
if (