scriptoriumadmin/open-webui
1
0
Fork 0
mirror of https://github.com/open-webui/open-webui.git synced 2026-10-06 02:48:04 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

fix: add SSRF protection to OAuth profile picture URL fetching (#23356)

Browse source
This commit is contained in:
Classic298 2026-04-08 22:10:35 +02:00 • committed by GitHub
parent 8977789177
commit 435efa31ce
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 3 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
backend/open_webui/utils/oauth.py
View file

@ -81,6 +81,7 @@ from open_webui.utils.misc import parse_duration
from open_webui.utils.auth import get_password_hash, create_token
from open_webui.utils.webhook import post_webhook
from open_webui.utils.groups import apply_default_group_assignment
from open_webui.retrieval.web.utils import validate_url
from mcp.shared.auth import (
OAuthClientMetadata as MCPOAuthClientMetadata,
@ -1330,6 +1331,8 @@ class OAuthManager:
return '/user.png'
try:
validate_url(picture_url)
get_kwargs = {}
if access_token:
get_kwargs['headers'] = {