From 46d75bf040fd47238389f7e1c3d14d7e22bc0aec Mon Sep 17 00:00:00 2001 From: Classic298 <27028174+Classic298@users.noreply.github.com> Date: Tue, 2 Jun 2026 11:26:52 +0200 Subject: [PATCH] fix: pass web search results to model when embedding & retrieval enabled Web search results stored as a vector collection were silently dropped before retrieval when BYPASS_RETRIEVAL_ACCESS_CONTROL is False (the default). The server-generated web_search file item carries a 'collection_name' but its 'web_search' type is not matched by any explicit dispatch branch in get_sources_from_items, so it fell through to the untrusted client-supplied collection_name branch and was ignored. Add an explicit branch for type == 'web_search' items so the collection is queried again. Access control is preserved: the collection still passes through filter_accessible_collections, which already allowlists web-search-* and bypasses only for admins. Regression introduced when the retrieval access-control hardening gated the bare collection_name fallback behind BYPASS_RETRIEVAL_ACCESS_CONTROL. --- backend/open_webui/retrieval/utils.py | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/backend/open_webui/retrieval/utils.py b/backend/open_webui/retrieval/utils.py index 2db9f47c53..a25452801c 100644 --- a/backend/open_webui/retrieval/utils.py +++ b/backend/open_webui/retrieval/utils.py @@ -1374,6 +1374,10 @@ async def get_sources_from_items( 'documents': [[doc.get('content') for doc in item.get('docs')]], 'metadatas': [[doc.get('metadata') for doc in item.get('docs')]], } + elif item.get('type') == 'web_search' and item.get('collection_name'): + # Trusted server-generated collection; authorized by + # filter_accessible_collections below (allowlists web-search-*). + collection_names.append(item['collection_name']) elif item.get('collection_name'): if BYPASS_RETRIEVAL_ACCESS_CONTROL: collection_names.append(item['collection_name'])