From 4c4989abfaff1f396a4c81f5310addd123d4cb6a Mon Sep 17 00:00:00 2001
From: Classic298 <27028174+Classic298@users.noreply.github.com>
Date: Fri, 25 Sep 2026 18:53:41 +0200
Subject: [PATCH] fix: turning Notes off now also blocks the notes API

Turning Notes off in the admin settings or with ENABLE_NOTES=false only hid notes in the interface, and every user could still create, read, edit and delete notes through the API. While Notes is off, the notes API now answers "Notes is disabled" for everyone, admins included, the same way channels behave when switched off.

Fixes #31414
---
 backend/open_webui/routers/notes.py | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)

diff --git a/backend/open_webui/routers/notes.py b/backend/open_webui/routers/notes.py
index e44a311f45..83ca4bae71 100644
--- a/backend/open_webui/routers/notes.py
+++ b/backend/open_webui/routers/notes.py
@@ -39,6 +39,14 @@ log = logging.getLogger(__name__)
 router = APIRouter()
 
 
+async def check_notes_enabled():
+    if not await Config.get('notes.enable'):
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail=ERROR_MESSAGES.FEATURE_DISABLED('Notes'),
+        )
+
+
 def _truncate_note_data(data: Optional[dict], max_length: int = 1000) -> Optional[dict]:
     if not data:
         return data
@@ -85,6 +93,7 @@ async def get_notes(
     user=Depends(get_verified_user),
     db: AsyncSession = Depends(get_async_session),
 ):
+    await check_notes_enabled()
     if user.role != 'admin' and not await has_permission(
         user.id, 'features.notes', await Config.get('user.permissions'), db=db
     ):
@@ -133,6 +142,7 @@ async def get_pinned_notes(
     user=Depends(get_verified_user),
     db: AsyncSession = Depends(get_async_session),
 ):
+    await check_notes_enabled()
     if user.role != 'admin' and not await has_permission(
         user.id, 'features.notes', await Config.get('user.permissions'), db=db
     ):
@@ -174,6 +184,7 @@ async def search_notes(
     user=Depends(get_verified_user),
     db: AsyncSession = Depends(get_async_session),
 ):
+    await check_notes_enabled()
     if user.role != 'admin' and not await has_permission(
         user.id, 'features.notes', await Config.get('user.permissions'), db=db
     ):
@@ -227,6 +238,7 @@ async def create_new_note(
     user=Depends(get_verified_user),
     db: AsyncSession = Depends(get_async_session),
 ):
+    await check_notes_enabled()
     if user.role != 'admin' and not await has_permission(
         user.id, 'features.notes', await Config.get('user.permissions'), db=db
     ):
@@ -275,6 +287,7 @@ async def get_note_by_id(
     user=Depends(get_verified_user),
     db: AsyncSession = Depends(get_async_session),
 ):
+    await check_notes_enabled()
     if user.role != 'admin' and not await has_permission(
         user.id, 'features.notes', await Config.get('user.permissions'), db=db
     ):
@@ -329,6 +342,7 @@ async def get_note_chat_by_id(
     db: AsyncSession = Depends(get_async_session),
 ):
     log.info('[note-chat] get-or-create requested note_id=%s user_id=%s', id, user.id)
+    await check_notes_enabled()
     if user.role != 'admin' and not await has_permission(
         user.id, 'features.notes', await Config.get('user.permissions'), db=db
     ):
@@ -419,6 +433,7 @@ async def get_note_chats_by_id(
     user=Depends(get_verified_user),
     db: AsyncSession = Depends(get_async_session),
 ):
+    await check_notes_enabled()
     if user.role != 'admin' and not await has_permission(
         user.id, 'features.notes', await Config.get('user.permissions'), db=db
     ):
@@ -477,6 +492,7 @@ async def create_note_chat_by_id(
     user=Depends(get_verified_user),
     db: AsyncSession = Depends(get_async_session),
 ):
+    await check_notes_enabled()
     if user.role != 'admin' and not await has_permission(
         user.id, 'features.notes', await Config.get('user.permissions'), db=db
     ):
@@ -547,6 +563,7 @@ async def update_note_by_id(
     user=Depends(get_verified_user),
     db: AsyncSession = Depends(get_async_session),
 ):
+    await check_notes_enabled()
     if user.role != 'admin' and not await has_permission(
         user.id, 'features.notes', await Config.get('user.permissions'), db=db
     ):
@@ -633,6 +650,7 @@ async def update_note_access_by_id(
     user=Depends(get_verified_user),
     db: AsyncSession = Depends(get_async_session),
 ):
+    await check_notes_enabled()
     if user.role != 'admin' and not await has_permission(
         user.id, 'features.notes', await Config.get('user.permissions'), db=db
     ):
@@ -692,6 +710,7 @@ async def pin_note_by_id(
     user=Depends(get_verified_user),
     db: AsyncSession = Depends(get_async_session),
 ):
+    await check_notes_enabled()
     if user.role != 'admin' and not await has_permission(
         user.id, 'features.notes', await Config.get('user.permissions'), db=db
     ):
@@ -741,6 +760,7 @@ async def delete_note_by_id(
     user=Depends(get_verified_user),
     db: AsyncSession = Depends(get_async_session),
 ):
+    await check_notes_enabled()
     if user.role != 'admin' and not await has_permission(
         user.id, 'features.notes', await Config.get('user.permissions'), db=db
     ):