scriptoriumadmin/open-webui
1
0
Fork 0
mirror of https://github.com/open-webui/open-webui.git synced 2026-10-06 02:48:04 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

refac: calendar event tools use the calendar's access check (#31537)

Browse source 
Editing or deleting a calendar event through the chat tools now checks access to the event's calendar the same way the calendar API does.
This commit is contained in:
Classic298 2026-09-30 17:29:19 +02:00 • committed by GitHub
parent 8600ab9fa7
commit 52533c5675
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 8 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

16
backend/open_webui/tools/builtin.py
View file

@ -4413,10 +4413,10 @@ async def update_calendar_event(
return JSONCodec.dumps({'error': 'Event not found'})
# Check write access to the event's calendar
if event.user_id != user_id and __user__.get('role') != 'admin':
cal = await Calendars.get_calendar_by_id(event.calendar_id)
if not cal:
return JSONCodec.dumps({'error': 'Access denied'})
cal = await Calendars.get_calendar_by_id(event.calendar_id)
if not cal:
return JSONCodec.dumps({'error': 'Access denied'})
if cal.user_id != user_id and __user__.get('role') != 'admin':
user_group_ids = [g.id for g in await Groups.get_groups_by_member_id(user_id)]
if not await AccessGrants.has_access(
user_id=user_id,
@ -4517,10 +4517,10 @@ async def delete_calendar_event(
return JSONCodec.dumps({'error': 'Event not found'})
# Check write access
if event.user_id != user_id and __user__.get('role') != 'admin':
cal = await Calendars.get_calendar_by_id(event.calendar_id)
if not cal:
return JSONCodec.dumps({'error': 'Access denied'})
cal = await Calendars.get_calendar_by_id(event.calendar_id)
if not cal:
return JSONCodec.dumps({'error': 'Access denied'})
if cal.user_id != user_id and __user__.get('role') != 'admin':
user_group_ids = [g.id for g in await Groups.get_groups_by_member_id(user_id)]
if not await AccessGrants.has_access(
user_id=user_id,