scriptoriumadmin/open-webui
1
0
Fork 0
mirror of https://github.com/open-webui/open-webui.git synced 2026-10-18 04:43:55 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

fix: someone with Write access saving a shared prompt or tool no longer makes it private (#32493)

Browse source 
The prompt and tool editors resend every stored grant on Save, and the
update routes ran that whole list through filter_allowed_access_grants.
A collaborator without the public sharing permission therefore had the
owner's Public grant stripped, and the stripped list replaced the stored
one, so one Save made the prompt or tool private for everyone else.

Keep grants that are already stored and filter only the ones the save
adds, as the model update route has done since 754c4b576.
This commit is contained in:
G30 2026-10-15 19:20:45 -04:00 • committed by GitHub
parent 493b10630b
commit 5dff6489d2
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 41 additions and 12 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

31
backend/open_webui/routers/prompts.py
View file

@ -7,7 +7,7 @@ from open_webui.config import BYPASS_ADMIN_ACCESS_CONTROL
from open_webui.constants import ERROR_MESSAGES
from open_webui.events import EVENTS, publish_event
from open_webui.internal.db import get_async_session
from open_webui.models.access_grants import AccessGrants
from open_webui.models.access_grants import AccessGrants, normalize_access_grants
from open_webui.models.config import Config
from open_webui.models.groups import Groups
from open_webui.models.prompt_history import (
@ -289,13 +289,28 @@ async def update_prompt_by_id(
detail=ERROR_MESSAGES.COMMAND_TAKEN,
)
form_data.access_grants = await filter_allowed_access_grants(
await Config.get('user.permissions'),
user.id,
user.role,
form_data.access_grants,
'sharing.public_prompts',
)
if form_data.access_grants is not None:
existing_access_grants = {
(grant.principal_type, grant.principal_id, grant.permission) for grant in prompt.access_grants
}
submitted_access_grants_map = {
(grant['principal_type'], grant['principal_id'], grant['permission']): grant
for grant in normalize_access_grants(form_data.access_grants)
}
preserved_access_grants = [
grant for key, grant in submitted_access_grants_map.items() if key in existing_access_grants
]
new_access_grants = [
grant for key, grant in submitted_access_grants_map.items() if key not in existing_access_grants
]
form_data.access_grants = preserved_access_grants + await filter_allowed_access_grants(
await Config.get('user.permissions'),
user.id,
user.role,
new_access_grants,
'sharing.public_prompts',
)
# Use the ID from the found prompt
updated_prompt = await Prompts.update_prompt_by_id(prompt.id, form_data, user.id, db=db)

22
backend/open_webui/routers/tools.py
View file

@ -19,7 +19,7 @@ from open_webui.env import (
)
from open_webui.events import EVENTS, publish_event
from open_webui.internal.db import get_async_session
from open_webui.models.access_grants import AccessGrants
from open_webui.models.access_grants import AccessGrants, normalize_access_grants
from open_webui.models.config import Config
from open_webui.models.groups import Groups
from open_webui.models.oauth_sessions import OAuthSessions
@ -571,12 +571,26 @@ async def _update_tool(request, id, form_data, user, db, version_id=None):
specs = get_local_tool_specs(tool_module)
if version_id is None:
form_data.access_grants = await filter_allowed_access_grants(
if version_id is None and form_data.access_grants is not None:
existing_access_grants = {
(grant.principal_type, grant.principal_id, grant.permission) for grant in tools.access_grants
}
submitted_access_grants_map = {
(grant['principal_type'], grant['principal_id'], grant['permission']): grant
for grant in normalize_access_grants(form_data.access_grants)
}
preserved_access_grants = [
grant for key, grant in submitted_access_grants_map.items() if key in existing_access_grants
]
new_access_grants = [
grant for key, grant in submitted_access_grants_map.items() if key not in existing_access_grants
]
form_data.access_grants = preserved_access_grants + await filter_allowed_access_grants(
await Config.get('user.permissions'),
user.id,
user.role,
form_data.access_grants,
new_access_grants,
'sharing.public_tools',
)