From 6d736d3c598dbe49488675ed42845e00b62dfcba Mon Sep 17 00:00:00 2001 From: Timothy Jaeryang Baek Date: Thu, 26 Mar 2026 19:01:33 -0500 Subject: [PATCH] refac --- backend/open_webui/retrieval/utils.py | 7 ++++++- backend/open_webui/routers/utils.py | 6 ++++++ 2 files changed, 12 insertions(+), 1 deletion(-) diff --git a/backend/open_webui/retrieval/utils.py b/backend/open_webui/retrieval/utils.py index 724537f2af..4ab8bdf7c0 100644 --- a/backend/open_webui/retrieval/utils.py +++ b/backend/open_webui/retrieval/utils.py @@ -30,6 +30,7 @@ from open_webui.models.knowledge import Knowledges from open_webui.models.chats import Chats from open_webui.models.notes import Notes from open_webui.models.access_grants import AccessGrants +from open_webui.utils.access_control.files import has_access_to_file from open_webui.retrieval.vector.main import GetResult from open_webui.utils.headers import include_user_info_headers @@ -1042,7 +1043,11 @@ async def get_sources_from_items( } elif item.get('id'): file_object = Files.get_file_by_id(item.get('id')) - if file_object: + if file_object and ( + user.role == 'admin' + or file_object.user_id == user.id + or has_access_to_file(item.get('id'), 'read', user) + ): query_result = { 'documents': [[file_object.data.get('content', '')]], 'metadatas': [ diff --git a/backend/open_webui/routers/utils.py b/backend/open_webui/routers/utils.py index 7ea4150021..c79d8fe5d8 100644 --- a/backend/open_webui/routers/utils.py +++ b/backend/open_webui/routers/utils.py @@ -42,6 +42,12 @@ async def format_code(form_data: CodeForm, user=Depends(get_admin_user)): @router.post('/code/execute') async def execute_code(request: Request, form_data: CodeForm, user=Depends(get_verified_user)): + if not request.app.state.config.ENABLE_CODE_EXECUTION: + raise HTTPException( + status_code=403, + detail='Code execution is disabled', + ) + if request.app.state.config.CODE_EXECUTION_ENGINE == 'jupyter': output = await execute_code_jupyter( request.app.state.config.CODE_EXECUTION_JUPYTER_URL,