scriptoriumadmin/open-webui
1
0
Fork 0
mirror of https://github.com/open-webui/open-webui.git synced 2026-09-26 01:11:39 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

chore: trim verbose comment on channel: branch gate

Browse source
This commit is contained in:
Classic298 2026-05-14 21:57:51 +02:00
parent 30bd3cc218
commit 6f27df88d5
1 changed files with 2 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
backend/open_webui/main.py
View file

@ -1800,14 +1800,8 @@ async def chat_completion(
if metadata.get('chat_id') and user:
chat_id = metadata['chat_id']
# channel: chat_ids skip the chat ownership / storage block below,
# but the channel-emitter ultimately writes to a Messages row by
# the caller-supplied message_id. Without a gate here, any auth
# user could supply chat_id="channel:<any>" + id="<any>" and
# overwrite arbitrary messages in arbitrary channels (private,
# DM, channels they don't belong to). Enforce: caller must be
# able to write in the target channel, AND the supplied message
# must belong to that channel.
# Gate channel: branch — caller needs write access on the channel
# and the supplied message_id must belong to that channel.
if chat_id.startswith('channel:'):
channel_id = chat_id.removeprefix('channel:')
channel = await Channels.get_channel_by_id(channel_id)