scriptoriumadmin/open-webui
1
0
Fork 0
mirror of https://github.com/open-webui/open-webui.git synced 2026-09-16 23:43:03 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

chore: write the connection listing role check as a security fix

Browse source
This commit is contained in:
Classic298 2026-09-06 22:57:40 +00:00
parent 6878601274
commit 8366a2e240
No known key found for this signature in database
1 changed files with 2 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
CHANGELOG.md
View file

@ -18,13 +18,14 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
- 🏷️ **Custom file metadata.** Metadata attached to an uploaded file now travels with the pieces that file is split into and arrives with the retrieved sources, the oversized and internal fields left out. [#29499](https://github.com/open-webui/open-webui/pull/29499), [#29486](https://github.com/open-webui/open-webui/issues/29486), [Commit](https://github.com/open-webui/open-webui/commit/894655f66b9563890e63c76090ddecc90a311eb2), [#29502](https://github.com/open-webui/open-webui/pull/29502)
- 🗑️ **Quick delete for notes and automations.** Holding Shift over a note in the list or grid, or over a row on the automations page, turns its trailing controls into a delete button, removing the entry in one click rather than the three the menu and its confirmation ask for. [#29635](https://github.com/open-webui/open-webui/pull/29635), [#29633](https://github.com/open-webui/open-webui/issues/29633), [#29640](https://github.com/open-webui/open-webui/pull/29640), [#29637](https://github.com/open-webui/open-webui/issues/29637)
- ⚡ **Searching without holding up the server.** Searching the text of chats and knowledge now runs beside the rest of the server rather than in front of it, so a long search no longer keeps other requests waiting. [#29621](https://github.com/open-webui/open-webui/pull/29621)
- 🔄 **General improvements.** Various improvements were implemented across the application to enhance performance, stability, and security. [Commit](https://github.com/open-webui/open-webui/commit/f1c803d36bae9d429eb630ad26853c9d939262b5), [#29619](https://github.com/open-webui/open-webui/pull/29619)
- 🔄 **General improvements.** Various improvements were implemented across the application to enhance performance, stability, and security. [Commit](https://github.com/open-webui/open-webui/commit/f1c803d36bae9d429eb630ad26853c9d939262b5)
- 🌐 **Translation updates.** Translations for Traditional Chinese, Korean, Finnish, Russian, Ukrainian, German, Spanish, and Portuguese (Brazil) were enhanced and expanded, and text that had been fixed in English, from the headings grouping the settings pages to labels and messages across the admin pages, the workspace and notifications, now takes its wording from the interface language. [Commit](https://github.com/open-webui/open-webui/commit/cffd734a1847593bb04c5b5a54d08daf3de0f614), [Commit](https://github.com/open-webui/open-webui/commit/006f95ee595a4d1d63b705c517f1c64cf9ebc676), [Commit](https://github.com/open-webui/open-webui/commit/f677fdbf5074e07216d9bb18d6934f3cfabb5839), [Commit](https://github.com/open-webui/open-webui/commit/237b11c6d944e083445e4ef53f5947b40bb80c6c), [Commit](https://github.com/open-webui/open-webui/commit/8aa25dd3585fe38062d2205231a440db31e330f3)
### Fixed
- 🛡️ **Security Advisory**: This release includes security and access-control fixes. We recommend updating production deployments at your earliest convenience. Not all security fixes in this version may be enumerated in the fixed section. Some may be withheld for a short time to give administrators time to upgrade. [Advisories](https://github.com/open-webui/open-webui/security)
- 🔑 **Tokens stay out of logs.** A failure part way through signing in with an identity provider no longer writes the credentials it was handed into the application log, recording the provider and the error it reported instead. [#29709](https://github.com/open-webui/open-webui/pull/29709)
- 🔒 **Listing one connection's models is for administrators again.** The endpoints that list the models on a single Ollama or OpenAI connection took the connection's number in the path, which was held to administrators, but also as a query parameter on the same handler, which was not: a signed-in account of any role could ask `/openai/models?url_idx=2` and read back every model that connection offers, none of it passed through the access filtering the ordinary model list applies, and reach the Ollama tag and version listings the same way. Each handler now checks the caller's role itself, whichever way the number arrives. [#29619](https://github.com/open-webui/open-webui/pull/29619)
- 📤 **Exporting tools stops at what you may edit.** Exporting all tools at once returned every tool the account could see, the source of a tool shared for reading included; it now returns only the tools it may edit, matching the single-tool export and the way models already export. [#29310](https://github.com/open-webui/open-webui/pull/29310)
- 🔐 **Model pictures follow model access.** The picture belonging to a model is now shown only to people who can see that model, where anyone signed in could fetch it and tell an existing model from an unknown one by which picture came back. [#29700](https://github.com/open-webui/open-webui/pull/29700)
- 🚪 **Webhook pictures follow channel access.** The picture belonging to a channel webhook is now shown only to people with access to that channel, where anyone signed in could fetch it or be sent on to wherever it pointed, and it is refused outright where channels are turned off. [#29703](https://github.com/open-webui/open-webui/pull/29703)