From 8a19e2f867063256bb2836649e2fe80af41ef748 Mon Sep 17 00:00:00 2001
From: Timothy Jaeryang Baek <tim@openwebui.com>
Date: Wed, 9 Sep 2026 17:09:45 -0400
Subject: [PATCH] refac

---
 backend/open_webui/models/models.py                    | 2 +-
 backend/open_webui/routers/models.py                   | 6 +++---
 src/lib/components/workspace/Models/ModelEditor.svelte | 7 +++++++
 3 files changed, 11 insertions(+), 4 deletions(-)

diff --git a/backend/open_webui/models/models.py b/backend/open_webui/models/models.py
index e435a492ba..bfcba6f33f 100755
--- a/backend/open_webui/models/models.py
+++ b/backend/open_webui/models/models.py
@@ -176,7 +176,7 @@ class ModelAccessListResponse(BaseModel):
 class ModelForm(BaseModel):
     model_config = ConfigDict(extra='ignore')
 
-    id: str
+    id: str = Field(pattern=r'^\S+$')
     base_model_id: str | None = None
     name: str
     meta: ModelMeta
diff --git a/backend/open_webui/routers/models.py b/backend/open_webui/routers/models.py
index baa8bae604..1f506b438d 100644
--- a/backend/open_webui/routers/models.py
+++ b/backend/open_webui/routers/models.py
@@ -45,7 +45,7 @@ from open_webui.utils.access_control.files import has_access_to_file
 from open_webui.utils.auth import get_admin_user, get_verified_user
 from open_webui.utils.chat_variables import get_chat_variables_schema
 from open_webui.utils.models import get_all_models
-from pydantic import BaseModel
+from pydantic import BaseModel, Field
 from sqlalchemy.ext.asyncio import AsyncSession
 
 log = logging.getLogger(__name__)
@@ -93,7 +93,7 @@ def _safe_static_redirect_path(url: str) -> str | None:
 
 
 def is_valid_model_id(model_id: str) -> bool:
-    return model_id and len(model_id) <= 256
+    return model_id and len(model_id) <= 256 and not any(char.isspace() for char in model_id)
 
 
 async def _verify_knowledge_file_access(
@@ -878,7 +878,7 @@ async def update_model_by_id(
 
 
 class ModelAccessGrantsForm(BaseModel):
-    id: str
+    id: str = Field(pattern=r'^\S+$')
     name: str | None = None
     access_grants: list[dict]
 
diff --git a/src/lib/components/workspace/Models/ModelEditor.svelte b/src/lib/components/workspace/Models/ModelEditor.svelte
index 9bb833e51c..87e9a89f13 100644
--- a/src/lib/components/workspace/Models/ModelEditor.svelte
+++ b/src/lib/components/workspace/Models/ModelEditor.svelte
@@ -283,6 +283,13 @@
 			return;
 		}
 
+		if (/\s/.test(id)) {
+			toast.error($i18n.t('Model ID cannot contain whitespace.'));
+			loading = false;
+
+			return;
+		}
+
 		if (name === '') {
 			toast.error($i18n.t('Model Name is required.'));
 			loading = false;