scriptoriumadmin/open-webui
1
0
Fork 0
mirror of https://github.com/open-webui/open-webui.git synced 2026-10-07 02:58:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

fix: keep private arena models with no access grants visible to admins without the admin bypass (#31858)

Browse source
This commit is contained in:
G30 2026-10-04 22:42:55 -04:00 • committed by GitHub
parent 2e43d66985
commit 8c34af3033
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 14 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
backend/open_webui/routers/models.py
View file

@ -809,8 +809,11 @@ async def get_model_profile_image(
for arena_model in arena_models:
if arena_model.get('id') == id:
arena_meta = arena_model.get('meta', {})
if bypass_access_control or await has_access(
user.id, permission='read', access_grants=arena_meta.get('access_grants', []), db=db
access_grants = arena_meta.get('access_grants', [])
if (
bypass_access_control
or (not access_grants and user.role == 'admin')
or await has_access(user.id, permission='read', access_grants=access_grants, db=db)
):
profile_image_url = arena_meta.get('profile_image_url')
break

15
backend/open_webui/utils/models.py
View file

@ -476,11 +476,14 @@ async def check_model_access(user, model, model_info=None, db=None):
if model.get('arena'):
meta = model.get('info', {}).get('meta', {})
access_grants = meta.get('access_grants', [])
if not await has_access(
user.id,
permission='read',
access_grants=access_grants,
db=db,
if not (
(not access_grants and user.role == 'admin')
or await has_access(
user.id,
permission='read',
access_grants=access_grants,
db=db,
)
):
log.warning(
'Model access denied: user_id=%r model_id=%r reason=arena_read_denied',
@ -561,7 +564,7 @@ async def get_filtered_models(models, user, db=None):
if model.get('arena'):
meta = model.get('info', {}).get('meta', {})
access_grants = meta.get('access_grants', [])
if await has_access(
if (not access_grants and user.role == 'admin') or await has_access(
user.id,
permission='read',
access_grants=access_grants,