scriptoriumadmin/open-webui
1
0
Fork 0
mirror of https://github.com/open-webui/open-webui.git synced 2026-09-15 23:32:40 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

chore: keep the connection listing fix brief

Browse source
This commit is contained in:
Classic298 2026-09-06 22:59:38 +00:00
parent 8366a2e240
commit 93b277cf1e
No known key found for this signature in database
1 changed files with 1 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
CHANGELOG.md
View file

@ -25,7 +25,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
- 🛡️ **Security Advisory**: This release includes security and access-control fixes. We recommend updating production deployments at your earliest convenience. Not all security fixes in this version may be enumerated in the fixed section. Some may be withheld for a short time to give administrators time to upgrade. [Advisories](https://github.com/open-webui/open-webui/security)
- 🔑 **Tokens stay out of logs.** A failure part way through signing in with an identity provider no longer writes the credentials it was handed into the application log, recording the provider and the error it reported instead. [#29709](https://github.com/open-webui/open-webui/pull/29709)
- 🔒 **Listing one connection's models is for administrators again.** The endpoints that list the models on a single Ollama or OpenAI connection took the connection's number in the path, which was held to administrators, but also as a query parameter on the same handler, which was not: a signed-in account of any role could ask `/openai/models?url_idx=2` and read back every model that connection offers, none of it passed through the access filtering the ordinary model list applies, and reach the Ollama tag and version listings the same way. Each handler now checks the caller's role itself, whichever way the number arrives. [#29619](https://github.com/open-webui/open-webui/pull/29619)
- 🔒 **Listing one connection's models is for administrators again.** The endpoints that list the models on a single Ollama or OpenAI connection could be reached by a signed-in account of any role, and now check the caller's role. [#29619](https://github.com/open-webui/open-webui/pull/29619)
- 📤 **Exporting tools stops at what you may edit.** Exporting all tools at once returned every tool the account could see, the source of a tool shared for reading included; it now returns only the tools it may edit, matching the single-tool export and the way models already export. [#29310](https://github.com/open-webui/open-webui/pull/29310)
- 🔐 **Model pictures follow model access.** The picture belonging to a model is now shown only to people who can see that model, where anyone signed in could fetch it and tell an existing model from an unknown one by which picture came back. [#29700](https://github.com/open-webui/open-webui/pull/29700)
- 🚪 **Webhook pictures follow channel access.** The picture belonging to a channel webhook is now shown only to people with access to that channel, where anyone signed in could fetch it or be sent on to wherever it pointed, and it is refused outright where channels are turned off. [#29703](https://github.com/open-webui/open-webui/pull/29703)