scriptoriumadmin/open-webui
1
0
Fork 0
mirror of https://github.com/open-webui/open-webui.git synced 2026-08-28 05:27:35 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

fix(#28767):fetching tags for a chat the user can read but does not own returns 401

Browse source
This commit is contained in:
arjun r 2026-08-19 15:21:02 +05:30
parent 01f4282f1f
commit e784a1c04d
1 changed files with 19 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

22
backend/open_webui/routers/chats.py
View file

@ -1302,8 +1302,14 @@ async def compact_chat_by_id(
############################
@router.get('/{id}', response_model=ChatResponse | None)
async def get_chat_by_id(id: str, user=Depends(get_verified_user), db: AsyncSession = Depends(get_async_session)):
async def get_readable_chat(user, id: str, db: AsyncSession):
"""Resolve a chat the given user has read access to, or None.
Read access is granted by any of: ownership, an admin override under
ENABLE_ADMIN_CHAT_ACCESS, an explicit shared_chat read grant, or access
to the folder the chat sits in. Kept as a single helper so every route
that needs to check "can this user read this chat" stays in step.
"""
chat = await Chats.get_chat_by_id_and_user_id(id, user.id, db=db)
if not chat and user.role == 'admin':
@ -1332,6 +1338,13 @@ async def get_chat_by_id(id: str, user=Depends(get_verified_user), db: AsyncSess
if folder and await has_folder_access(user.id, folder, 'read', db):
chat = candidate
return chat
@router.get('/{id}', response_model=ChatResponse | None)
async def get_chat_by_id(id: str, user=Depends(get_verified_user), db: AsyncSession = Depends(get_async_session)):
chat = await get_readable_chat(user, id, db)
if chat:
data = ChatResponse.model_validate(chat, from_attributes=True).model_dump()
data['context_usage'] = await get_chat_context_usage(chat)
@ -2153,9 +2166,12 @@ async def update_chat_folder_id_by_id(
@router.get('/{id}/tags', response_model=list[TagModel])
async def get_chat_tags_by_id(id: str, user=Depends(get_verified_user), db: AsyncSession = Depends(get_async_session)):
chat = await Chats.get_chat_by_id_and_user_id(id, user.id, db=db)
chat = await get_readable_chat(user, id, db)
if chat:
tags = chat.meta.get('tags', [])
# Tags are resolved against the requesting user's own tag rows, so a
# viewer who does not own the chat simply gets an empty list rather
# than another user's tags leaking through.
return await Tags.get_tags_by_ids_and_user_id(tags, user.id, db=db)
else:
raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail=ERROR_MESSAGES.NOT_FOUND)