From e874469d0ffef6513fd5cd5fc9c63f910fe9a020 Mon Sep 17 00:00:00 2001
From: DrMelone <27028174+Classic298@users.noreply.github.com>
Date: Mon, 13 Apr 2026 01:35:22 +0200
Subject: [PATCH] fix: thread bypass flag into ollama.py secondary base-model
 checks
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Address review feedback: the four other chat-completion-like endpoints
in ollama.py (generate_openai_completion, generate_openai_chat_completion,
generate_anthropic_messages, generate_responses) received the new
check_base_model_access call without a bypass flag. The native
generate_chat_completion path in the same file and in routers/openai.py
thread bypass_filter through, so base-model enforcement was
inconsistent between closely related routes.

Derive bypass_filter the same way — request.state.bypass_filter OR
BYPASS_MODEL_ACCESS_CONTROL — at each of the four sites and pass it to
check_base_model_access. Pre-existing check_model_access calls on the
user-facing model at these sites already ignore bypass; that is a
separate, pre-existing inconsistency that this PR does not take on.
---
 backend/open_webui/routers/ollama.py | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/backend/open_webui/routers/ollama.py b/backend/open_webui/routers/ollama.py
index 016ef65418..406a1c4213 100644
--- a/backend/open_webui/routers/ollama.py
+++ b/backend/open_webui/routers/ollama.py
@@ -1198,10 +1198,11 @@ async def generate_openai_completion(
 
     model_id = form_data.model
     model_info = await Models.get_model_by_id(model_id)
+    base_bypass_filter = getattr(request.state, 'bypass_filter', False) or BYPASS_MODEL_ACCESS_CONTROL
     if model_info:
         if model_info.base_model_id:
             payload['model'] = model_info.base_model_id
-            await check_base_model_access(user, model_info.base_model_id)
+            await check_base_model_access(user, model_info.base_model_id, base_bypass_filter)
         params = model_info.params.model_dump()
 
         if params:
@@ -1261,10 +1262,11 @@ async def generate_openai_chat_completion(
 
     model_id = completion_form.model
     model_info = await Models.get_model_by_id(model_id)
+    base_bypass_filter = getattr(request.state, 'bypass_filter', False) or BYPASS_MODEL_ACCESS_CONTROL
     if model_info:
         if model_info.base_model_id:
             payload['model'] = model_info.base_model_id
-            await check_base_model_access(user, model_info.base_model_id)
+            await check_base_model_access(user, model_info.base_model_id, base_bypass_filter)
 
         params = model_info.params.model_dump()
 
@@ -1322,10 +1324,11 @@ async def generate_anthropic_messages(
     model_id = payload.get('model', '')
 
     model_info = await Models.get_model_by_id(model_id)
+    base_bypass_filter = getattr(request.state, 'bypass_filter', False) or BYPASS_MODEL_ACCESS_CONTROL
     if model_info:
         if model_info.base_model_id:
             payload['model'] = model_info.base_model_id
-            await check_base_model_access(user, model_info.base_model_id)
+            await check_base_model_access(user, model_info.base_model_id, base_bypass_filter)
 
         await check_model_access(user, model_info)
     else:
@@ -1381,10 +1384,11 @@ async def generate_responses(
     model_id = form_data.model
 
     model_info = await Models.get_model_by_id(model_id)
+    base_bypass_filter = getattr(request.state, 'bypass_filter', False) or BYPASS_MODEL_ACCESS_CONTROL
     if model_info:
         if model_info.base_model_id:
             payload['model'] = model_info.base_model_id
-            await check_base_model_access(user, model_info.base_model_id)
+            await check_base_model_access(user, model_info.base_model_id, base_bypass_filter)
 
         # Check if user has access to the model
         if user.role == 'user':