scriptoriumadmin/open-webui
1
0
Fork 0
mirror of https://github.com/open-webui/open-webui.git synced 2026-10-08 03:08:02 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3
16089 commits 2 branches 171 tags 1.5 GiB
Commit graph

16089 commits

This branch
This branch
All branches
Author SHA1 Message Date
DrMelone
8dd015368c fix: constrain relative paths to known-safe prefixes 
Accepting any relative path starting with / allowed a user to set
their profile_image_url to an arbitrary internal GET endpoint. When
another user (e.g. an admin) views that profile, the browser fires
the GET with the viewer's session cookies — an authenticated GET
trigger surface.

Constrain to known-safe prefixes (/api/v1/users/, /static/) and
exact matches (/user.png, /favicon.png) which are the only relative
paths OWUI itself generates.
 2026-04-03 22:40:20 +02:00
DrMelone
90c676481d fix: validate hostname not netloc, fix misleading comment 
- Use parsed.hostname instead of parsed.netloc so URLs like
  http://:80/path (non-empty netloc but no actual host) are rejected.
- Update data URI comment to accurately state we validate MIME type
  and structure, not base64 payload integrity.
 2026-04-03 22:35:29 +02:00
DrMelone
3d579f23e0 fix: use structural validation instead of prefix checks 
- Use urlparse for HTTP(S) URLs: gives case-insensitive scheme
  matching and rejects bare schemes with no host (e.g. https://).
- Use a compiled regex for data URIs: enforces the ;base64, boundary,
  restricts to safe raster formats, and is case-insensitive per spec.
- Removes the startswith-based prefix tuple in favour of proper
  URL and data URI parsing.
 2026-04-03 22:31:48 +02:00
DrMelone
a3a385c4d9 fix: harden profile image URL validation per review feedback 
- Restrict data URIs to safe raster formats (png/jpeg/gif/webp);
  SVG is excluded because it can carry embedded scripts.
- Block scheme-relative URLs (//host/path) which browsers resolve
  against the current protocol, bypassing the relative-path check.
 2026-04-03 22:19:27 +02:00
Classic298
9af9635751
Merge branch 'dev' into fix/profile-image-url-validation 2026-04-03 21:49:09 +02:00
DrMelone
87d666fa3c fix: replace brittle profile_image_url allowlist with safe-scheme validation 
The previous validation used a hardcoded allowlist of specific static
paths and a single Gravatar prefix. This rejected OWUI's own internal
API paths (e.g. /api/v1/users/{id}/profile/image) and external OAuth
avatar URLs, making it impossible to save user profiles from the admin
panel.

Replace with scheme-based validation that allows relative paths,
HTTP(S) URLs, and data:image URIs while blocking dangerous schemes
like javascript:, file:, and ftp:.

Fixes open-webui#23387
 2026-04-03 21:45:51 +02:00
Timothy Jaeryang Baek
c40ea7f29d refac 2026-04-02 23:00:00 -05:00
Timothy Jaeryang Baek
253f416de3 refac 2026-04-02 22:54:17 -05:00
Timothy Jaeryang Baek
53eadb7df7 refac 2026-04-02 22:34:51 -05:00
Timothy Jaeryang Baek
6c243664bc refac 2026-04-02 20:56:00 -05:00
Timothy Jaeryang Baek
4cee67e2be feat: mistral tts 2026-04-02 19:31:15 -05:00
Timothy Jaeryang Baek
730e52a431 refac 2026-04-02 19:29:23 -05:00
Timothy Jaeryang Baek
8c2afb8157 refac 2026-04-02 17:58:11 -05:00
Timothy Jaeryang Baek
ae0316a30e refac 2026-04-02 17:53:11 -05:00
Classic298
a72e8e0223
Update translation.json (#23352) 2026-04-02 17:48:38 -05:00
Timothy Jaeryang Baek
f66b67c8b8 refac 2026-04-02 17:17:01 -05:00
Timothy Jaeryang Baek
b89019a8e1 refac 2026-04-02 08:57:49 -05:00
Timothy Jaeryang Baek
0dd9f462ff feat: oauth backchannel logout 2026-04-02 08:46:34 -05:00
Timothy Jaeryang Baek
4dea4fdf54 refac 2026-04-02 08:34:49 -05:00
_00_
2863e9f8c4
upd:i18n es-ES Translation v0.8.12 (#23350) 
Udded new strings and minor corrections
 2026-04-02 08:24:18 -05:00
Timothy Jaeryang Baek
a71d927a0c chore: format 2026-04-02 08:11:06 -05:00
Timothy Jaeryang Baek
640dbb6a28 refac 2026-04-02 08:09:57 -05:00
Timothy Jaeryang Baek
366454e812 refac 2026-04-02 08:04:43 -05:00
Timothy Jaeryang Baek
4578bf52ee refac 2026-04-02 08:02:46 -05:00
Timothy Jaeryang Baek
9190d4b542 refac 2026-04-02 07:48:24 -05:00
Shirasawa
6fdd19bf14
I18n: improve Chinese translation (#23347) 
* i18n: improve zh-CN translation

* i18n: improve zh-TW translation
 2026-04-02 06:44:24 -05:00
Timothy Jaeryang Baek
6d6dfbf02c refac 2026-04-02 06:41:10 -05:00
Timothy Jaeryang Baek
342582676a refac 2026-04-02 02:57:45 -05:00
Timothy Jaeryang Baek
60e4d75174 refac 2026-04-02 02:50:05 -05:00
Timothy Jaeryang Baek
4632f200a9 refac 2026-04-02 02:06:21 -05:00
Timothy Jaeryang Baek
9d3e0637c8 refac 2026-04-02 02:05:35 -05:00
Timothy Jaeryang Baek
65ee771fd0 refac 2026-04-02 01:40:50 -05:00
Timothy Jaeryang Baek
0c5399ca53 refac 2026-04-01 18:26:46 -05:00
Timothy Jaeryang Baek
584a9a0920 refac 2026-04-01 07:42:11 -05:00
Timothy Jaeryang Baek
124b7e9154 refac 2026-04-01 07:35:38 -05:00
Timothy Jaeryang Baek
4764dd5d37 refac 2026-04-01 07:34:01 -05:00
Timothy Jaeryang Baek
86472bb445 refac 2026-04-01 07:31:54 -05:00
Timothy Jaeryang Baek
07262fa62c refac 2026-04-01 07:14:18 -05:00
Algorithm5838
a28ea36657
perf: inline update_chat_title_by_id into single DB context (#23214) 2026-04-01 07:06:16 -05:00
Shirasawa
3f7fc1a75a
fix: Fix the error that occurs when the task model does not exist (#23169) 2026-04-01 07:01:25 -05:00
Timothy Jaeryang Baek
60676bfdcf refac 2026-04-01 06:40:49 -05:00
Shirasawa
2734fcad63
fix(sidebar): ChatItem document listener teardown and shared drag image (#23209) 2026-04-01 06:40:02 -05:00
Timothy Jaeryang Baek
3d6e5ff8f9 refac 2026-04-01 06:37:57 -05:00
Timothy Jaeryang Baek
1554be9da6 refac 2026-04-01 06:29:21 -05:00
Timothy Jaeryang Baek
d6a9efca68 refac 2026-04-01 06:13:50 -05:00
Timothy Jaeryang Baek
b3e56e0c92 refac 2026-04-01 06:02:37 -05:00
Timothy Jaeryang Baek
15883e5229 refac 2026-04-01 06:00:53 -05:00
Timothy Jaeryang Baek
0e5696de74 refac 2026-04-01 05:55:48 -05:00
Timothy Jaeryang Baek
70c87a1ed1 refac 2026-04-01 05:54:58 -05:00
Timothy Jaeryang Baek
51b200c67b refac 2026-04-01 05:52:03 -05:00