Settings > Interface showed "Regenerate Menu" to users without permission to regenerate responses. Those users have no regenerate button, so the setting did nothing. It now only shows to users who can regenerate, and the settings search skips it for everyone else.
Refs #32830
* fix: temporary chat and delete chat shortcuts show while not allowed
The keyboard shortcuts list showed "New Temporary Chat" and "Delete Chat" to users who may not use temporary chats or delete chats, and pressing those shortcuts neither opened a temporary chat nor deleted anything for them. Both entries now only show to users with the matching permission, and the settings search skips them otherwise.
Refs #32830
* fix: new temporary chat shortcut does nothing without the permission
Users without the temporary chat permission were sent to a new chat by the New Temporary Chat shortcut; it now does nothing for them.
The Voice section in Settings > Interface, with voice interruption and emoji in call, showed to users without the call permission, who cannot start a call. The section now only shows to users who can make calls, and the settings search skips it for everyone else.
Refs #32830
Co-authored-by: Tim Baek <tim@openwebui.com>
Settings > Interface showed "Web Search in Chat" when web search is off for the instance or the user may not use it, and the choice had no effect. It now shows under the same conditions as the web search button in the chat input, and the settings search skips it otherwise. A saved choice is kept and applies again once web search is available.
Refs #32830
Settings > Interface offered "Compress Images in Channels" when channels are turned off for the instance or the user may not use them. It now only shows when the user can use channels, the same way the sidebar decides whether to list them, and the settings search skips it otherwise. A saved choice is kept.
Refs #32830
In the PowerPoint preview, a title or subtitle that the file sets to left alignment was drawn centred, the same as one with no alignment at all. Decks made by python-pptx and most deck generators set the alignment on every paragraph, so their left-aligned title slides all came out centred. The preview now keeps a title the file aligns left on the left, and only centres titles and subtitles that leave the alignment open.
Fixes#32873
In a Realtime call, a short pause mid-sentence can make the Realtime provider split the sentence into two turns. If you kept talking before the first half was transcribed, Open WebUI asked the voice model for one reply per half. The voice model hears the whole conversation each time, so both replies answered the full sentence and you heard the same answer twice, the second one about 15 seconds later. Now Open WebUI asks the voice model only once, after the last half, and that one reply covers the whole sentence.
Fixes#32764
Connecting Google Drive asked every user for the drive.readonly scope, read access to their whole Drive. Google classes that scope as restricted, so each self-hosted install needed Google's restricted-scope verification and security assessment, and until then users got the "Google hasn't verified this app" warning. The picker now only requests drive.file, access to the files the user picks, which Google classes as non-sensitive and which needs no such verification. With that scope Google requires the picker to name the Cloud project, so it sends the project number again, taken from the leading digits of the Google Drive client ID. It also opens in list view, as Google recommends for this scope, since the picker gets no thumbnail access with it.
Fixes#29537
On the first day of a month, chats from the day before were listed under "Previous 7 days" in the sidebar instead of "Yesterday". The same happened on January 1st for chats from December 31st. Any chat from the previous calendar day is now listed under "Yesterday", whatever the month or year.
Fixes#31964
Read Aloud and response auto-playback always played at normal speed, regardless of the Speech Playback Speed setting. The speech is played one sentence at a time, and the browser put the speed back to normal every time a new sentence started. The chosen speed now stays in effect for every sentence. Voice mode already respected the setting.
Fixes#31870
In chat replies, inline math written right next to an em dash or en dash, with either $...$ or \(...\), was left unrendered, as in "constants—\(e\), \(i\) and \(0\)—in one equation" where the 0 showed up as plain "(0)". Both dashes are now allowed directly before or after a formula, like spaces, commas and brackets already are, so the math renders whenever a dash touches it.
iPhone photos were only converted to JPEG when the browser reported their type as exactly image/heic. Firefox reports image/heif and some browsers report no type at all, so those photos were uploaded as HEIC and vision models failed with an error. When conversion did run, the JPEG was still uploaded with the HEIC file name and type, so the model was told it was HEIC anyway. HEIC and HEIF photos are now converted whatever type the browser reports and are uploaded as a .jpg with the JPEG type, in chats, channels and notes.
Fixes#28411
On iOS and iPadOS, auto-playback of a finished reply is never heard and the speaker button stays stuck in "speaking", so the first tap only stops a playback that never started. WebKit rejects play() started from a network event, and the audio queue ignored that rejection, so its state never reset. Call mode on the same devices was silent too.
A rejected play() now resets the queue, returns the button to idle and shows a toast (an aborted play from stop or a message switch is ignored). The first user tap or keypress plays a 10 ms silent clip on the shared audio element, which WebKit then allows to play later without a gesture; if that attempt fails it retries on the next gesture. Call mode plays unmuted: WebKit pauses an element that is unmuted after play() outside a gesture, even once unlocked.
The unlock and call mode change follow the reporter's on-device tests (iPhone iOS 27, iPad iPadOS 26.6.2). Verified in Chromium with autoplay restricted: the base queue wedges and drops later chunks; with the fix it reports the error, recovers, the unlock plays once and never interrupts audio already playing, and chunks queued during the unlock still play.
Fixes#30262
Mermaid diagrams and the shared SVG sanitizer now accept only same-origin and data: references. Image URLs, class styles and directive config are checked on the parsed diagram before it renders, and the sanitizer drops attribute values and stylesheet rules that point at another origin. use elements keep local #id references only.
SVGPanZoom and the SVG file preview call the shared sanitizer instead of keeping their own configs, so SVG artifacts and uploaded SVG files follow the same rule. Uploaded SVGs that reference external sprites now render those parts blank, which is the point of the change.
A diagram that references an external resource now reports an error instead of rendering, and an SVG artifact keeps everything except the rules that reference one.
