scriptoriumadmin/open-webui
1
0
Fork 0
mirror of https://github.com/open-webui/open-webui.git synced 2026-09-23 00:41:56 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3
17255 commits 2 branches 171 tags 1.4 GiB
Commit graph

3697 commits

Author SHA1 Message Date
Timothy Jaeryang Baek
c7f1ff9323 refac 2026-07-14 04:30:47 -04:00
Timothy Jaeryang Baek
c9103a29ff refac 2026-07-14 04:26:18 -04:00
Timothy Jaeryang Baek
aedb6bef4e refac 2026-07-14 04:15:20 -04:00
Timothy Jaeryang Baek
a7fbf66269 refac 2026-07-14 04:06:41 -04:00
Timothy Jaeryang Baek
1b64ccbaa0 refac 2026-07-14 04:02:28 -04:00
Timothy Jaeryang Baek
b2e4bda927 refac 2026-07-14 03:53:37 -04:00
Timothy Jaeryang Baek
04b146f2ce refac 2026-07-14 03:52:59 -04:00
Timothy Jaeryang Baek
e58a4633b1 refac 2026-07-14 03:51:09 -04:00
Timothy Jaeryang Baek
92842ecf23 refac 2026-07-14 03:49:21 -04:00
Timothy Jaeryang Baek
dbdacf2678 refac 2026-07-14 03:48:34 -04:00
Timothy Jaeryang Baek
b2fd6ccfd5 refac 2026-07-14 03:36:44 -04:00
Timothy Jaeryang Baek
fcedbebcf4 refac 2026-07-14 03:18:46 -04:00
Timothy Jaeryang Baek
7407eeede8 refac 2026-07-14 03:16:20 -04:00
Timothy Jaeryang Baek
d475cb9174 refac 2026-07-14 03:10:12 -04:00
Timothy Jaeryang Baek
d364101761 refac 2026-07-14 02:55:01 -04:00
Timothy Jaeryang Baek
d8131d1091 refac 2026-07-14 02:37:21 -04:00
Timothy Jaeryang Baek
b9d5462ed0 refac 2026-07-14 02:11:38 -04:00
Timothy Jaeryang Baek
809d9f29f3 refac 2026-07-14 01:47:50 -04:00
Timothy Jaeryang Baek
bcf449d5ad refac 2026-07-14 01:44:00 -04:00
Timothy Jaeryang Baek
a62ba97467 refac 2026-07-14 01:41:40 -04:00
Timothy Jaeryang Baek
b012d683d8 refac 2026-07-14 01:40:58 -04:00
Timothy Jaeryang Baek
6e14d0d627 refac 2026-07-14 01:39:40 -04:00
Timothy Jaeryang Baek
410ebb05d4 refac 2026-07-14 00:54:01 -04:00
Timothy Jaeryang Baek
d38c953608 refac 2026-07-14 00:49:30 -04:00
Timothy Jaeryang Baek
f1584b5a37 refac 2026-07-14 00:48:40 -04:00
Timothy Jaeryang Baek
009715cd63 refac 2026-07-14 00:22:00 -04:00
Timothy Jaeryang Baek
6a7068c3a4 refac 2026-07-14 00:21:47 -04:00
Timothy Jaeryang Baek
797293c749 refac 2026-07-14 00:19:41 -04:00
Timothy Jaeryang Baek
7088d245bb refac 2026-07-14 00:10:28 -04:00
Timothy Jaeryang Baek
8f07c0c8ee refac 2026-07-13 23:34:54 -04:00
Classic298
274729aa47
fix: socket reconnect recovery never runs for chats started from the home page (#26913) 
When a chat is started from the home page, the URL is switched to /c/{id} with
history.replaceState, so the Chat component is never remounted and chatIdProp
stays empty for the lifetime of that view. Both websocket recovery paths,
handleSocketConnect and the chat:active fallback, are gated on chatIdProp and
therefore never run for these chats. After any websocket drop during a response
(mobile backgrounding, VPN or IP change, wake from sleep) the completed response
is never fetched and the chat stays stuck in a loading state until a manual page
refresh. Chats opened directly via /c/{id} recover fine, which is why the bug
only reproduces reliably on freshly started chats.

Gate both recovery paths on the chatId store instead, which is set for every
persisted chat, and let loadChat fall back to it so the recovery reload also
works when chatIdProp is empty. Chats opened via /c/{id} behave exactly as
before and temporary chats stay excluded.

The same gate likely explains the remaining reports in #26315.

Fixes #26844
 2026-07-10 13:30:55 -05:00
Classic298
65a5fad7b9
fix: gate allow-same-origin on the terminal file-preview iframe to prevent same-origin XSS (#26907) 
The system-terminal HTML file preview (FilePreview.svelte, serveUrl branch) rendered served HTML in an iframe that hardcoded allow-same-origin. The terminal proxy serves the file root-relative (same origin as the app) and injects no CSP, and there is no default global CSP, so script in a previewed HTML file executed in the application's own origin and could read localStorage (the session token), enabling account takeover and, for admin or workspace.functions victims, server-side RCE via Functions. The sibling srcdoc branch already gates allow-same-origin behind the iframeSandboxAllowSameOrigin setting (off by default) and injects a CSP; the serveUrl branch never received that defense. Gate allow-same-origin on the serveUrl branch identically, so by default the preview runs at an opaque origin and its scripts cannot reach the parent context. Legitimate HTML preview rendering is unaffected.

Co-authored-by: manus-use <manus-use@users.noreply.github.com>
 2026-07-10 13:30:18 -05:00
Classic298
42f5c3d6f7
Merge pull request #26914 from Classic298/srcdoc-embed-prompt-confirmation 
fix: restore prompt confirmation for sandboxed tool result embeds
 2026-07-10 13:28:39 -05:00
Timothy Jaeryang Baek
6e030e892b refac 2026-07-09 18:28:38 -05:00
Timothy Jaeryang Baek
285379d489 refac 2026-07-09 17:43:13 -05:00
Timothy Jaeryang Baek
5ab012e7ae refac 2026-07-09 17:38:52 -05:00
Timothy Jaeryang Baek
975f7b868a refac 2026-07-09 17:32:45 -05:00
Algorithm5838
0e5540c2b2
fix: derive content from output for search (#26405) 2026-07-01 03:05:47 -05:00
Timothy Jaeryang Baek
4b08d65597 refac 2026-07-01 02:53:22 -05:00
Timothy Jaeryang Baek
af1c0eee89 refac 2026-06-30 20:20:15 -05:00
Timothy Jaeryang Baek
6ed56b07c4 refac 2026-06-30 16:55:25 -05:00
Timothy Jaeryang Baek
403392b41b chore: format 2026-06-29 13:35:39 -05:00
Timothy Jaeryang Baek
c33fadc266 refac 2026-06-29 13:30:32 -05:00
Timothy Jaeryang Baek
0443ab3a61 refac 2026-06-29 13:30:28 -05:00
Timothy Jaeryang Baek
24b8619f64 refac 2026-06-29 13:15:11 -05:00
Timothy Jaeryang Baek
55cb98ff56 refac 2026-06-29 13:03:30 -05:00
Timothy Jaeryang Baek
517cd8d102 refac 2026-06-29 13:03:14 -05:00
Timothy Jaeryang Baek
2c804b0ac4 refac 2026-06-29 12:55:10 -05:00
Timothy Jaeryang Baek
589b62b529 refac 2026-06-29 12:52:51 -05:00
Timothy Jaeryang Baek
21ac7e95a3 refac 2026-06-29 12:51:20 -05:00