scriptoriumadmin/open-webui
1
0
Fork 0
mirror of https://github.com/open-webui/open-webui.git synced 2026-09-22 00:31:30 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 9
17274 commits 2 branches 171 tags 1.4 GiB
Commit graph

3712 commits

Author SHA1 Message Date
Timothy Jaeryang Baek
e05f9fa17e refac 2026-07-15 00:30:28 -04:00
Timothy Jaeryang Baek
63ada24706 refac 2026-07-15 00:14:01 -04:00
Timothy Jaeryang Baek
254888cf15 refac 2026-07-14 23:20:15 -04:00
Timothy Jaeryang Baek
263bbc77d8 refac 2026-07-14 23:13:50 -04:00
Timothy Jaeryang Baek
7a9928ef17 refac 2026-07-14 23:08:41 -04:00
Timothy Jaeryang Baek
ea31a3bd61 refac 2026-07-14 18:05:36 -04:00
Timothy Jaeryang Baek
e8b4c7f9e2 refac 2026-07-14 17:16:20 -04:00
Timothy Jaeryang Baek
9588c97e64 refac 2026-07-14 17:10:11 -04:00
Timothy Jaeryang Baek
eb11029eac refac 2026-07-14 17:07:39 -04:00
Timothy Jaeryang Baek
e39ff71532 refac 2026-07-14 17:05:07 -04:00
Timothy Jaeryang Baek
d42da41090 refac 2026-07-14 17:01:10 -04:00
Timothy Jaeryang Baek
54cef1df48 refac 2026-07-14 17:00:27 -04:00
Timothy Jaeryang Baek
79d3e34eea refac 2026-07-14 16:57:35 -04:00
Timothy Jaeryang Baek
8dd862d338 refac 2026-07-14 14:17:59 -04:00
Timothy Jaeryang Baek
3be493f5b0 refac 2026-07-14 04:53:37 -04:00
Timothy Jaeryang Baek
c7f1ff9323 refac 2026-07-14 04:30:47 -04:00
Timothy Jaeryang Baek
c9103a29ff refac 2026-07-14 04:26:18 -04:00
Timothy Jaeryang Baek
aedb6bef4e refac 2026-07-14 04:15:20 -04:00
Timothy Jaeryang Baek
a7fbf66269 refac 2026-07-14 04:06:41 -04:00
Timothy Jaeryang Baek
1b64ccbaa0 refac 2026-07-14 04:02:28 -04:00
Timothy Jaeryang Baek
b2e4bda927 refac 2026-07-14 03:53:37 -04:00
Timothy Jaeryang Baek
04b146f2ce refac 2026-07-14 03:52:59 -04:00
Timothy Jaeryang Baek
e58a4633b1 refac 2026-07-14 03:51:09 -04:00
Timothy Jaeryang Baek
92842ecf23 refac 2026-07-14 03:49:21 -04:00
Timothy Jaeryang Baek
dbdacf2678 refac 2026-07-14 03:48:34 -04:00
Timothy Jaeryang Baek
b2fd6ccfd5 refac 2026-07-14 03:36:44 -04:00
Timothy Jaeryang Baek
fcedbebcf4 refac 2026-07-14 03:18:46 -04:00
Timothy Jaeryang Baek
7407eeede8 refac 2026-07-14 03:16:20 -04:00
Timothy Jaeryang Baek
d475cb9174 refac 2026-07-14 03:10:12 -04:00
Timothy Jaeryang Baek
d364101761 refac 2026-07-14 02:55:01 -04:00
Timothy Jaeryang Baek
d8131d1091 refac 2026-07-14 02:37:21 -04:00
Timothy Jaeryang Baek
b9d5462ed0 refac 2026-07-14 02:11:38 -04:00
Timothy Jaeryang Baek
809d9f29f3 refac 2026-07-14 01:47:50 -04:00
Timothy Jaeryang Baek
bcf449d5ad refac 2026-07-14 01:44:00 -04:00
Timothy Jaeryang Baek
a62ba97467 refac 2026-07-14 01:41:40 -04:00
Timothy Jaeryang Baek
b012d683d8 refac 2026-07-14 01:40:58 -04:00
Timothy Jaeryang Baek
6e14d0d627 refac 2026-07-14 01:39:40 -04:00
Timothy Jaeryang Baek
410ebb05d4 refac 2026-07-14 00:54:01 -04:00
Timothy Jaeryang Baek
d38c953608 refac 2026-07-14 00:49:30 -04:00
Timothy Jaeryang Baek
f1584b5a37 refac 2026-07-14 00:48:40 -04:00
Timothy Jaeryang Baek
009715cd63 refac 2026-07-14 00:22:00 -04:00
Timothy Jaeryang Baek
6a7068c3a4 refac 2026-07-14 00:21:47 -04:00
Timothy Jaeryang Baek
797293c749 refac 2026-07-14 00:19:41 -04:00
Timothy Jaeryang Baek
7088d245bb refac 2026-07-14 00:10:28 -04:00
Timothy Jaeryang Baek
8f07c0c8ee refac 2026-07-13 23:34:54 -04:00
Classic298
274729aa47
fix: socket reconnect recovery never runs for chats started from the home page (#26913) 
When a chat is started from the home page, the URL is switched to /c/{id} with
history.replaceState, so the Chat component is never remounted and chatIdProp
stays empty for the lifetime of that view. Both websocket recovery paths,
handleSocketConnect and the chat:active fallback, are gated on chatIdProp and
therefore never run for these chats. After any websocket drop during a response
(mobile backgrounding, VPN or IP change, wake from sleep) the completed response
is never fetched and the chat stays stuck in a loading state until a manual page
refresh. Chats opened directly via /c/{id} recover fine, which is why the bug
only reproduces reliably on freshly started chats.

Gate both recovery paths on the chatId store instead, which is set for every
persisted chat, and let loadChat fall back to it so the recovery reload also
works when chatIdProp is empty. Chats opened via /c/{id} behave exactly as
before and temporary chats stay excluded.

The same gate likely explains the remaining reports in #26315.

Fixes #26844
 2026-07-10 13:30:55 -05:00
Classic298
65a5fad7b9
fix: gate allow-same-origin on the terminal file-preview iframe to prevent same-origin XSS (#26907) 
The system-terminal HTML file preview (FilePreview.svelte, serveUrl branch) rendered served HTML in an iframe that hardcoded allow-same-origin. The terminal proxy serves the file root-relative (same origin as the app) and injects no CSP, and there is no default global CSP, so script in a previewed HTML file executed in the application's own origin and could read localStorage (the session token), enabling account takeover and, for admin or workspace.functions victims, server-side RCE via Functions. The sibling srcdoc branch already gates allow-same-origin behind the iframeSandboxAllowSameOrigin setting (off by default) and injects a CSP; the serveUrl branch never received that defense. Gate allow-same-origin on the serveUrl branch identically, so by default the preview runs at an opaque origin and its scripts cannot reach the parent context. Legitimate HTML preview rendering is unaffected.

Co-authored-by: manus-use <manus-use@users.noreply.github.com>
 2026-07-10 13:30:18 -05:00
Classic298
42f5c3d6f7
Merge pull request #26914 from Classic298/srcdoc-embed-prompt-confirmation 
fix: restore prompt confirmation for sandboxed tool result embeds
 2026-07-10 13:28:39 -05:00
Timothy Jaeryang Baek
6e030e892b refac 2026-07-09 18:28:38 -05:00
Timothy Jaeryang Baek
285379d489 refac 2026-07-09 17:43:13 -05:00