scriptoriumadmin/open-webui
1
0
Fork 0
mirror of https://github.com/open-webui/open-webui.git synced 2026-09-23 00:41:56 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3
16065 commits 2 branches 171 tags 1.4 GiB
Commit graph

5751 commits

Author SHA1 Message Date
DrMelone
f50b5e479c fix: enforce model access control on /responses endpoint 
The /responses proxy endpoint only required authentication via
get_verified_user but did not check per-model access grants. This
allowed any authenticated user to access any model through this
endpoint, bypassing the access control system.

Extract a shared check_model_access helper into utils/access_control
and replace all inline access control blocks across openai.py and
ollama.py (7 locations) with calls to this helper. This eliminates
code duplication and prevents future policy drift between endpoints.

CWE-862: Missing Authorization
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H (6.5 Medium)
 2026-04-07 19:26:54 +02:00
Timothy Jaeryang Baek
60e4d75174 refac 2026-04-02 02:50:05 -05:00
Timothy Jaeryang Baek
4632f200a9 refac 2026-04-02 02:06:21 -05:00
Timothy Jaeryang Baek
9d3e0637c8 refac 2026-04-02 02:05:35 -05:00
Timothy Jaeryang Baek
65ee771fd0 refac 2026-04-02 01:40:50 -05:00
Timothy Jaeryang Baek
0c5399ca53 refac 2026-04-01 18:26:46 -05:00
Timothy Jaeryang Baek
584a9a0920 refac 2026-04-01 07:42:11 -05:00
Algorithm5838
a28ea36657
perf: inline update_chat_title_by_id into single DB context (#23214) 2026-04-01 07:06:16 -05:00
Shirasawa
3f7fc1a75a
fix: Fix the error that occurs when the task model does not exist (#23169) 2026-04-01 07:01:25 -05:00
Timothy Jaeryang Baek
60676bfdcf refac 2026-04-01 06:40:49 -05:00
Timothy Jaeryang Baek
d6a9efca68 refac 2026-04-01 06:13:50 -05:00
Timothy Jaeryang Baek
15883e5229 refac 2026-04-01 06:00:53 -05:00
Timothy Jaeryang Baek
0e5696de74 refac 2026-04-01 05:55:48 -05:00
Timothy Jaeryang Baek
70c87a1ed1 refac 2026-04-01 05:54:58 -05:00
Timothy Jaeryang Baek
51b200c67b refac 2026-04-01 05:52:03 -05:00
Shirasawa
d7a5a903a6
fix: guard completed API with message id (#23184) 2026-04-01 05:39:34 -05:00
Denis Khachyan
7025cc94cc
feat(config): add environment variable support for DEFAULT_MODEL_PARAMS (#23223) 2026-04-01 05:36:29 -05:00
Timothy Jaeryang Baek
b898fc0258 fix: gravatar profile image 2026-04-01 05:33:41 -05:00
Timothy Jaeryang Baek
18f6ec68b9 refac 2026-04-01 05:11:48 -05:00
Timothy Jaeryang Baek
7c52382c90 refac 2026-04-01 05:03:53 -05:00
Timothy Jaeryang Baek
c8ef5a4f38 chore: format 2026-04-01 04:36:02 -05:00
Timothy Jaeryang Baek
53583f8d83 refac 2026-04-01 04:33:30 -05:00
Timothy Jaeryang Baek
0638b9f56c refac 2026-04-01 04:00:18 -05:00
Timothy Jaeryang Baek
5a2ff8b2e5 refac 2026-04-01 01:21:21 -05:00
Tim Baek
8e67bf67e1
Merge pull request #23303 from open-webui/automations 
feat: automations
 2026-04-01 10:02:36 +04:00
Timothy Jaeryang Baek
fe8a3d9f83 refac 2026-04-01 00:55:52 -05:00
Timothy Jaeryang Baek
48288e9ce7 refac 2026-04-01 00:41:08 -05:00
Timothy Jaeryang Baek
90319593d0 refac 2026-04-01 00:35:11 -05:00
Timothy Jaeryang Baek
f984c6e79a refac 2026-04-01 00:17:04 -05:00
Timothy Jaeryang Baek
8a0794958d refac 2026-04-01 00:11:11 -05:00
Timothy Jaeryang Baek
378673408e refac 2026-03-31 23:39:54 -05:00
Timothy Jaeryang Baek
e6f38f52c8 feat: automation 2026-03-31 23:36:01 -05:00
Timothy Jaeryang Baek
36d02aa147 refac 2026-03-31 23:12:23 -05:00
Algorithm5838
98570d3547
perf: single yield per line in stream chunks handler (#23266) 2026-03-31 18:42:52 -05:00
Shirasawa
b10c70cfcf
feat: Save error messages to the database (#23231) 2026-03-31 04:11:47 -05:00
Algorithm5838
1c5e84ddf2
perf: project only Chat.id in delete_shared_chats_by_user_id (#23216) 2026-03-30 05:15:12 -05:00
Timothy Jaeryang Baek
10b4b86ada refac 2026-03-30 05:10:24 -05:00
Algorithm5838
9cc3ffb4a9
perf: update_last_active_by_id via single UPDATE (#23215) 2026-03-30 04:14:33 -05:00
Timothy Jaeryang Baek
b1e8c7d2aa refac 2026-03-29 21:25:39 -05:00
Timothy Jaeryang Baek
b794d61626 refac 2026-03-29 21:15:20 -05:00
Timothy Jaeryang Baek
a06685a47b refac 2026-03-29 21:01:10 -05:00
Timothy Jaeryang Baek
4777f4fa32 refac 2026-03-29 19:48:23 -05:00
Timothy Jaeryang Baek
1b1d85fe2e refac 2026-03-29 19:42:10 -05:00
Timothy Jaeryang Baek
bcb71bb520 feat: tasks 2026-03-29 18:01:04 -05:00
Timothy Jaeryang Baek
6d736d3c59 refac 2026-03-26 19:01:33 -05:00
Timothy Jaeryang Baek
925f77f0f5 chore: format 2026-03-26 18:25:19 -05:00
Timothy Jaeryang Baek
f3f8f9874f refac 2026-03-26 18:24:17 -05:00
Timothy Jaeryang Baek
52a06bd48a refac 2026-03-26 18:22:14 -05:00
Timothy Jaeryang Baek
4567cdc0d9 refac 2026-03-26 18:17:49 -05:00
Timothy Jaeryang Baek
a641325707 refac 2026-03-26 18:13:18 -05:00