scriptoriumadmin/open-webui
1
0
Fork 0
mirror of https://github.com/open-webui/open-webui.git synced 2026-09-24 00:51:27 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3
16065 commits 2 branches 171 tags 1.4 GiB
Commit graph

1216 commits

Author SHA1 Message Date
DrMelone
f50b5e479c fix: enforce model access control on /responses endpoint 
The /responses proxy endpoint only required authentication via
get_verified_user but did not check per-model access grants. This
allowed any authenticated user to access any model through this
endpoint, bypassing the access control system.

Extract a shared check_model_access helper into utils/access_control
and replace all inline access control blocks across openai.py and
ollama.py (7 locations) with calls to this helper. This eliminates
code duplication and prevents future policy drift between endpoints.

CWE-862: Missing Authorization
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H (6.5 Medium)
 2026-04-07 19:26:54 +02:00
Timothy Jaeryang Baek
65ee771fd0 refac 2026-04-02 01:40:50 -05:00
Shirasawa
3f7fc1a75a
fix: Fix the error that occurs when the task model does not exist (#23169) 2026-04-01 07:01:25 -05:00
Timothy Jaeryang Baek
60676bfdcf refac 2026-04-01 06:40:49 -05:00
Timothy Jaeryang Baek
d6a9efca68 refac 2026-04-01 06:13:50 -05:00
Timothy Jaeryang Baek
15883e5229 refac 2026-04-01 06:00:53 -05:00
Timothy Jaeryang Baek
70c87a1ed1 refac 2026-04-01 05:54:58 -05:00
Shirasawa
d7a5a903a6
fix: guard completed API with message id (#23184) 2026-04-01 05:39:34 -05:00
Timothy Jaeryang Baek
b898fc0258 fix: gravatar profile image 2026-04-01 05:33:41 -05:00
Timothy Jaeryang Baek
18f6ec68b9 refac 2026-04-01 05:11:48 -05:00
Timothy Jaeryang Baek
7c52382c90 refac 2026-04-01 05:03:53 -05:00
Timothy Jaeryang Baek
c8ef5a4f38 chore: format 2026-04-01 04:36:02 -05:00
Timothy Jaeryang Baek
48288e9ce7 refac 2026-04-01 00:41:08 -05:00
Timothy Jaeryang Baek
90319593d0 refac 2026-04-01 00:35:11 -05:00
Timothy Jaeryang Baek
f984c6e79a refac 2026-04-01 00:17:04 -05:00
Timothy Jaeryang Baek
8a0794958d refac 2026-04-01 00:11:11 -05:00
Timothy Jaeryang Baek
378673408e refac 2026-03-31 23:39:54 -05:00
Timothy Jaeryang Baek
e6f38f52c8 feat: automation 2026-03-31 23:36:01 -05:00
Algorithm5838
98570d3547
perf: single yield per line in stream chunks handler (#23266) 2026-03-31 18:42:52 -05:00
Shirasawa
b10c70cfcf
feat: Save error messages to the database (#23231) 2026-03-31 04:11:47 -05:00
Timothy Jaeryang Baek
10b4b86ada refac 2026-03-30 05:10:24 -05:00
Timothy Jaeryang Baek
a06685a47b refac 2026-03-29 21:01:10 -05:00
Timothy Jaeryang Baek
1b1d85fe2e refac 2026-03-29 19:42:10 -05:00
Timothy Jaeryang Baek
bcb71bb520 feat: tasks 2026-03-29 18:01:04 -05:00
Timothy Jaeryang Baek
925f77f0f5 chore: format 2026-03-26 18:25:19 -05:00
Timothy Jaeryang Baek
f3f8f9874f refac 2026-03-26 18:24:17 -05:00
Timothy Jaeryang Baek
52a06bd48a refac 2026-03-26 18:22:14 -05:00
Timothy Jaeryang Baek
16335f866e refac 2026-03-26 17:38:23 -05:00
Timothy Jaeryang Baek
06635898d0 refac 2026-03-25 17:29:57 -05:00
Timothy Jaeryang Baek
0fa246a1c3 refac 2026-03-25 17:09:36 -05:00
Classic298
bfc606a9e3
fix: align file context injection by user-role messages for native FC (#22776) 
The add_file_context function used a positional zip() to pair API
payload messages with DB-stored messages. After
process_messages_with_output() expands assistant messages containing
tool calls into multiple OpenAI-format messages (assistant + tool
results), the payload list becomes longer than the stored list. This
caused the zip to misalign, so subsequent user messages never received
their attached_files tags -- the model could see uploaded images via
vision but had no file URL to pass to edit_image.

Fix: filter both lists to user-role messages only before zipping.
User messages maintain the same order in both lists regardless of
assistant message expansion, restoring correct file context injection.

Fixes #21878
 2026-03-25 16:56:43 -05:00
Timothy Jaeryang Baek
350d52f515 chore: format 2026-03-25 16:43:06 -05:00
Timothy Jaeryang Baek
857d7e6f37 refac 2026-03-25 02:49:34 -05:00
Timothy Jaeryang Baek
aa2f7fbe52 refac 2026-03-24 21:32:04 -05:00
Timothy Jaeryang Baek
d933991904 refac 2026-03-24 19:50:46 -05:00
Timothy Jaeryang Baek
601bb78358 feat: oauth 2.1 static mcp 
Co-Authored-By: Joost Mul <6438009+donmul@users.noreply.github.com>
 2026-03-24 17:58:21 -05:00
Timothy Jaeryang Baek
631bd20c35 refac 2026-03-24 17:46:33 -05:00
Timothy Jaeryang Baek
c0fcbc5b4c refac 2026-03-24 17:31:09 -05:00
Algorithm5838
e1cdd7e4fe
fix: use full_output() in reasoning content delta emit (#23001) 2026-03-24 17:00:12 -05:00
Timothy Jaeryang Baek
7eae377c01 perf: lookup 
Co-Authored-By: alifurkanstahl <180474740+alifurkanstahl@users.noreply.github.com>
 2026-03-24 16:24:46 -05:00
Tim Baek
c24a4da17d refac 2026-03-24 14:54:29 -05:00
Timothy Jaeryang Baek
6d7744c219 refac 2026-03-24 06:21:37 -05:00
Timothy Jaeryang Baek
a9c5c787b9 refac 2026-03-24 06:12:07 -05:00
Timothy Jaeryang Baek
f7e07f3ca1 chore: format 2026-03-24 06:07:20 -05:00
Timothy Jaeryang Baek
69171a4c8b refac 2026-03-24 05:13:31 -05:00
Timothy Jaeryang Baek
fe7e002fea refac 2026-03-24 04:58:48 -05:00
Timothy Jaeryang Baek
ade617efa8 refac 2026-03-24 04:49:48 -05:00
Timothy Jaeryang Baek
a3238aa79f refac 2026-03-23 20:42:48 -05:00
Timothy Jaeryang Baek
1c25b06dca refac 2026-03-23 19:46:24 -05:00
Timothy Jaeryang Baek
0f0ba7dadd refac 2026-03-23 16:56:50 -05:00