open-webui/backend/open_webui
Classic298 0fc630b34b
fix: per-user model cache used static key= (cross-user model exposure) (#25783)
routers/openai.py and routers/ollama.py decorated get_all_models with
`@cached(key=lambda _, user: ...)`. In aiocache 0.12, `key=` is a STATIC
cache key: get_cache_key returns `self.key` verbatim (the lambda object)
without calling it, so every caller collides to ONE shared entry within
the TTL. The intended per-user namespacing never happened — one user's
permission-filtered model list could be served to another user (or an
anonymous caller) during the cache window.

The per-call hook is `key_builder=` (called as key_builder(func, *args,
**kwargs)). Switch both sites to key_builder with a (func, request,
user=None) signature so the key is built per call. user=None mirrors
ollama's optional-user signature and stays correct whether user is passed
positionally, as a kwarg, or omitted.

Verified offline: old form returns the same key object for distinct users
(collision); new form yields distinct openai_all_models_<id> /
ollama_all_models_<id> keys, and the unauthenticated base key when no user.
These two were the only @cached(key=lambda ...) sites in the backend.
2026-06-29 03:51:02 -05:00
..
data refac: mv backend files to /open_webui dir 2024-09-04 16:54:48 +02:00
internal refac 2026-06-17 02:52:35 +02:00
migrations refac 2026-06-29 00:21:37 -05:00
models fix: bind channel thread parent/reply to the URL channel (#25766) 2026-06-29 03:46:50 -05:00
retrieval fix: pass web search results to model when embedding & retrieval enabled (#25600) 2026-06-29 03:34:55 -05:00
routers fix: per-user model cache used static key= (cross-user model exposure) (#25783) 2026-06-29 03:51:02 -05:00
socket refac 2026-06-29 02:26:27 -05:00
static chore: format 2026-06-01 14:10:40 -07:00
storage refac: modernize type annotations (PEP 604 / PEP 585) 2026-05-12 17:10:15 +09:00
tools refac 2026-06-29 00:46:45 -05:00
utils refac 2026-06-29 03:42:36 -05:00
__init__.py refac 2026-06-17 03:01:11 +02:00
alembic.ini fix: Alembic CLI commands from failing 2025-08-15 04:17:47 -04:00
config.py refac 2026-06-29 01:52:07 -05:00
constants.py refac: modernize type annotations (PEP 604 / PEP 585) 2026-05-12 17:10:15 +09:00
env.py refac 2026-06-29 03:42:36 -05:00
events.py refac 2026-06-25 15:56:10 +01:00
functions.py fix: emit [DONE] for AsyncGenerator pipe returns (#24763) 2026-05-19 22:07:56 +04:00
main.py refac 2026-06-29 02:57:58 -05:00
tasks.py refac: modernize type annotations (PEP 604 / PEP 585) 2026-05-12 17:10:15 +09:00