open-webui/backend/open_webui/routers
Classic298 0fc630b34b
fix: per-user model cache used static key= (cross-user model exposure) (#25783)
routers/openai.py and routers/ollama.py decorated get_all_models with
`@cached(key=lambda _, user: ...)`. In aiocache 0.12, `key=` is a STATIC
cache key: get_cache_key returns `self.key` verbatim (the lambda object)
without calling it, so every caller collides to ONE shared entry within
the TTL. The intended per-user namespacing never happened — one user's
permission-filtered model list could be served to another user (or an
anonymous caller) during the cache window.

The per-call hook is `key_builder=` (called as key_builder(func, *args,
**kwargs)). Switch both sites to key_builder with a (func, request,
user=None) signature so the key is built per call. user=None mirrors
ollama's optional-user signature and stays correct whether user is passed
positionally, as a kwarg, or omitted.

Verified offline: old form returns the same key object for distinct users
(collision); new form yields distinct openai_all_models_<id> /
ollama_all_models_<id> keys, and the unauthenticated base key when no user.
These two were the only @cached(key=lambda ...) sites in the backend.
2026-06-29 03:51:02 -05:00
..
analytics.py refac 2026-06-29 01:38:41 -05:00
audio.py Escape voice-derived attributes in Azure TTS SSML (#25776) 2026-06-29 02:16:37 -05:00
auths.py refac 2026-06-29 03:42:36 -05:00
automations.py refac 2026-06-25 03:31:45 +01:00
calendar.py refac 2026-06-25 03:31:45 +01:00
channels.py fix: bind channel thread parent/reply to the URL channel (#25766) 2026-06-29 03:46:50 -05:00
chats.py fix(api): handle orphaned shared_chat rows when unsharing (#25632) 2026-06-29 03:20:46 -05:00
configs.py refac 2026-06-29 02:57:58 -05:00
evaluations.py refac 2026-06-25 03:31:45 +01:00
files.py perf(retrieval): make URL fetch and file hash non-blocking with asyncio.to_thread (#25822) 2026-06-29 03:46:24 -05:00
folders.py refac 2026-06-25 03:31:45 +01:00
functions.py refac 2026-06-25 03:31:45 +01:00
groups.py refac 2026-06-25 03:31:45 +01:00
images.py perf(images): offload validate_url() DNS resolution with asyncio.to_thread (#25825) 2026-06-29 02:31:24 -05:00
knowledge.py refac 2026-06-25 03:31:45 +01:00
memories.py refac 2026-06-29 00:35:54 -05:00
models.py refac 2026-06-29 02:43:14 -05:00
notes.py refac 2026-06-25 03:31:45 +01:00
ollama.py fix: per-user model cache used static key= (cross-user model exposure) (#25783) 2026-06-29 03:51:02 -05:00
openai.py fix: per-user model cache used static key= (cross-user model exposure) (#25783) 2026-06-29 03:51:02 -05:00
pipelines.py refac 2026-06-25 03:31:45 +01:00
prompts.py refac 2026-06-25 03:31:45 +01:00
retrieval.py refac 2026-06-29 03:21:41 -05:00
scim.py refac 2026-06-25 03:31:45 +01:00
skills.py feat(permissions): add workspace.skills_import and workspace.skills_export permissions (#25921) 2026-06-29 01:36:27 -05:00
tasks.py refac 2026-06-17 02:58:11 +02:00
terminals.py refac 2026-06-25 03:31:45 +01:00
tools.py solve-valves-icon-disappear-issue (#26256) 2026-06-29 00:56:44 -05:00
users.py perf(auth): make password hashing non-blocking and batch CSV user import (#25804) 2026-06-29 02:45:39 -05:00
utils.py refac 2026-06-17 02:52:35 +02:00