mirror of
https://github.com/open-webui/open-webui.git
synced 2026-09-20 00:11:27 +00:00
e038bab66d
The direct image-edit route was the only image-edit surface with no authorization: it ran on get_verified_user alone, while POST /generations enforces ENABLE_IMAGE_GENERATION + features.image_generation and the built-in edit_image tool enforces ENABLE_IMAGE_EDIT + features.image_generation. A verified non-admin user could therefore reach the configured image-edit provider (spending IMAGES_EDIT_OPENAI_API_KEY) even when the administrator had globally disabled image editing (ENABLE_IMAGE_EDIT=False) or denied the user image generation. Split the route from the shared impl (mirroring generate_images/image_generations): the new /edit wrapper enforces ENABLE_IMAGE_EDIT and the per-user image-generation permission, then delegates to image_edits(). The internal callers (the edit_image tool and the chat middleware) already gate themselves and call image_edits() directly, so they are unaffected. Co-authored-by: jagstack <52110932+jagstack@users.noreply.github.com> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| analytics.py | ||
| audio.py | ||
| auths.py | ||
| automations.py | ||
| calendar.py | ||
| channels.py | ||
| chats.py | ||
| configs.py | ||
| evaluations.py | ||
| files.py | ||
| folders.py | ||
| functions.py | ||
| groups.py | ||
| images.py | ||
| knowledge.py | ||
| memories.py | ||
| models.py | ||
| notes.py | ||
| ollama.py | ||
| openai.py | ||
| pipelines.py | ||
| prompts.py | ||
| retrieval.py | ||
| scim.py | ||
| skills.py | ||
| tasks.py | ||
| terminals.py | ||
| tools.py | ||
| users.py | ||
| utils.py | ||