mirror of
https://github.com/open-webui/open-webui.git
synced 2026-10-23 05:33:48 +00:00
5835cd93cf
- InterfaceSettings now reads from a reactive activeSettings alias (initialSettings in admin mode, $settings otherwise) instead of reading $settings directly. toggleTitleAutoGenerate spreads activeSettings.title and the chat-bubble template branch uses the local chatBubble state, so the admin defaults modal no longer mixes the current admin's personal settings into the payload or the render logic. - deepMerge skips __proto__, constructor, and prototype keys before copying. Inputs come from API payloads and localStorage, both untrusted channels, and a crafted payload could otherwise mutate the object prototype chain or reassign the constructor during app init. - GET /configs/interface/defaults swaps Cache-Control: private, max-age=600 for no-store. The endpoint is fetched on every authenticated app load and merged into runtime settings, so a 10-minute freshness window made admin "save defaults" and "reset all users" appear to have no effect for up to ten minutes. The read is cheap (in-memory config), so skipping the cache is fine. |
||
|---|---|---|
| .. | ||
| data | ||
| open_webui | ||
| .dockerignore | ||
| .gitignore | ||
| dev.sh | ||
| requirements-min.txt | ||
| requirements.txt | ||
| start.sh | ||
| start_windows.bat | ||