mirror of
https://github.com/open-webui/open-webui.git
synced 2026-10-24 05:44:07 +00:00
5835cd93cf
- InterfaceSettings now reads from a reactive activeSettings alias (initialSettings in admin mode, $settings otherwise) instead of reading $settings directly. toggleTitleAutoGenerate spreads activeSettings.title and the chat-bubble template branch uses the local chatBubble state, so the admin defaults modal no longer mixes the current admin's personal settings into the payload or the render logic. - deepMerge skips __proto__, constructor, and prototype keys before copying. Inputs come from API payloads and localStorage, both untrusted channels, and a crafted payload could otherwise mutate the object prototype chain or reassign the constructor during app init. - GET /configs/interface/defaults swaps Cache-Control: private, max-age=600 for no-store. The endpoint is fetched on every authenticated app load and merged into runtime settings, so a 10-minute freshness window made admin "save defaults" and "reset all users" appear to have no effect for up to ten minutes. The read is cheap (in-memory config), so skipping the cache is fine. |
||
|---|---|---|
| .. | ||
| analytics.py | ||
| audio.py | ||
| auths.py | ||
| automations.py | ||
| channels.py | ||
| chats.py | ||
| configs.py | ||
| evaluations.py | ||
| files.py | ||
| folders.py | ||
| functions.py | ||
| groups.py | ||
| images.py | ||
| knowledge.py | ||
| memories.py | ||
| models.py | ||
| notes.py | ||
| ollama.py | ||
| openai.py | ||
| pipelines.py | ||
| prompts.py | ||
| retrieval.py | ||
| scim.py | ||
| skills.py | ||
| tasks.py | ||
| terminals.py | ||
| tools.py | ||
| users.py | ||
| utils.py | ||