scriptoriumadmin/open-webui
1
0
Fork 0
mirror of https://github.com/open-webui/open-webui.git synced 2026-09-15 23:32:40 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3
open-webui/backend/open_webui
History
G30 34b8844ccf
fix(models): gracefully handle legacy svg profile_image_url in ModelMeta validator (#25173) 
The SVG-XSS hardening introduced in f5f4b5895 correctly rejects
data:image/svg+xml URIs on new input, but also caused a
pydantic_core.ValidationError when reading pre-existing models from
the database that had SVG data URIs stored as their profile images.

This ValidationError propagated unhandled through _to_model_model and
get_all_models, crashing the entire /api/models endpoint with HTTP 500
and leaving users with no models available in the UI.

Fix:
- Wrap validate_profile_image_url() in a try/except ValueError inside
  ModelMeta.check_profile_image_url. Legacy entries are cleared to None
  with a warning log instead of raising — the /model/profile/image API
  endpoint already falls back to /static/favicon.png when the value is
  empty.
- Default ModelMeta.profile_image_url to None instead of hardcoding
  /static/favicon.png, since the serving endpoint handles the fallback.
- Add a per-model try/except in ModelsTable.get_all_models so that any
  future unexpected validation failure on a single record skips that
  model with an error log rather than aborting the entire list.
2026-05-31 14:55:07 -07:00
..
data refac: mv backend files to /open_webui dir 2024-09-04 16:54:48 +02:00
internal refac 2026-05-21 16:25:25 +04:00
migrations refac 2026-05-21 15:29:49 +04:00
models fix(models): gracefully handle legacy svg profile_image_url in ModelMeta validator (#25173) 2026-05-31 14:55:07 -07:00
retrieval refac 2026-05-21 16:44:36 +04:00
routers fix: move bypass_system_prompt off query parameter onto request.state (#25156) 2026-05-31 14:53:53 -07:00
socket Update main.py (#25271) 2026-05-31 14:48:51 -07:00
static refac 2026-05-12 03:04:35 +09:00
storage refac: modernize type annotations (PEP 604 / PEP 585) 2026-05-12 17:10:15 +09:00
tools fix: add knowledge_id access check in search_knowledge_files (BOLA) (#25113) 2026-05-28 16:23:49 -05:00
utils fix: move bypass_system_prompt off query parameter onto request.state (#25156) 2026-05-31 14:53:53 -07:00
__init__.py refac 2026-05-09 02:38:08 +09:00
alembic.ini fix: Alembic CLI commands from failing 2025-08-15 04:17:47 -04:00
config.py refac 2026-05-21 16:56:56 +04:00
constants.py refac: modernize type annotations (PEP 604 / PEP 585) 2026-05-12 17:10:15 +09:00
env.py fix: remove hardcoded WEBUI_SECRET_KEY fallback, require key explicitly (#25218) 2026-05-31 14:53:25 -07:00
functions.py fix: emit [DONE] for AsyncGenerator pipe returns (#24763) 2026-05-19 22:07:56 +04:00
main.py refac 2026-05-21 16:56:56 +04:00
tasks.py refac: modernize type annotations (PEP 604 / PEP 585) 2026-05-12 17:10:15 +09:00