mirror of
https://github.com/open-webui/open-webui.git
synced 2026-09-14 23:22:44 +00:00
3fe829acc2
The per-id model endpoint (GET /api/v1/models/model) strips params, the system prompt and other curated model config, for callers who only have read access. The list endpoint (GET /api/v1/models/list) did not: it returned each read-accessible model's full params, so a read-shared model exposed its params.system to non-owner read-grant holders. Mirror the per-id behaviour: compute write_access per item and drop params before serialising when the caller lacks write access (not the owner, not an admin under BYPASS_ADMIN_ACCESS_CONTROL and holding no write grant). The model-card list UI does not render params, so this does not change functionality. Co-authored-by: bogdancherniy11-sudo <229690748+bogdancherniy11-sudo@users.noreply.github.com> |
||
|---|---|---|
| .. | ||
| data | ||
| internal | ||
| migrations | ||
| models | ||
| retrieval | ||
| routers | ||
| socket | ||
| static | ||
| storage | ||
| tools | ||
| utils | ||
| __init__.py | ||
| alembic.ini | ||
| config.py | ||
| constants.py | ||
| env.py | ||
| events.py | ||
| functions.py | ||
| main.py | ||
| tasks.py | ||