open-webui/backend
Classic298 4f94d21780
fix: enforce filter_allowed_access_grants on channel create and update (#23638)
Unlike all other resource routers (knowledge, models, notes, prompts, tools, skills), the channel router did not call filter_allowed_access_grants. This allowed any user to set wildcard access grants on group channels, bypassing the admin's public sharing permission framework.

Adds filter_allowed_access_grants with the sharing.public_channels permission key to both create and update endpoints, matching the pattern used by all other resource routers.
2026-04-12 16:27:44 -05:00
..
data refac: mv backend files to /open_webui dir 2024-09-04 16:54:48 +02:00
open_webui fix: enforce filter_allowed_access_grants on channel create and update (#23638) 2026-04-12 16:27:44 -05:00
.dockerignore fix: litellm config issue 2024-02-24 22:35:11 -08:00
.gitignore refac 2024-09-06 04:59:20 +02:00
dev.sh refac 2026-03-24 19:43:30 -05:00
requirements-min.txt refac: async db 2026-04-12 14:22:11 -05:00
requirements.txt refac: async db 2026-04-12 14:22:11 -05:00
start.sh refac 2026-03-24 19:43:30 -05:00
start_windows.bat refac 2026-03-24 19:43:30 -05:00