scriptoriumadmin/open-webui
1
0
Fork 0
mirror of https://github.com/open-webui/open-webui.git synced 2026-09-15 23:32:40 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions
open-webui/backend/open_webui/models
History
Classic298 3f1c52e018
fix: gate chat-file links by caller access + repair insert_chat_files db arg (#25054) 
insert_chat_files() stored any caller-supplied file_id with no ownership
check, so a user could attach another user's file to their own chat and
then read it through the shared-chat access path in has_access_to_file().
Filter file_ids to those the caller owns, is admin for, or can read.

Also repairs an UnboundLocalError introduced in 260ead64d: the existing
duplicate-check referenced `session` before it was assigned (db=session),
so the function threw on every call and no chat_file rows were persisted.
2026-05-28 17:42:17 -05:00
..
access_grants.py refac: modernize type annotations (PEP 604 / PEP 585) 2026-05-12 17:10:15 +09:00
auths.py refac 2026-05-21 15:29:49 +04:00
automations.py refac: modernize type annotations (PEP 604 / PEP 585) 2026-05-12 17:10:15 +09:00
calendar.py refac: modernize type annotations (PEP 604 / PEP 585) 2026-05-12 17:10:15 +09:00
channels.py refac: modernize type annotations (PEP 604 / PEP 585) 2026-05-12 17:10:15 +09:00
chat_messages.py refac 2026-05-19 20:37:53 +04:00
chats.py fix: gate chat-file links by caller access + repair insert_chat_files db arg (#25054) 2026-05-28 17:42:17 -05:00
feedbacks.py refac: modernize type annotations (PEP 604 / PEP 585) 2026-05-12 17:10:15 +09:00
files.py refac 2026-05-21 15:29:49 +04:00
folders.py refac: modernize type annotations (PEP 604 / PEP 585) 2026-05-12 17:10:15 +09:00
functions.py refac 2026-05-21 15:29:49 +04:00
groups.py refac: modernize type annotations (PEP 604 / PEP 585) 2026-05-12 17:10:15 +09:00
knowledge.py refac 2026-05-28 17:24:33 -05:00
memories.py refac 2026-05-21 15:29:49 +04:00
messages.py refac: modernize type annotations (PEP 604 / PEP 585) 2026-05-12 17:10:15 +09:00
models.py fix: harden model profile image against SVG stored XSS (#25060) 2026-05-28 17:41:55 -05:00
notes.py refac 2026-05-14 01:49:34 +09:00
oauth_sessions.py refac: modernize type annotations (PEP 604 / PEP 585) 2026-05-12 17:10:15 +09:00
prompt_history.py refac: modernize type annotations (PEP 604 / PEP 585) 2026-05-12 17:10:15 +09:00
prompts.py fix(prompts): resolve undefined session variable in _get_access_grants and _to_prompt_model (#25129) 2026-05-28 16:23:25 -05:00
shared_chats.py refac: modernize type annotations (PEP 604 / PEP 585) 2026-05-12 17:10:15 +09:00
skills.py refac: modernize type annotations (PEP 604 / PEP 585) 2026-05-12 17:10:15 +09:00
tags.py refac 2026-05-21 15:29:49 +04:00
tools.py refac 2026-05-21 15:29:49 +04:00
users.py refac 2026-05-21 15:29:49 +04:00