mirror of
https://github.com/open-webui/open-webui.git
synced 2026-09-21 00:21:19 +00:00
76947ff926
Open WebUI's collection ACL accepted any unknown name as a legacy/ephemeral collection. In Milvus multi-tenancy mode that name becomes the `resource_id` and is interpolated unescaped into a SQL-like Milvus expression — `resource_id == '<name>'` — so a name like x' or resource_id != '' or resource_id == 'x turns the filter into a tautology and returns every tenant's chunks from the shared collection. All collection names Open WebUI generates are UUIDs, SHA-256 hex digests, or fixed-prefix variants of those — they all fit [A-Za-z0-9_-]. Add a strict format check in filter_accessible_collections (utils.py) that drops any name outside that set before any ACL or vector-store lookup, applied even on the admin bypass path. _validate_collection_access then surfaces the dropped name as a 403. As defense in depth, MilvusClient now validates resource_id at every expression-construction site and escapes single quotes / backslashes in any other string interpolated into a filter (delete ids, metadata filter values). Non-string filter values are typed-checked instead of str()-formatted. Co-authored-by: Claude <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| chroma.py | ||
| elasticsearch.py | ||
| mariadb_vector.py | ||
| milvus.py | ||
| milvus_multitenancy.py | ||
| opengauss.py | ||
| opensearch.py | ||
| oracle23ai.py | ||
| pgvector.py | ||
| pinecone.py | ||
| qdrant.py | ||
| qdrant_multitenancy.py | ||
| s3vector.py | ||
| weaviate.py | ||