scriptoriumadmin/open-webui
1
0
Fork 0
mirror of https://github.com/open-webui/open-webui.git synced 2026-09-17 23:52:29 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3
open-webui/backend/open_webui/routers
History
Classic298 9a3eea6448
fix: bind prompt history/version ops to the authorized prompt (#25056) 
The history diff, delete, and version-restore routes authorize the URL
prompt_id but then act on a caller-supplied history/version id without
checking it belongs to that prompt (IDOR). Filter by prompt_id in
compute_diff and delete_history_entry, and reject a cross-prompt version_id
in update_prompt_version.

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-06-01 12:07:52 -07:00
..
analytics.py refac: modernize type annotations (PEP 604 / PEP 585) 2026-05-12 17:10:15 +09:00
audio.py refac 2026-05-31 14:59:28 -07:00
auths.py fix: don't block first-admin signup on stale ENABLE_SIGNUP (#24821) 2026-06-01 11:44:36 -07:00
automations.py refac: modernize type annotations (PEP 604 / PEP 585) 2026-05-12 17:10:15 +09:00
calendar.py fix: check destination calendar write access on event update (#24764) 2026-05-19 21:26:58 +04:00
channels.py refac 2026-05-19 20:44:38 +04:00
chats.py fix: don't revert replace/outlet content on chat save (#25485) 2026-06-01 11:45:05 -07:00
configs.py refac: modernize type annotations (PEP 604 / PEP 585) 2026-05-12 17:10:15 +09:00
evaluations.py refactor: remove unused GET /evaluations/feedbacks/all endpoint (#24778) 2026-05-19 20:49:22 +04:00
files.py refac 2026-06-01 09:53:04 -07:00
folders.py refac: modernize type annotations (PEP 604 / PEP 585) 2026-05-12 17:10:15 +09:00
functions.py refac: modernize type annotations (PEP 604 / PEP 585) 2026-05-12 17:10:15 +09:00
groups.py refac 2026-05-14 13:12:59 +09:00
images.py fix(images): pass content_type=None to r.json() to accept non-standard MIME types (#24838) 2026-06-01 10:33:24 -07:00
knowledge.py refac 2026-06-01 11:34:46 -07:00
memories.py refac 2026-05-21 14:01:57 +04:00
models.py fix: harden model profile image against SVG stored XSS (#25060) 2026-05-28 17:41:55 -05:00
notes.py refac: modernize type annotations (PEP 604 / PEP 585) 2026-05-12 17:10:15 +09:00
ollama.py refac 2026-05-31 18:42:28 -07:00
openai.py fix: move bypass_system_prompt off query parameter onto request.state (#25156) 2026-05-31 14:53:53 -07:00
pipelines.py refac: modernize type annotations (PEP 604 / PEP 585) 2026-05-12 17:10:15 +09:00
prompts.py fix: bind prompt history/version ops to the authorized prompt (#25056) 2026-06-01 12:07:52 -07:00
retrieval.py refac 2026-05-31 15:10:48 -07:00
scim.py refac: modernize type annotations (PEP 604 / PEP 585) 2026-05-12 17:10:15 +09:00
skills.py refac: modernize type annotations (PEP 604 / PEP 585) 2026-05-12 17:10:15 +09:00
tasks.py refac 2026-05-14 13:19:00 +09:00
terminals.py fix: don't hang terminal proxy when one forwarding pump exits first (#25479) 2026-06-01 10:10:04 -07:00
tools.py refac 2026-05-21 14:01:57 +04:00
users.py refac 2026-05-21 15:29:49 +04:00
utils.py refac 2026-05-21 16:25:25 +04:00