open-webui/backend/open_webui/retrieval
Classic298 fc9ad75164
fix: admins can still read and change other users' chats with ENABLE_ADMIN_CHAT_ACCESS off (#31416)
With ENABLE_ADMIN_CHAT_ACCESS turned off, opening another user's chat was refused, but through direct API requests an admin could still get the whole chat back in the reply to editing or deleting one of its messages, grant themselves read access in the chat's share settings, clone a chat someone shared privately with another user, or delete the chat. They could also send messages into it, attach it as context to their own chat, approve its tool calls, and list or stop its running replies. All of these are now refused for an admin on another user's chat, the same as opening it. With the setting on, admins keep full access as before.

Fixes #31413
2026-09-28 01:51:59 +04:00
..
loaders fix: backslashes in uploaded HTML files turn into line breaks or break the upload (#31450) 2026-09-27 23:08:14 +04:00
models fix: repair two broken logging calls, one of which makes VECTOR_DB=opengauss unusable (#27838) 2026-08-10 22:19:41 -06:00
vector fix: file uploads and hybrid search fail on Qdrant with strict mode enabled (#31461) 2026-09-27 22:58:42 +04:00
web feat: add a Tavily search depth setting (#31308) 2026-09-27 23:15:09 +04:00
external.py refac 2026-07-27 01:59:17 -04:00
utils.py fix: admins can still read and change other users' chats with ENABLE_ADMIN_CHAT_ACCESS off (#31416) 2026-09-28 01:51:59 +04:00