Classic298 d07fd7d6d8 fix: disable redirect following in OAuth picture fetch (SSRF) (#24809) ... _process_picture_url validated the initial picture URL with validate_url() but then aiohttp followed 3xx redirects without re-validating the target, so a validate_url-passing public URL could 302 to an internal address and the body was base64-stored in the user's profile_image_url. This is the sixth call site of the CVE-2026-45401 redirect-bypass cohort; the other five already pass allow_redirects=AIOHTTP_CLIENT_ALLOW_REDIRECTS. Apply the same.		2026-05-19 23:57:38 +04:00
..
data	refac: mv backend files to /open_webui dir	2024-09-04 16:54:48 +02:00
open_webui	fix: disable redirect following in OAuth picture fetch (SSRF) (#24809)	2026-05-19 23:57:38 +04:00
.dockerignore	fix: litellm config issue	2024-02-24 22:35:11 -08:00
.gitignore	refac	2024-09-06 04:59:20 +02:00
dev.sh	refac	2026-03-24 19:43:30 -05:00
requirements-min.txt	refac	2026-04-24 18:20:10 +09:00
requirements.txt	refactor(firecrawl): use v2 API directly (#23934)	2026-04-24 18:32:08 +09:00
start.sh	fix: default optional env vars used with bash ,, in start.sh (#24683)	2026-05-15 09:29:25 +09:00
start_windows.bat	refac	2026-04-24 15:40:02 +09:00