Classic298 d3737176bc fix: require write permission for pin_channel_message on standard channels (#24521) ... `pin_channel_message` (channels.py:1242) checked `permission='read'` on the standard-channel branch before mutating `is_pinned` / `pinned_by` / `pinned_at` via `Messages.update_is_pinned_by_id`. Pin/unpin is a write operation; gating it on read access let any user with read-only channel access pin or unpin any message in the channel, including admin posts. One-character fix: change `permission='read'` to `permission='write'`. Reported by kikayli in GHSA-5gc6-xhv4-2wg6. Co-authored-by: kikayli <kikayli@users.noreply.github.com>		2026-05-11 00:59:50 +09:00
..
data	refac: mv backend files to /open_webui dir	2024-09-04 16:54:48 +02:00
open_webui	fix: require write permission for pin_channel_message on standard channels (#24521)	2026-05-11 00:59:50 +09:00
.dockerignore	fix: litellm config issue	2024-02-24 22:35:11 -08:00
.gitignore	refac	2024-09-06 04:59:20 +02:00
dev.sh	refac	2026-03-24 19:43:30 -05:00
requirements-min.txt	refac	2026-04-24 18:20:10 +09:00
requirements.txt	refactor(firecrawl): use v2 API directly (#23934)	2026-04-24 18:32:08 +09:00
start.sh	refac	2026-03-24 19:43:30 -05:00
start_windows.bat	refac	2026-04-24 15:40:02 +09:00