mirror of
https://github.com/open-webui/open-webui.git
synced 2026-09-16 23:43:03 +00:00
d3737176bc
`pin_channel_message` (channels.py:1242) checked `permission='read'` on the standard-channel branch before mutating `is_pinned` / `pinned_by` / `pinned_at` via `Messages.update_is_pinned_by_id`. Pin/unpin is a write operation; gating it on read access let any user with read-only channel access pin or unpin any message in the channel, including admin posts. One-character fix: change `permission='read'` to `permission='write'`. Reported by kikayli in GHSA-5gc6-xhv4-2wg6. Co-authored-by: kikayli <kikayli@users.noreply.github.com> |
||
|---|---|---|
| .. | ||
| data | ||
| internal | ||
| migrations | ||
| models | ||
| retrieval | ||
| routers | ||
| socket | ||
| static | ||
| storage | ||
| test | ||
| tools | ||
| utils | ||
| __init__.py | ||
| alembic.ini | ||
| config.py | ||
| constants.py | ||
| env.py | ||
| functions.py | ||
| main.py | ||
| tasks.py | ||