mirror of
https://github.com/open-webui/open-webui.git
synced 2026-09-29 01:41:47 +00:00
ddec5556dd
Open WebUI's collection ACL accepted any unknown name as a legacy/ephemeral collection. In Milvus multi-tenancy mode that name becomes the `resource_id` and is interpolated unescaped into a SQL-like Milvus expression — `resource_id == '<name>'` — so a name like x' or resource_id != '' or resource_id == 'x turns the filter into a tautology and returns every tenant's chunks from the shared collection. All collection names Open WebUI generates are UUIDs, SHA-256 hex digests, or fixed-prefix variants of those — they all fit [A-Za-z0-9_-]. Add a strict format check in filter_accessible_collections (utils.py) that drops any name outside that set before any ACL or vector-store lookup, applied even on the admin bypass path. _validate_collection_access then surfaces the dropped name as a 403. As defense in depth, MilvusClient now validates resource_id at every expression-construction site and escapes single quotes / backslashes in any other string interpolated into a filter (delete ids, metadata filter values). Non-string filter values are typed-checked instead of str()-formatted. |
||
|---|---|---|
| .. | ||
| loaders | ||
| models | ||
| vector | ||
| web | ||
| utils.py | ||