Classic298 897d69a35c fix: enforce feature permissions on the legacy chat-features block (image_generation, web_search) (#26703) ... The legacy features block in process_chat_payload honoured client-supplied features.image_generation and features.web_search flags and dispatched to the image generation/edit provider and the web-search provider without re-checking the per-user permission that the direct /images routes and the native function-calling path enforce. A user denied features.image_generation or features.web_search could still trigger billable server-side image generation or web search via POST /api/chat/completions with params.function_calling set to legacy. Gate both branches on admin-or-has_permission before invoking chat_image_generation_handler / chat_web_search_handler, matching the existing code_interpreter gate, so a forged flag from an unpermitted user is ignored. Normal completions and permitted users are unaffected.		2026-07-27 01:54:00 -04:00
..
access_control	chore: format	2026-07-27 00:12:47 -04:00
images	refac	2026-07-01 02:48:29 -05:00
mcp	refac	2026-06-29 11:56:00 -05:00
telemetry	refac(telemetry): drop deprecated semconv SpanAttributes subclass (#25784)	2026-06-29 02:05:34 -05:00
actions.py	fix: enforce action availability and model access on the chat action route (#27243)	2026-07-23 12:23:05 -04:00
anthropic.py	refac	2026-07-26 18:46:39 -04:00
asgi_middleware.py	fix: report sub-second timings in the X-Process-Time header (#27368)	2026-07-23 18:09:23 -05:00
audit.py	refac	2026-07-23 22:52:23 -04:00
auth.py	fix: apply the verified-user role gate to WebSocket authentication (#27537)	2026-07-26 17:27:54 -04:00
automations.py	chore: format	2026-07-27 00:12:47 -04:00
calendar.py	feat: add repeat/recurrence dropdown to calendar event modal (#25865)	2026-06-29 02:16:19 -05:00
channels.py	refac	2026-03-17 17:58:01 -05:00
chat.py	perf: halve Redis round trips on model resolution and socket pools (#27225)	2026-07-23 21:32:01 -04:00
chat_fork.py	refac	2026-07-23 02:54:56 -04:00
chat_id.py	refac	2026-07-26 21:12:14 -04:00
chat_variables.py	refac	2026-07-24 01:44:30 -04:00
code_interpreter.py	refac: modernize type annotations (PEP 604 / PEP 585)	2026-05-12 17:10:15 +09:00
context_compaction.py	refac	2026-07-27 01:13:09 -04:00
embeddings.py	refac: modernize type annotations (PEP 604 / PEP 585)	2026-05-12 17:10:15 +09:00
files.py	refac	2026-07-23 21:29:33 -04:00
filter.py	refac	2026-07-23 12:48:14 -04:00
groups.py	refac: modernize type annotations (PEP 604 / PEP 585)	2026-05-12 17:10:15 +09:00
headers.py	chore: format	2026-07-27 00:12:47 -04:00
logger.py	chore: format	2026-06-01 13:56:55 -07:00
memory.py	refac	2026-07-01 03:35:46 -05:00
middleware.py	fix: enforce feature permissions on the legacy chat-features block (image_generation, web_search) (#26703)	2026-07-27 01:54:00 -04:00
misc.py	refac	2026-07-27 00:55:16 -04:00
model_ids.py	refac	2026-07-26 23:09:22 -04:00
models.py	perf: stop refetching the model row and user groups in the completion access check (#27378)	2026-07-27 01:52:04 -04:00
notifications.py	refac	2026-07-16 01:37:21 -04:00
oauth.py	fix: route OAuth profile-picture fetch through the SSRF-safe session (#26699)	2026-07-27 00:56:24 -04:00
payload.py	perf: drop the full-payload deepcopy in the OpenAI to Ollama conversion (#27371)	2026-07-27 01:47:23 -04:00
pdf_generator.py	refac: modernize type annotations (PEP 604 / PEP 585)	2026-05-12 17:10:15 +09:00
plugin.py	refac	2026-07-23 19:17:19 -04:00
rate_limit.py	refac: modernize type annotations (PEP 604 / PEP 585)	2026-05-12 17:10:15 +09:00
redis.py	fix: Set default Redis socket timeout to None (#27104)	2026-07-27 00:30:00 -04:00
response.py	refac	2026-07-26 18:54:07 -04:00
sanitize.py	refac	2026-03-17 17:58:01 -05:00
security_headers.py	perf: stop recomputing static work in per-response ASGI middlewares (#27229)	2026-07-23 12:29:01 -04:00
session_pool.py	perf: stream pure passthrough proxy responses by network chunk instead of by line (#27384)	2026-07-27 00:58:24 -04:00
subagents.py	chore: format	2026-07-20 22:11:42 -04:00
task.py	refac	2026-06-19 00:16:06 +02:00
terminals.py	refac	2026-07-10 18:32:21 -05:00
timers.py	fix: scope timer cancellation to the timer's owner (#27472)	2026-07-26 18:12:44 -04:00
tools.py	refac	2026-07-27 00:34:25 -04:00
validate.py	chore: format	2026-06-01 13:56:55 -07:00
valves.py	refac	2026-06-29 12:29:10 -05:00
webhook.py	refac	2026-07-26 17:58:01 -04:00