Classic298 e790e7be7a fix: enforce model access control on /responses endpoint (#23481) ... The /responses proxy endpoint only required authentication via get_verified_user but did not check per-model access grants. This allowed any authenticated user to access any model through this endpoint, bypassing the access control system. Extract a shared check_model_access helper into utils/access_control and replace all inline access control blocks across openai.py and ollama.py (7 locations) with calls to this helper. This eliminates code duplication and prevents future policy drift between endpoints. CWE-862: Missing Authorization CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H (6.5 Medium)		2026-04-12 11:06:33 -05:00
..
data	refac: mv backend files to /open_webui dir	2024-09-04 16:54:48 +02:00
open_webui	fix: enforce model access control on /responses endpoint (#23481)	2026-04-12 11:06:33 -05:00
.dockerignore	fix: litellm config issue	2024-02-24 22:35:11 -08:00
.gitignore	refac	2024-09-06 04:59:20 +02:00
dev.sh	refac	2026-03-24 19:43:30 -05:00
requirements-min.txt	chore: dep bump (#22305)	2026-03-07 17:12:22 -06:00
requirements.txt	refac	2026-03-24 20:06:43 -05:00
start.sh	refac	2026-03-24 19:43:30 -05:00
start_windows.bat	refac	2026-03-24 19:43:30 -05:00