mirror of
https://github.com/open-webui/open-webui.git
synced 2026-09-06 08:18:53 +00:00
9a3eea6448
The history diff, delete, and version-restore routes authorize the URL prompt_id but then act on a caller-supplied history/version id without checking it belongs to that prompt (IDOR). Filter by prompt_id in compute_diff and delete_history_entry, and reject a cross-prompt version_id in update_prompt_version. Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| access_grants.py | ||
| auths.py | ||
| automations.py | ||
| calendar.py | ||
| channels.py | ||
| chat_messages.py | ||
| chats.py | ||
| feedbacks.py | ||
| files.py | ||
| folders.py | ||
| functions.py | ||
| groups.py | ||
| knowledge.py | ||
| memories.py | ||
| messages.py | ||
| models.py | ||
| notes.py | ||
| oauth_sessions.py | ||
| prompt_history.py | ||
| prompts.py | ||
| shared_chats.py | ||
| skills.py | ||
| tags.py | ||
| tools.py | ||
| users.py | ||