mirror of
https://github.com/open-webui/open-webui.git
synced 2026-09-19 00:03:21 +00:00
e98730b20d
Web search results stored as a vector collection were silently dropped before retrieval when BYPASS_RETRIEVAL_ACCESS_CONTROL is False (the default). The server-generated web_search file item carries a 'collection_name' but its 'web_search' type is not matched by any explicit dispatch branch in get_sources_from_items, so it fell through to the untrusted client-supplied collection_name branch and was ignored. Add an explicit branch for type == 'web_search' items so the collection is queried again. Access control is preserved: the collection still passes through filter_accessible_collections, which already allowlists web-search-* and bypasses only for admins. Regression introduced when the retrieval access-control hardening gated the bare collection_name fallback behind BYPASS_RETRIEVAL_ACCESS_CONTROL. |
||
|---|---|---|
| .. | ||
| data | ||
| open_webui | ||
| .dockerignore | ||
| .gitignore | ||
| dev.sh | ||
| requirements-min.txt | ||
| requirements.txt | ||
| start.sh | ||
| start_windows.bat | ||