scriptoriumadmin/open-webui
1
0
Fork 0
mirror of https://github.com/open-webui/open-webui.git synced 2026-10-01 02:01:35 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3
open-webui/backend/open_webui
History
Classic298 3f1c52e018
fix: gate chat-file links by caller access + repair insert_chat_files db arg (#25054) 
insert_chat_files() stored any caller-supplied file_id with no ownership
check, so a user could attach another user's file to their own chat and
then read it through the shared-chat access path in has_access_to_file().
Filter file_ids to those the caller owns, is admin for, or can read.

Also repairs an UnboundLocalError introduced in 260ead64d: the existing
duplicate-check referenced `session` before it was assigned (db=session),
so the function threw on every call and no chat_file rows were persisted.
2026-05-28 17:42:17 -05:00
..
data refac: mv backend files to /open_webui dir 2024-09-04 16:54:48 +02:00
internal refac 2026-05-21 16:25:25 +04:00
migrations refac 2026-05-21 15:29:49 +04:00
models fix: gate chat-file links by caller access + repair insert_chat_files db arg (#25054) 2026-05-28 17:42:17 -05:00
retrieval refac 2026-05-21 16:44:36 +04:00
routers fix: harden model profile image against SVG stored XSS (#25060) 2026-05-28 17:41:55 -05:00
socket fix: resolve NameError for redis_sentinels in session_cleanup_lock 2026-05-21 13:41:21 +04:00
static refac 2026-05-12 03:04:35 +09:00
storage refac: modernize type annotations (PEP 604 / PEP 585) 2026-05-12 17:10:15 +09:00
tools fix: add knowledge_id access check in search_knowledge_files (BOLA) (#25113) 2026-05-28 16:23:49 -05:00
utils fix(auth): use request.scope["path"] to prevent CVE-2026-48710 (BadHost) (#25123) 2026-05-28 16:41:56 -05:00
__init__.py refac 2026-05-09 02:38:08 +09:00
alembic.ini fix: Alembic CLI commands from failing 2025-08-15 04:17:47 -04:00
config.py refac 2026-05-21 16:56:56 +04:00
constants.py refac: modernize type annotations (PEP 604 / PEP 585) 2026-05-12 17:10:15 +09:00
env.py refac 2026-05-20 00:22:27 +04:00
functions.py fix: emit [DONE] for AsyncGenerator pipe returns (#24763) 2026-05-19 22:07:56 +04:00
main.py refac 2026-05-21 16:56:56 +04:00
tasks.py refac: modernize type annotations (PEP 604 / PEP 585) 2026-05-12 17:10:15 +09:00