Classic298 f5f4b58958 fix: harden model profile image against SVG stored XSS (#25060) ... ModelMeta.profile_image_url now runs validate_profile_image_url, rejecting SVG/script data URIs (matching UserUpdateForm and ChannelWebhookForm). The /model/profile/image endpoint enforces the PROFILE_IMAGE_ALLOWED_MIME_TYPES allowlist and sets X-Content-Type-Options: nosniff, so an SVG data URI can no longer be served inline on-origin. Closes the fourth profile-image XSS sink missed by the user and webhook fixes. Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>		2026-05-28 17:41:55 -05:00
..
data	refac: mv backend files to /open_webui dir	2024-09-04 16:54:48 +02:00
internal	refac	2026-05-21 16:25:25 +04:00
migrations	refac	2026-05-21 15:29:49 +04:00
models	fix: harden model profile image against SVG stored XSS (#25060)	2026-05-28 17:41:55 -05:00
retrieval	refac	2026-05-21 16:44:36 +04:00
routers	fix: harden model profile image against SVG stored XSS (#25060)	2026-05-28 17:41:55 -05:00
socket	fix: resolve NameError for redis_sentinels in session_cleanup_lock	2026-05-21 13:41:21 +04:00
static	refac	2026-05-12 03:04:35 +09:00
storage	refac: modernize type annotations (PEP 604 / PEP 585)	2026-05-12 17:10:15 +09:00
tools	fix: add knowledge_id access check in search_knowledge_files (BOLA) (#25113)	2026-05-28 16:23:49 -05:00
utils	fix(auth): use request.scope["path"] to prevent CVE-2026-48710 (BadHost) (#25123)	2026-05-28 16:41:56 -05:00
__init__.py	refac	2026-05-09 02:38:08 +09:00
alembic.ini	fix: Alembic CLI commands from failing	2025-08-15 04:17:47 -04:00
config.py	refac	2026-05-21 16:56:56 +04:00
constants.py	refac: modernize type annotations (PEP 604 / PEP 585)	2026-05-12 17:10:15 +09:00
env.py	refac	2026-05-20 00:22:27 +04:00
functions.py	fix: emit [DONE] for AsyncGenerator pipe returns (#24763)	2026-05-19 22:07:56 +04:00
main.py	refac	2026-05-21 16:56:56 +04:00
tasks.py	refac: modernize type annotations (PEP 604 / PEP 585)	2026-05-12 17:10:15 +09:00