mirror of
https://github.com/open-webui/open-webui.git
synced 2026-09-17 23:52:29 +00:00
f5f4b58958
ModelMeta.profile_image_url now runs validate_profile_image_url, rejecting SVG/script data URIs (matching UserUpdateForm and ChannelWebhookForm). The /model/profile/image endpoint enforces the PROFILE_IMAGE_ALLOWED_MIME_TYPES allowlist and sets X-Content-Type-Options: nosniff, so an SVG data URI can no longer be served inline on-origin. Closes the fourth profile-image XSS sink missed by the user and webhook fixes. Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| access_grants.py | ||
| auths.py | ||
| automations.py | ||
| calendar.py | ||
| channels.py | ||
| chat_messages.py | ||
| chats.py | ||
| feedbacks.py | ||
| files.py | ||
| folders.py | ||
| functions.py | ||
| groups.py | ||
| knowledge.py | ||
| memories.py | ||
| messages.py | ||
| models.py | ||
| notes.py | ||
| oauth_sessions.py | ||
| prompt_history.py | ||
| prompts.py | ||
| shared_chats.py | ||
| skills.py | ||
| tags.py | ||
| tools.py | ||
| users.py | ||