Classic298 fe4b319428 fix: deny chained access to unregistered base models for non-admins (#26905) ... A workspace model shared publicly could be used by any user even when its base model was private. Unregistered base models (no row in the model table) are admin-only for direct use — get_filtered_models hides them from non-admins and check_model_access rejects them — but has_base_model_access treated a missing row as "no ACL" and allowed the chained request through. has_base_model_access now takes the caller's role and only allows an unregistered base model hop for admins, so a shared preset can no longer reach a base model the caller could not use directly. Registered base models keep their existing grant-based enforcement. Claude-Session: https://claude.ai/code/session_018toPfJW1hMXAhokGaL43Ep Co-authored-by: Claude <noreply@anthropic.com>		2026-07-24 01:32:32 -05:00
..
access_control	fix: deny chained access to unregistered base models for non-admins (#26905)	2026-07-24 01:32:32 -05:00
images	refac	2026-07-01 02:48:29 -05:00
mcp	refac	2026-06-29 11:56:00 -05:00
telemetry	refac(telemetry): drop deprecated semconv SpanAttributes subclass (#25784)	2026-06-29 02:05:34 -05:00
actions.py	fix: enforce action availability and model access on the chat action route (#27243)	2026-07-23 12:23:05 -04:00
anthropic.py	refac	2026-07-23 04:16:14 -04:00
asgi_middleware.py	fix: report sub-second timings in the X-Process-Time header (#27368)	2026-07-23 18:09:23 -05:00
audit.py	refac	2026-07-23 22:52:23 -04:00
auth.py	perf: stop the audit middleware from re-running the whole auth pipeline (#27373)	2026-07-23 18:09:04 -05:00
automations.py	refac	2026-07-16 01:34:50 -04:00
calendar.py	feat: add repeat/recurrence dropdown to calendar event modal (#25865)	2026-06-29 02:16:19 -05:00
channels.py	refac	2026-03-17 17:58:01 -05:00
chat.py	perf: halve Redis round trips on model resolution and socket pools (#27225)	2026-07-23 21:32:01 -04:00
chat_fork.py	refac	2026-07-23 02:54:56 -04:00
chat_variables.py	refac	2026-07-24 01:44:30 -04:00
code_interpreter.py	refac: modernize type annotations (PEP 604 / PEP 585)	2026-05-12 17:10:15 +09:00
context_compaction.py	refac	2026-07-24 01:19:28 -04:00
embeddings.py	refac: modernize type annotations (PEP 604 / PEP 585)	2026-05-12 17:10:15 +09:00
files.py	refac	2026-07-23 21:29:33 -04:00
filter.py	refac	2026-07-23 12:48:14 -04:00
groups.py	refac: modernize type annotations (PEP 604 / PEP 585)	2026-05-12 17:10:15 +09:00
headers.py	feat: forward client User-Agent to model backends via {{USER_AGENT}} placeholder (#26333)	2026-06-29 05:58:19 -05:00
logger.py	chore: format	2026-06-01 13:56:55 -07:00
memory.py	refac	2026-07-01 03:35:46 -05:00
middleware.py	refac	2026-07-24 02:19:57 -04:00
misc.py	fix: malformed WEB_FETCH_FILTER_LIST entry blocking all web fetches (#26910)	2026-07-24 01:27:24 -05:00
models.py	fix: deny chained access to unregistered base models for non-admins (#26905)	2026-07-24 01:32:32 -05:00
notifications.py	refac	2026-07-16 01:37:21 -04:00
oauth.py	fix: migrate deprecated authlib.jose import to joserfc in oauth utils (#27310)	2026-07-23 21:54:59 -04:00
payload.py	refac	2026-07-24 01:44:30 -04:00
pdf_generator.py	refac: modernize type annotations (PEP 604 / PEP 585)	2026-05-12 17:10:15 +09:00
plugin.py	refac	2026-07-23 19:17:19 -04:00
rate_limit.py	refac: modernize type annotations (PEP 604 / PEP 585)	2026-05-12 17:10:15 +09:00
redis.py	refac	2026-07-23 22:36:03 -04:00
response.py	refac	2026-06-23 23:35:44 +02:00
sanitize.py	refac	2026-03-17 17:58:01 -05:00
security_headers.py	perf: stop recomputing static work in per-response ASGI middlewares (#27229)	2026-07-23 12:29:01 -04:00
session_pool.py	refac: modernize type annotations (PEP 604 / PEP 585)	2026-05-12 17:10:15 +09:00
subagents.py	chore: format	2026-07-20 22:11:42 -04:00
task.py	refac	2026-06-19 00:16:06 +02:00
terminals.py	refac	2026-07-10 18:32:21 -05:00
timers.py	chore: format	2026-07-20 22:11:42 -04:00
tools.py	refac	2026-07-16 00:58:34 -04:00
validate.py	chore: format	2026-06-01 13:56:55 -07:00
valves.py	refac	2026-06-29 12:29:10 -05:00
webhook.py	refac	2026-06-29 13:03:14 -05:00