open-webui

mirror of https://github.com/open-webui/open-webui.git synced 2026-08-13 01:02:25 -06:00

Files

T

Classic298 6d4c02a89e refac: owner-bind ephemeral web-search RAG collections (#26706 )

The web-search-* namespace was the one collection namespace filter_accessible_collections admitted unconditionally for any non-admin user, on both read and write, unlike file-*, user-memory-* and knowledge bases which are owner-scoped. process_web_search now mints these ephemeral per-query collections as web-search-{user.id}-<hash>, and the access helper only admits web-search-{requester.id}-* names, so a web-search collection is readable and writable only by the user who created it (admins keep their bypass). The collections hold transient public web-search results and their names are non-enumerable query hashes, so there was no demonstrated cross-user access path; this removes the namespace exception so the per-user scoping the other namespaces enforce also covers web-search.

Co-authored-by: rexpository <rexpository@users.noreply.github.com>

2026-07-27 02:08:04 -04:00

data

refac: mv backend files to /open_webui dir

2024-09-04 16:54:48 +02:00

open_webui

refac: owner-bind ephemeral web-search RAG collections (#26706 )

2026-07-27 02:08:04 -04:00

.dockerignore

fix: litellm config issue

2024-02-24 22:35:11 -08:00

.gitignore

refac