Files
open-webui/backend
Classic298 897d69a35c fix: enforce feature permissions on the legacy chat-features block (image_generation, web_search) (#26703)
The legacy features block in process_chat_payload honoured client-supplied features.image_generation and features.web_search flags and dispatched to the image generation/edit provider and the web-search provider without re-checking the per-user permission that the direct /images routes and the native function-calling path enforce. A user denied features.image_generation or features.web_search could still trigger billable server-side image generation or web search via POST /api/chat/completions with params.function_calling set to legacy. Gate both branches on admin-or-has_permission before invoking chat_image_generation_handler / chat_web_search_handler, matching the existing code_interpreter gate, so a forged flag from an unpermitted user is ignored. Normal completions and permitted users are unaffected.
2026-07-27 01:54:00 -04:00
..
2024-02-24 22:35:11 -08:00
2024-09-06 04:59:20 +02:00
2026-03-24 19:43:30 -05:00
2026-07-26 23:03:32 -04:00
2026-06-17 03:01:11 +02:00
2026-06-17 03:01:11 +02:00