bhetherman/open-webui
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(permissions): add admin bypass to memories permission checks (#25924)

Browse Source
This commit is contained in:
G30
2026-06-17 00:28:17 +02:00
committed by GitHub
parent 2bc91e8f52
commit 3e3c5b6d78
1 changed files with 7 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/open_webui/routers/memories.py
+7 -7
View File
@@ -39,7 +39,7 @@ async def get_memories(
detail=ERROR_MESSAGES.NOT_FOUND,
)
if not await has_permission(user.id, 'features.memories', request.app.state.config.USER_PERMISSIONS):
if user.role != 'admin' and not await has_permission(user.id, 'features.memories', request.app.state.config.USER_PERMISSIONS):
raise HTTPException(
status_code=status.HTTP_403_FORBIDDEN,
detail=ERROR_MESSAGES.ACCESS_PROHIBITED,
@@ -79,7 +79,7 @@ async def add_memory(
detail=ERROR_MESSAGES.NOT_FOUND,
)
if not await has_permission(user.id, 'features.memories', request.app.state.config.USER_PERMISSIONS):
if user.role != 'admin' and not await has_permission(user.id, 'features.memories', request.app.state.config.USER_PERMISSIONS):
raise HTTPException(
status_code=status.HTTP_403_FORBIDDEN,
detail=ERROR_MESSAGES.ACCESS_PROHIBITED,
@@ -130,7 +130,7 @@ async def query_memory(
detail=ERROR_MESSAGES.NOT_FOUND,
)
if not await has_permission(user.id, 'features.memories', request.app.state.config.USER_PERMISSIONS):
if user.role != 'admin' and not await has_permission(user.id, 'features.memories', request.app.state.config.USER_PERMISSIONS):
raise HTTPException(
status_code=status.HTTP_403_FORBIDDEN,
detail=ERROR_MESSAGES.ACCESS_PROHIBITED,
@@ -205,7 +205,7 @@ async def reset_memory_from_vector_db(
detail=ERROR_MESSAGES.NOT_FOUND,
)
if not await has_permission(user.id, 'features.memories', request.app.state.config.USER_PERMISSIONS):
if user.role != 'admin' and not await has_permission(user.id, 'features.memories', request.app.state.config.USER_PERMISSIONS):
raise HTTPException(
status_code=status.HTTP_403_FORBIDDEN,
detail=ERROR_MESSAGES.ACCESS_PROHIBITED,
@@ -256,7 +256,7 @@ async def delete_memory_by_user_id(
detail=ERROR_MESSAGES.NOT_FOUND,
)
if not await has_permission(user.id, 'features.memories', request.app.state.config.USER_PERMISSIONS):
if user.role != 'admin' and not await has_permission(user.id, 'features.memories', request.app.state.config.USER_PERMISSIONS):
raise HTTPException(
status_code=status.HTTP_403_FORBIDDEN,
detail=ERROR_MESSAGES.ACCESS_PROHIBITED,
@@ -296,7 +296,7 @@ async def update_memory_by_id(
detail=ERROR_MESSAGES.NOT_FOUND,
)
if not await has_permission(user.id, 'features.memories', request.app.state.config.USER_PERMISSIONS):
if user.role != 'admin' and not await has_permission(user.id, 'features.memories', request.app.state.config.USER_PERMISSIONS):
raise HTTPException(
status_code=status.HTTP_403_FORBIDDEN,
detail=ERROR_MESSAGES.ACCESS_PROHIBITED,
@@ -345,7 +345,7 @@ async def delete_memory_by_id(
detail=ERROR_MESSAGES.NOT_FOUND,
)
if not await has_permission(user.id, 'features.memories', request.app.state.config.USER_PERMISSIONS):
if user.role != 'admin' and not await has_permission(user.id, 'features.memories', request.app.state.config.USER_PERMISSIONS):
raise HTTPException(
status_code=status.HTTP_403_FORBIDDEN,
detail=ERROR_MESSAGES.ACCESS_PROHIBITED,