From 7d392bedc9c1aaecc94509a58e59186b614433dc Mon Sep 17 00:00:00 2001 From: Classic298 <27028174+Classic298@users.noreply.github.com> Date: Mon, 17 Aug 2026 08:24:49 +0200 Subject: [PATCH] refac: align the channel completion gate with the message update route (#28631) The gate now applies the same authorship condition the channel message update route already uses, so both paths agree on which messages a caller may modify. --- backend/open_webui/main.py | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/backend/open_webui/main.py b/backend/open_webui/main.py index e1978d7cfb..4b7622a833 100644 --- a/backend/open_webui/main.py +++ b/backend/open_webui/main.py @@ -1257,8 +1257,8 @@ async def chat_completion( if metadata.get('chat_id') and user: chat_id = metadata['chat_id'] - # Gate channel: branch — caller needs write access on the channel - # and the supplied message_id must belong to that channel. + # Gate channel: branch — caller needs write access on the channel, and the + # supplied message_id must belong to that channel and be the caller's own. if chat_id.startswith('channel:'): channel_id = chat_id.removeprefix('channel:') channel = await Channels.get_channel_by_id(channel_id) @@ -1290,7 +1290,11 @@ async def chat_completion( if not target_message_id: continue target_message = await Messages.get_message_by_id(target_message_id) - if target_message and target_message.channel_id != channel.id: + if target_message and ( + target_message.channel_id != channel.id + # Write access is not authorship — block cross-member edits. + or (user.role != 'admin' and target_message.user_id != user.id) + ): raise HTTPException( status_code=status.HTTP_403_FORBIDDEN, detail=ERROR_MESSAGES.DEFAULT(),