fix:image url validation and signout post (#24420)

* refac(routers): reject external URLs in profile/model image handlers

* refac(ui): centralize image URL validation in safeImageUrl helper

* refac(auths): make signout POST-only

* refac: gate external profile image redirect behind ENABLE_PROFILE_IMAGE_URL_FORWARDING

Restore the 302 redirect for external http(s) profile image URLs in
the user and model profile-image endpoints, but gate it behind a new
ENABLE_PROFILE_IMAGE_URL_FORWARDING env flag (default: True).

Existing deployments that rely on external profile image forwarding
continue to work unchanged.  Operators who want to suppress the
redirect (to prevent client-side IP/UA/Referer leaks) can set the
flag to False.

backend/open_webui/routers/users.py

@@ -29,7 +29,7 @@ from open_webui.models.users import (
 )
 
 from open_webui.constants import ERROR_MESSAGES
-from open_webui.env import STATIC_DIR
+from open_webui.env import ENABLE_PROFILE_IMAGE_URL_FORWARDING, STATIC_DIR
 from open_webui.internal.db import get_async_session
 
 
@@ -478,12 +478,15 @@ async def get_user_profile_image_by_id(user_id: str, user=Depends(get_verified_u
     user = await Users.get_user_by_id(user_id)
     if user:
         if user.profile_image_url:
-            # check if it's url or base64
             if user.profile_image_url.startswith('http'):
-                return Response(
-                    status_code=status.HTTP_302_FOUND,
-                    headers={'Location': user.profile_image_url},
-                )
+                if ENABLE_PROFILE_IMAGE_URL_FORWARDING:
+                    return Response(
+                        status_code=status.HTTP_302_FOUND,
+                        headers={'Location': user.profile_image_url},
+                    )
+                # When forwarding is disabled, fall through to the
+                # default image to prevent client-side IP/UA/Referer
+                # leaks via 302 redirect to external origins.
             elif user.profile_image_url.startswith('data:image'):
                 try:
                     header, base64_data = user.profile_image_url.split(',', 1)