From e98730b20d7df8c4384434b92960a37da89f2412 Mon Sep 17 00:00:00 2001 From: Classic298 <27028174+Classic298@users.noreply.github.com> Date: Mon, 29 Jun 2026 10:34:55 +0200 Subject: [PATCH] fix: pass web search results to model when embedding & retrieval enabled (#25600) Web search results stored as a vector collection were silently dropped before retrieval when BYPASS_RETRIEVAL_ACCESS_CONTROL is False (the default). The server-generated web_search file item carries a 'collection_name' but its 'web_search' type is not matched by any explicit dispatch branch in get_sources_from_items, so it fell through to the untrusted client-supplied collection_name branch and was ignored. Add an explicit branch for type == 'web_search' items so the collection is queried again. Access control is preserved: the collection still passes through filter_accessible_collections, which already allowlists web-search-* and bypasses only for admins. Regression introduced when the retrieval access-control hardening gated the bare collection_name fallback behind BYPASS_RETRIEVAL_ACCESS_CONTROL. --- backend/open_webui/retrieval/utils.py | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/backend/open_webui/retrieval/utils.py b/backend/open_webui/retrieval/utils.py index 5ba010c445..f72625f721 100644 --- a/backend/open_webui/retrieval/utils.py +++ b/backend/open_webui/retrieval/utils.py @@ -1548,6 +1548,10 @@ async def get_sources_from_items( 'documents': [[doc.get('content') for doc in item.get('docs')]], 'metadatas': [[doc.get('metadata') for doc in item.get('docs')]], } + elif item.get('type') == 'web_search' and item.get('collection_name'): + # Trusted server-generated collection; authorized by + # filter_accessible_collections below (allowlists web-search-*). + collection_names.append(item['collection_name']) elif item.get('collection_name'): if BYPASS_RETRIEVAL_ACCESS_CONTROL: collection_names.append(item['collection_name'])