bhetherman/open-webui
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
17,363 Commits 2 Branches 168 Tags
4d27bfff92d5ae3bd2a8655aaa0f7aeca5bfd153
Commit Graph
1099 Commits
Author SHA1 Message Date
Timothy Jaeryang Baek 4d27bfff92 refac 2026-07-16 01:42:24 -04:00
Timothy Jaeryang Baek 92fbc77877 refac 2026-07-16 00:32:27 -04:00
Timothy Jaeryang Baek b23ddeb280 refac 2026-07-16 00:30:44 -04:00
Timothy Jaeryang Baek 1fe862b965 refac 2026-07-16 00:07:41 -04:00
Timothy Jaeryang Baek 07fafe081b refac 2026-07-15 23:34:45 -04:00
Timothy Jaeryang Baek f7af03ff26 refac 2026-07-15 22:48:41 -04:00
Timothy Jaeryang Baek 588f129695 refac 2026-07-15 22:45:00 -04:00
Timothy Jaeryang Baek 9e2536aa57 refac 2026-07-15 22:40:30 -04:00
Timothy Jaeryang Baek e65fdf1ca5 refac 2026-07-15 22:36:47 -04:00
Timothy Jaeryang Baek 185bca8552 refac 2026-07-15 22:34:52 -04:00
Timothy Jaeryang Baek 423cafd4e7 refac 2026-07-15 21:43:47 -04:00
Timothy Jaeryang Baek 9499587c33 refac 2026-07-15 04:25:51 -04:00
Timothy Jaeryang Baek 36cff229a9 refac 2026-07-15 03:17:32 -04:00
Timothy Jaeryang Baek 04311d559d refac 2026-07-15 02:53:39 -04:00
Timothy Jaeryang Baek 622767d724 refac 2026-07-15 02:49:46 -04:00
Timothy Jaeryang Baek e39ff71532 refac 2026-07-14 17:05:07 -04:00
Timothy Jaeryang Baek aedb6bef4e refac 2026-07-14 04:15:20 -04:00
Timothy Jaeryang Baek 04b146f2ce refac 2026-07-14 03:52:59 -04:00
Timothy Jaeryang Baek dbdacf2678 refac 2026-07-14 03:48:34 -04:00
Timothy Jaeryang Baek b012d683d8 refac 2026-07-14 01:40:58 -04:00
Timothy Jaeryang Baek 410ebb05d4 refac 2026-07-14 00:54:01 -04:00
Timothy Jaeryang Baek f1584b5a37 refac 2026-07-14 00:48:40 -04:00
Timothy Jaeryang Baek 797293c749 refac 2026-07-14 00:19:41 -04:00
Timothy Jaeryang Baek 7088d245bb refac 2026-07-14 00:10:28 -04:00
Timothy Jaeryang Baek af1c0eee89 refac 2026-06-30 20:20:15 -05:00
Timothy Jaeryang Baek 403392b41b chore: format 2026-06-29 13:35:39 -05:00
Timothy Jaeryang Baek c33fadc266 refac 2026-06-29 13:30:32 -05:00
Timothy Jaeryang Baek 0443ab3a61 refac 2026-06-29 13:30:28 -05:00
G30 964a098a4b fix(chat): use code block language tag to detect Vega-Lite specs for rendering (#25843) 2026-06-29 02:07:11 -05:00
Algorithm5838 62b153749a perf: skip re-sanitizing unchanged HTML tokens (#26325) 2026-06-29 00:43:54 -05:00
Timothy Jaeryang Baek c7be66626f refac 2026-06-28 22:53:47 -05:00
Algorithm5838 6729e64f30 perf: skip re-splitting unchanged text tokens (#26326) 2026-06-28 22:09:58 -05:00
G30 b2809e6293 perf(ui): hoist marked.use() to module scope to prevent extension stacking (#25837) 2026-06-17 03:09:09 +02:00
G30 9fe3a00dba perf(chat): cache KaTeX rendered HTML in reactive statement to avoid redundant renders (#25847) 2026-06-17 03:06:56 +02:00
Algorithm5838 e031fadc35 perf: skip highlight.js auto-detection in read-only code blocks (#25824) 2026-06-17 02:57:02 +02:00
Timothy Jaeryang Baek 6fce92aa12 chore: format 2026-06-01 13:56:55 -07:00
Timothy Jaeryang Baek e90a618f45 refac 2026-06-01 12:47:59 -07:00
G30 229e65b9f0 fix(ui): correct inverted high-contrast text colors for user message timestamp (#25461) 2026-06-01 09:26:18 -07:00
Timothy Jaeryang Baek c951b4f262 chore: format 2026-05-11 02:29:13 +09:00
Timothy Jaeryang Baek 4a1064cefd refac 2026-05-11 02:04:09 +09:00
Timothy Jaeryang Baek 3bba1c2270 feat: add IFRAME_CSP env var for srcdoc iframe content security policy 
Adds an IFRAME_CSP environment variable that injects a Content-Security-Policy
<meta> tag into all srcdoc iframes rendering untrusted content:
- Artifacts (LLM-generated HTML previews)
- FullHeightIframe (tool/embed output)
- FilePreview (user-uploaded HTML files)
- CitationModal (RAG document HTML)

Shared utility in src/lib/utils/csp.ts handles injection with HTML-safe
attribute escaping. URL-based iframes (src=) are correctly excluded.

Env-var only — no PersistentConfig, no admin UI, no DB. Set once at deploy
time, requires restart. Empty string (default) means no CSP restriction.
 2026-05-11 01:56:02 +09:00
Timothy Jaeryang Baek 3fcad2f627 refac 2026-05-09 08:28:29 +09:00
Classic298 cfd2888545 fix:image url validation and signout post (#24420) 
* refac(routers): reject external URLs in profile/model image handlers

* refac(ui): centralize image URL validation in safeImageUrl helper

* refac(auths): make signout POST-only

* refac: gate external profile image redirect behind ENABLE_PROFILE_IMAGE_URL_FORWARDING

Restore the 302 redirect for external http(s) profile image URLs in
the user and model profile-image endpoints, but gate it behind a new
ENABLE_PROFILE_IMAGE_URL_FORWARDING env flag (default: True).

Existing deployments that rely on external profile image forwarding
continue to work unchanged.  Operators who want to suppress the
redirect (to prevent client-side IP/UA/Referer leaks) can set the
flag to False.
 2026-05-09 07:33:31 +09:00
Timothy Jaeryang Baek e1dce99147 refac 2026-05-09 07:13:36 +09:00
Timothy Jaeryang Baek 29f6c72e87 refac 2026-05-09 06:44:42 +09:00
Timothy Jaeryang Baek 064fdecb67 refac 2026-05-09 05:29:15 +09:00
Timothy Jaeryang Baek 7eeff2fdf9 refac 2026-05-09 05:09:20 +09:00
Timothy Jaeryang Baek 23ff9943a9 refac 2026-05-09 04:44:20 +09:00
Timothy Jaeryang Baek 8ff7ff459b chore: format 2026-04-24 18:48:21 +09:00
Timothy Jaeryang Baek 3d1e355df7 refac 2026-04-24 18:20:10 +09:00