open-webui

Files

T

Classic298andkikayli d3737176bc fix: require write permission for pin_channel_message on standard channels (#24521 )

`pin_channel_message` (channels.py:1242) checked `permission='read'` on
the standard-channel branch before mutating `is_pinned` / `pinned_by` /
`pinned_at` via `Messages.update_is_pinned_by_id`. Pin/unpin is a write
operation; gating it on read access let any user with read-only channel
access pin or unpin any message in the channel, including admin posts.

One-character fix: change `permission='read'` to `permission='write'`.

Reported by kikayli in GHSA-5gc6-xhv4-2wg6.

Co-authored-by: kikayli <kikayli@users.noreply.github.com>

2026-05-11 00:59:50 +09:00

data

refac: mv backend files to /open_webui dir

2024-09-04 16:54:48 +02:00

open_webui

fix: require write permission for pin_channel_message on standard channels (#24521 )

2026-05-11 00:59:50 +09:00

.dockerignore

fix: litellm config issue

2024-02-24 22:35:11 -08:00

.gitignore

refac