Classic298andClaude Opus 4.7 f5f4b58958 fix: harden model profile image against SVG stored XSS (#25060) ...

ModelMeta.profile_image_url now runs validate_profile_image_url, rejecting SVG/script data URIs (matching UserUpdateForm and ChannelWebhookForm). The /model/profile/image endpoint enforces the PROFILE_IMAGE_ALLOWED_MIME_TYPES allowlist and sets X-Content-Type-Options: nosniff, so an SVG data URI can no longer be served inline on-origin. Closes the fourth profile-image XSS sink missed by the user and webhook fixes.

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

2026-05-28 17:41:55 -05:00

..

data

refac: mv backend files to /open_webui dir

2024-09-04 16:54:48 +02:00

open_webui

fix: harden model profile image against SVG stored XSS (#25060)

2026-05-28 17:41:55 -05:00

.dockerignore

fix: litellm config issue

2024-02-24 22:35:11 -08:00

.gitignore

refac

2024-09-06 04:59:20 +02:00

dev.sh

refac

2026-03-24 19:43:30 -05:00

requirements-min.txt

refac

2026-04-24 18:20:10 +09:00

requirements.txt

refactor(firecrawl): use v2 API directly (#23934)

2026-04-24 18:32:08 +09:00

start_windows.bat

refac

2026-04-24 15:40:02 +09:00

start.sh

fix: default optional env vars used with bash ,, in start.sh (#24683)

2026-05-15 09:29:25 +09:00