fix: gravatar profile image

backend/open_webui/utils/validate.py

@@ -6,6 +6,11 @@ _ALLOWED_STATIC_PATHS = (
     '/static/favicon.png',
 )
 
+# External URL prefixes that are explicitly trusted for profile images
+_ALLOWED_URL_PREFIXES = (
+    'https://www.gravatar.com/avatar/',
+)
+
 
 def validate_profile_image_url(url: str) -> str:
     """
@@ -15,6 +20,7 @@ def validate_profile_image_url(url: str) -> str:
     - Empty string (falls back to default avatar)
     - data:image/* URIs (base64-encoded uploads from the frontend)
     - Known static asset paths (/user.png, /static/favicon.png)
+    - Trusted external URLs (e.g. Gravatar)
 
     Returns the url unchanged if valid, raises ValueError otherwise.
     """
@@ -33,4 +39,7 @@ def validate_profile_image_url(url: str) -> str:
     if url in _ALLOWED_STATIC_PATHS:
         return url
 
+    if any(url.startswith(prefix) for prefix in _ALLOWED_URL_PREFIXES):
+        return url
+
     raise ValueError('Invalid profile image URL: only data URIs and default avatars are allowed.')

src/lib/apis/auths/index.ts

@@ -413,6 +413,9 @@ export const updateUserProfile = async (token: string, profile: object) => {
 		.catch((err) => {
 			console.error(err);
 			error = err.detail;
+			if (Array.isArray(error)) {
+				error = error.map((e: { msg?: string }) => e.msg).join("; ");
+			}
 			return null;
 		});
 

src/lib/apis/utils/index.ts

@@ -16,10 +16,14 @@ export const getGravatarUrl = async (token: string, email: string) => {
 		})
 		.catch((err) => {
 			console.error(err);
-			error = err;
+			error = err.detail ?? err;
 			return null;
 		});
 
+	if (error) {
+		throw error;
+	}
+
 	return res;
 };