From b898fc0258ee57b657899fd8f12b370afe9d9f65 Mon Sep 17 00:00:00 2001
From: Timothy Jaeryang Baek <tim@openwebui.com>
Date: Wed, 1 Apr 2026 05:33:41 -0500
Subject: [PATCH] fix: gravatar profile image

---
 backend/open_webui/utils/validate.py | 9 +++++++++
 src/lib/apis/auths/index.ts          | 3 +++
 src/lib/apis/utils/index.ts          | 6 +++++-
 3 files changed, 17 insertions(+), 1 deletion(-)

diff --git a/backend/open_webui/utils/validate.py b/backend/open_webui/utils/validate.py
index c2064de25..5686f20ec 100644
--- a/backend/open_webui/utils/validate.py
+++ b/backend/open_webui/utils/validate.py
@@ -6,6 +6,11 @@ _ALLOWED_STATIC_PATHS = (
     '/static/favicon.png',
 )
 
+# External URL prefixes that are explicitly trusted for profile images
+_ALLOWED_URL_PREFIXES = (
+    'https://www.gravatar.com/avatar/',
+)
+
 
 def validate_profile_image_url(url: str) -> str:
     """
@@ -15,6 +20,7 @@ def validate_profile_image_url(url: str) -> str:
     - Empty string (falls back to default avatar)
     - data:image/* URIs (base64-encoded uploads from the frontend)
     - Known static asset paths (/user.png, /static/favicon.png)
+    - Trusted external URLs (e.g. Gravatar)
 
     Returns the url unchanged if valid, raises ValueError otherwise.
     """
@@ -33,4 +39,7 @@ def validate_profile_image_url(url: str) -> str:
     if url in _ALLOWED_STATIC_PATHS:
         return url
 
+    if any(url.startswith(prefix) for prefix in _ALLOWED_URL_PREFIXES):
+        return url
+
     raise ValueError('Invalid profile image URL: only data URIs and default avatars are allowed.')
diff --git a/src/lib/apis/auths/index.ts b/src/lib/apis/auths/index.ts
index 1fd22494b..f8e953f7c 100644
--- a/src/lib/apis/auths/index.ts
+++ b/src/lib/apis/auths/index.ts
@@ -413,6 +413,9 @@ export const updateUserProfile = async (token: string, profile: object) => {
 		.catch((err) => {
 			console.error(err);
 			error = err.detail;
+			if (Array.isArray(error)) {
+				error = error.map((e: { msg?: string }) => e.msg).join("; ");
+			}
 			return null;
 		});
 
diff --git a/src/lib/apis/utils/index.ts b/src/lib/apis/utils/index.ts
index d19f10f94..e5fea091e 100644
--- a/src/lib/apis/utils/index.ts
+++ b/src/lib/apis/utils/index.ts
@@ -16,10 +16,14 @@ export const getGravatarUrl = async (token: string, email: string) => {
 		})
 		.catch((err) => {
 			console.error(err);
-			error = err;
+			error = err.detail ?? err;
 			return null;
 		});
 
+	if (error) {
+		throw error;
+	}
+
 	return res;
 };