Emil_Shanaty/open-webui-ai4me
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: respect BYPASS_ADMIN_ACCESS_CONTROL in file list/search endpoints (#21595)

Browse Source
This commit is contained in:
Classic298
2026-02-19 16:36:48 -06:00
committed by GitHub
parent 43eb2351d2
commit c5c31ab769
1 changed files with 4 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/open_webui/routers/files.py
+4 -3
View File
@@ -47,6 +47,7 @@ from open_webui.routers.audio import transcribe
from open_webui.storage.provider import Storage from open_webui.storage.provider import Storage
from open_webui.config import BYPASS_ADMIN_ACCESS_CONTROL
from open_webui.utils.auth import get_admin_user, get_verified_user from open_webui.utils.auth import get_admin_user, get_verified_user
from open_webui.utils.misc import strict_match_mime_type from open_webui.utils.misc import strict_match_mime_type
from pydantic import BaseModel from pydantic import BaseModel
@@ -362,7 +363,7 @@ async def list_files(
content: bool = Query(True), content: bool = Query(True),
db: Session = Depends(get_session), db: Session = Depends(get_session),
): ):
if user.role == "admin": if user.role == "admin" and BYPASS_ADMIN_ACCESS_CONTROL:
files = Files.get_files(db=db) files = Files.get_files(db=db)
else: else:
files = Files.get_files_by_user_id(user.id, db=db) files = Files.get_files_by_user_id(user.id, db=db)
@@ -398,8 +399,8 @@ async def search_files(
Search for files by filename with support for wildcard patterns. Search for files by filename with support for wildcard patterns.
Uses SQL-based filtering with pagination for better performance. Uses SQL-based filtering with pagination for better performance.
""" """
# Determine user_id: null for admin (search all), user.id for regular users # Determine user_id: null for admin with bypass (search all), user.id otherwise
user_id = None if user.role == "admin" else user.id user_id = None if (user.role == "admin" and BYPASS_ADMIN_ACCESS_CONTROL) else user.id
# Use optimized database query with pagination # Use optimized database query with pagination
files = Files.search_files( files = Files.search_files(