From c83a42198d2a517f473f91536efa7344fa06163e Mon Sep 17 00:00:00 2001 From: Timothy Jaeryang Baek Date: Sun, 1 Mar 2026 13:37:31 -0600 Subject: [PATCH] refac --- backend/open_webui/routers/retrieval.py | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/backend/open_webui/routers/retrieval.py b/backend/open_webui/routers/retrieval.py index 44b570ff6..4c27ffea4 100644 --- a/backend/open_webui/routers/retrieval.py +++ b/backend/open_webui/routers/retrieval.py @@ -2757,6 +2757,27 @@ async def process_files_batch( for file in form_data.files: try: + # Ownership check: verify the requesting user owns the file or is an admin + db_file = Files.get_file_by_id(file.id) + if not db_file: + file_errors.append( + BatchProcessFilesResult( + file_id=file.id, + status="failed", + error="File not found", + ) + ) + continue + if db_file.user_id != user.id and user.role != "admin": + file_errors.append( + BatchProcessFilesResult( + file_id=file.id, + status="failed", + error="Permission denied: not file owner", + ) + ) + continue + text_content = file.data.get("content", "") docs: List[Document] = [ Document(