From fcff9c3afd170965693d2f44ab6f5990d74a687b Mon Sep 17 00:00:00 2001
From: Timothy Jaeryang Baek <tim@openwebui.com>
Date: Sun, 1 Mar 2026 13:20:55 -0600
Subject: [PATCH] refac

---
 backend/open_webui/models/knowledge.py  | 15 +++++++++++++++
 backend/open_webui/routers/knowledge.py | 14 ++++++++++++++
 2 files changed, 29 insertions(+)

diff --git a/backend/open_webui/models/knowledge.py b/backend/open_webui/models/knowledge.py
index 4e5e208d8..4212cf0fd 100644
--- a/backend/open_webui/models/knowledge.py
+++ b/backend/open_webui/models/knowledge.py
@@ -613,6 +613,21 @@ class KnowledgeTable:
             except Exception:
                 return None
 
+    def has_file(
+        self, knowledge_id: str, file_id: str, db: Optional[Session] = None
+    ) -> bool:
+        """Check whether a file belongs to a knowledge base."""
+        try:
+            with get_db_context(db) as db:
+                return (
+                    db.query(KnowledgeFile)
+                    .filter_by(knowledge_id=knowledge_id, file_id=file_id)
+                    .first()
+                    is not None
+                )
+        except Exception:
+            return False
+
     def remove_file_from_knowledge_by_id(
         self, knowledge_id: str, file_id: str, db: Optional[Session] = None
     ) -> bool:
diff --git a/backend/open_webui/routers/knowledge.py b/backend/open_webui/routers/knowledge.py
index 0d4770560..8bc58b437 100644
--- a/backend/open_webui/routers/knowledge.py
+++ b/backend/open_webui/routers/knowledge.py
@@ -745,6 +745,13 @@ def update_file_from_knowledge_by_id(
             detail=ERROR_MESSAGES.NOT_FOUND,
         )
 
+    # Validate the file actually belongs to this knowledge base
+    if not Knowledges.has_file(knowledge_id=id, file_id=form_data.file_id, db=db):
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail=ERROR_MESSAGES.NOT_FOUND,
+        )
+
     # Remove content from the vector database
     VECTOR_DB_CLIENT.delete(
         collection_name=knowledge.id, filter={"file_id": form_data.file_id}
@@ -819,6 +826,13 @@ def remove_file_from_knowledge_by_id(
             detail=ERROR_MESSAGES.NOT_FOUND,
         )
 
+    # Validate the file actually belongs to this knowledge base
+    if not Knowledges.has_file(knowledge_id=id, file_id=form_data.file_id, db=db):
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail=ERROR_MESSAGES.NOT_FOUND,
+        )
+
     Knowledges.remove_file_from_knowledge_by_id(
         knowledge_id=id, file_id=form_data.file_id, db=db
     )