refac

backend/open_webui/models/knowledge.py

@@ -613,6 +613,21 @@ class KnowledgeTable:
             except Exception:
                 return None
 
+    def has_file(
+        self, knowledge_id: str, file_id: str, db: Optional[Session] = None
+    ) -> bool:
+        """Check whether a file belongs to a knowledge base."""
+        try:
+            with get_db_context(db) as db:
+                return (
+                    db.query(KnowledgeFile)
+                    .filter_by(knowledge_id=knowledge_id, file_id=file_id)
+                    .first()
+                    is not None
+                )
+        except Exception:
+            return False
+
     def remove_file_from_knowledge_by_id(
         self, knowledge_id: str, file_id: str, db: Optional[Session] = None
     ) -> bool:

backend/open_webui/routers/knowledge.py

@@ -745,6 +745,13 @@ def update_file_from_knowledge_by_id(
             detail=ERROR_MESSAGES.NOT_FOUND,
         )
 
+    # Validate the file actually belongs to this knowledge base
+    if not Knowledges.has_file(knowledge_id=id, file_id=form_data.file_id, db=db):
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail=ERROR_MESSAGES.NOT_FOUND,
+        )
+
     # Remove content from the vector database
     VECTOR_DB_CLIENT.delete(
         collection_name=knowledge.id, filter={"file_id": form_data.file_id}
@@ -819,6 +826,13 @@ def remove_file_from_knowledge_by_id(
             detail=ERROR_MESSAGES.NOT_FOUND,
         )
 
+    # Validate the file actually belongs to this knowledge base
+    if not Knowledges.has_file(knowledge_id=id, file_id=form_data.file_id, db=db):
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail=ERROR_MESSAGES.NOT_FOUND,
+        )
+
     Knowledges.remove_file_from_knowledge_by_id(
         knowledge_id=id, file_id=form_data.file_id, db=db
     )