Commit Graph

  • d342a5060c Añadir backend/open_webui/env.py main Aria 2026-06-30 17:19:21 +00:00
  • 437d0cf20f Eliminar backend/open_webui/env.py Aria 2026-06-30 17:17:33 +00:00
  • 0ffc04797f i18n: Update es-ES Spanish translations v0.9.6 (#25836) dev _00_ 2026-06-17 03:09:26 +02:00
  • b2809e6293 perf(ui): hoist marked.use() to module scope to prevent extension stacking (#25837) G30 2026-06-16 21:09:09 -04:00
  • beb9bf60e4 feat(memory): default user memory toggle to admin's global ENABLE_MEMORIES config (#25909) G30 2026-06-16 21:08:43 -04:00
  • 2f9b28a57d fix(ui): run initChatList API calls concurrently in Promise.all (#25838) G30 2026-06-16 21:08:02 -04:00
  • d501e3d6b5 Update milvus_multitenancy.py (#25857) Classic298 2026-06-17 03:07:27 +02:00
  • 819ad1d904 fix(chat): convert recursive findClosingDelimiter to iterative loop to prevent stack overflow (#25845) G30 2026-06-16 21:07:12 -04:00
  • 9fe3a00dba perf(chat): cache KaTeX rendered HTML in reactive statement to avoid redundant renders (#25847) G30 2026-06-16 21:06:56 -04:00
  • 4584adf900 feat(ui): add 'Unshare All Shared Chats' button to Shared Chats modal (#25848) G30 2026-06-16 21:06:41 -04:00
  • dfdb76cc46 fix(ui): prevent Code Editor drawer from collapsing when content is empty (#25855) G30 2026-06-16 21:06:15 -04:00
  • 17df026492 Confer object-derived file write only for files the object owner owns (#26032) Classic298 2026-06-17 03:05:57 +02:00
  • e038bab66d Authorize POST /api/v1/images/edit (enforce ENABLE_IMAGE_EDIT + image-gen permission) (#26009) Classic298 2026-06-17 03:05:41 +02:00
  • c39be0e2d6 Update milvus.py (#25858) Classic298 2026-06-17 03:05:27 +02:00
  • 6cd0ba0b6b implement date picker and additional columns for analytics (#25922) Taylor Wilsdon 2026-06-16 21:03:18 -04:00
  • e473ab1231 refac Timothy Jaeryang Baek 2026-06-17 03:01:11 +02:00
  • 4dbb2f94a6 refac Timothy Jaeryang Baek 2026-06-17 02:58:11 +02:00
  • dee07d8a30 feat(ui): show total archived chat count in ChatsModal title (#25872) G30 2026-06-16 20:57:27 -04:00
  • e031fadc35 perf: skip highlight.js auto-detection in read-only code blocks (#25824) Algorithm5838 2026-06-17 03:57:02 +03:00
  • b4aef82401 feat(ui): show total file count in FilesModal title (#25873) G30 2026-06-16 20:55:13 -04:00
  • 5cdcdbaeec refac Timothy Jaeryang Baek 2026-06-17 02:52:35 +02:00
  • e8d55c0a8b refac Timothy Jaeryang Baek 2026-06-17 02:36:20 +02:00
  • 57a5e43696 feat(permissions): add per-group features.user_webhooks permission (#25923) G30 2026-06-16 18:47:44 -04:00
  • 7b29834d42 refac Timothy Jaeryang Baek 2026-06-17 00:43:59 +02:00
  • 2b9b956dad fix(notes): sync pinned note state in sidebar and editor menu (#25918) G30 2026-06-16 18:42:20 -04:00
  • 25090dbf17 fix(chat): prevent false-positive unread indicators from title generation, pin/archive/folder actions, and new chat creation (#25912) G30 2026-06-16 18:41:44 -04:00
  • bb2663aad1 fix(ui): gate all chat export formats by chat.export permission (#25914) G30 2026-06-16 18:41:18 -04:00
  • 3571db34e2 fix(ui): enforce allow_users permission in share chat modal (#25915) G30 2026-06-16 18:40:57 -04:00
  • 7d1f941580 refac Timothy Jaeryang Baek 2026-06-17 00:40:04 +02:00
  • ed4cb358a0 refac Timothy Jaeryang Baek 2026-06-17 00:39:11 +02:00
  • caedcbae49 refac Timothy Jaeryang Baek 2026-06-17 00:36:34 +02:00
  • 9ccda6715c refac Timothy Jaeryang Baek 2026-06-17 00:35:08 +02:00
  • edf3ae9209 refac Timothy Jaeryang Baek 2026-06-17 00:33:30 +02:00
  • 0726db7217 fix(analytics): remove duplicate onMount causing double API requests on dashboard load (#25935) G30 2026-06-16 18:29:07 -04:00
  • 9c6c375dfe fix(images): add null guard for config in onMount to prevent crash on API failure (#25933) G30 2026-06-16 18:28:42 -04:00
  • 3e3c5b6d78 fix(permissions): add admin bypass to memories permission checks (#25924) G30 2026-06-16 18:28:17 -04:00
  • 2bc91e8f52 fix(ui): add missing skills permission to workspace menu visibility check (#25925) G30 2026-06-16 18:27:25 -04:00
  • e5ed45fb20 fix(ui): handle null chat in folder drop handler for cross-account drag (#25928) G30 2026-06-16 18:26:35 -04:00
  • 232421f40b refac Timothy Jaeryang Baek 2026-06-17 00:25:35 +02:00
  • 6b2d962cd6 feat(permissions): add reset to defaults button in permissions modals (#25931) G30 2026-06-16 18:25:20 -04:00
  • 7ee75a0c04 refac Timothy Jaeryang Baek 2026-06-17 00:17:48 +02:00
  • fc9c2ea191 refac Timothy Jaeryang Baek 2026-06-17 00:17:14 +02:00
  • 6f2e97aa58 fix(evaluations): prevent duplicate leaderboard API requests on navigation (#25934) G30 2026-06-16 18:16:27 -04:00
  • 5f3a628a8d Encode terminal ws session_id to block upstream user_id query injection (#26042) Classic298 2026-06-17 00:15:39 +02:00
  • 8b35ce924b refac Timothy Jaeryang Baek 2026-06-17 00:15:04 +02:00
  • 966b3fdb57 fix(ui): deduplicate layout-level API requests (#25942) G30 2026-06-16 18:09:50 -04:00
  • ee3a49a88d fix(ui): deduplicate store fetches with null-guards and mutex (#25943) G30 2026-06-16 18:07:11 -04:00
  • 22f2fe1ffb Require auth on ydoc:awareness:update and ydoc:document:leave handlers (CWE-306) (#25946) Classic298 2026-06-17 00:06:13 +02:00
  • 993e749121 refac Timothy Jaeryang Baek 2026-06-17 00:05:45 +02:00
  • 4c06b392da Don't let SCIM's active flag demote an admin (defense-in-depth) (#25948) Classic298 2026-06-16 23:59:55 +02:00
  • fbcdcf146b refac Timothy Jaeryang Baek 2026-06-16 23:59:24 +02:00
  • ec86ce5cf7 fix(oauth): use Protected Resource Metadata scopes in MCP DCR flow (#25958) Jamie Lin 2026-06-17 05:53:38 +08:00
  • 087878ce84 Match WEB_FETCH_FILTER_LIST on hostnames with label boundaries, not URL suffix (CWE-693) (#25949) Classic298 2026-06-16 23:53:08 +02:00
  • 4f69c33de0 refac Timothy Jaeryang Baek 2026-06-16 23:52:33 +02:00
  • c205d3a353 refac Timothy Jaeryang Baek 2026-06-16 23:48:01 +02:00
  • 4210cae68e refac Timothy Jaeryang Baek 2026-06-16 23:41:17 +02:00
  • de8ea08f5c Route user-supplied image-URL fetches through an SSRF-safe session (DNS rebinding, CWE-918) (#25960) Classic298 2026-06-16 23:36:53 +02:00
  • d07e4154fe fix: prevent model edit loss from access auto-save (#26004) Algorithm5838 2026-06-17 00:36:36 +03:00
  • bb1419328b refac Timothy Jaeryang Baek 2026-06-16 23:30:24 +02:00
  • 40c09167cd refac Timothy Jaeryang Baek 2026-06-16 23:24:27 +02:00
  • 56ae99e96a refac Timothy Jaeryang Baek 2026-06-16 23:02:20 +02:00
  • 1eecbc1ac2 fix(ui): collapse Code Execution settings when toggle is disabled (#25970) G30 2026-06-16 17:01:22 -04:00
  • 78a5015846 refac Timothy Jaeryang Baek 2026-06-16 23:00:31 +02:00
  • b93d560788 feat(ui): pre-select last model when adding a new model slot (#25974) G30 2026-06-16 16:56:56 -04:00
  • b7626f05fb Authorize KB write access before auto-linking an uploaded file (CWE-862/863) (#26001) Classic298 2026-06-16 22:56:24 +02:00
  • 1fc0e3ade7 fix: correct German date format token for dayjs in de-DE translation (#25985) Martin Gronek 2026-06-16 22:55:23 +02:00
  • 84e4110538 fix(auth): enforce chat.tts permission on OpenAI /audio/speech proxy endpoint (#25993) G30 2026-06-16 16:54:35 -04:00
  • 19a176fd36 refac Timothy Jaeryang Baek 2026-06-16 22:53:57 +02:00
  • bb66d435b7 fix(auth): enforce features.api_keys permission on GET and DELETE /api_key endpoints (#25992) G30 2026-06-16 16:48:44 -04:00
  • dc4924b66e Enforce per-model access on arena fallback before bypass_filter dispatch (#26046) Classic298 2026-06-16 22:45:42 +02:00
  • 920b655f46 Gate scheduled automations and fail closed on per-model access for non-user roles (#26047) Classic298 2026-06-16 22:45:27 +02:00
  • 05098d25a5 Fail closed when the proxy/redirect path decode cap is exceeded (#26050) Classic298 2026-06-16 22:44:11 +02:00
  • 3266a8c9eb refac Timothy Jaeryang Baek 2026-06-16 22:43:40 +02:00
  • ecdb6f353a Merge pull request #26060 from andrewbbaek/dev Andrew Baek 2026-06-16 15:35:25 -05:00
  • 084d040e22 refac Timothy Jaeryang Baek 2026-06-16 00:05:14 +02:00
  • 76854d1424 refac Timothy Jaeryang Baek 2026-06-15 23:53:52 +02:00
  • 45fcf272ef refac Timothy Jaeryang Baek 2026-06-15 23:42:29 +02:00
  • c783fd30f2 refac Timothy Jaeryang Baek 2026-06-15 23:37:38 +02:00
  • d65ac445a4 refac Timothy Jaeryang Baek 2026-06-15 23:34:24 +02:00
  • 38920c0ed1 refac Timothy Jaeryang Baek 2026-06-15 23:32:06 +02:00
  • 5019af79a0 refac Timothy Jaeryang Baek 2026-06-15 23:31:59 +02:00
  • f85cb27ef8 refac Timothy Jaeryang Baek 2026-06-13 02:13:51 +01:00
  • 4602abe5c6 refac Timothy Jaeryang Baek 2026-06-13 02:13:39 +01:00
  • b1d40f3409 refac Timothy Jaeryang Baek 2026-06-05 16:58:16 -04:00
  • 02dc3e689c Merge pull request #25590 from open-webui/dev Tim Baek 2026-06-01 19:10:46 -07:00
  • 1a97751e37 refac v0.9.6 Timothy Jaeryang Baek 2026-06-01 19:09:44 -07:00
  • b868da6bcd Merge pull request #25589 from open-webui/dev Tim Baek 2026-06-01 19:05:05 -07:00
  • dc4dab7a07 refac Timothy Jaeryang Baek 2026-06-01 19:01:14 -07:00
  • 90f4b4fcda Merge pull request #25524 from open-webui/dev Tim Baek 2026-06-01 15:01:27 -07:00
  • 4be25c4fdd refac Timothy Jaeryang Baek 2026-06-01 15:01:01 -07:00
  • b3e9d16b6f 0.9.6 (#25497) Tim Baek 2026-06-01 14:56:48 -07:00
  • de2360ac07 refac Timothy Jaeryang Baek 2026-06-01 14:38:54 -07:00
  • 8862210139 refac Timothy Jaeryang Baek 2026-06-01 14:38:49 -07:00
  • 5062f9958f refac Timothy Jaeryang Baek 2026-06-01 14:35:45 -07:00
  • eb629866fe chore: format Timothy Jaeryang Baek 2026-06-01 14:33:43 -07:00
  • 54149903f0 refac Timothy Jaeryang Baek 2026-06-01 14:23:27 -07:00
  • 02b2a391e9 fix: block private-IP webhook URLs to close SSRF on caller-controlled URL (#24587) Classic298 2026-06-01 23:15:51 +02:00
  • c73d9da773 i18n(fr-fr): update frensh translations (#24614) hungryBird 2026-06-01 23:15:38 +02:00
  • eb38389636 fix: delete Qdrant points by ID so memory deletions don't orphan vectors (#25495) Classic298 2026-06-01 23:13:46 +02:00
  • eebbc48f80 refac Timothy Jaeryang Baek 2026-06-01 14:13:28 -07:00