From 65fbbf5e35fb75450aa739fc8c3330a901b94a5e Mon Sep 17 00:00:00 2001 From: Classic298 <27028174+Classic298@users.noreply.github.com> Date: Tue, 3 Mar 2026 00:08:49 +0100 Subject: [PATCH] fix: grant file access for knowledge attached to shared workspace models (#22151) --- backend/open_webui/tools/builtin.py | 2 +- backend/open_webui/utils/access_control/files.py | 10 ++++++++++ 2 files changed, 11 insertions(+), 1 deletion(-) diff --git a/backend/open_webui/tools/builtin.py b/backend/open_webui/tools/builtin.py index a59df3813f..eec760fe01 100644 --- a/backend/open_webui/tools/builtin.py +++ b/backend/open_webui/tools/builtin.py @@ -1831,7 +1831,7 @@ async def query_knowledge_files( elif item_type == "file": # Individual file - use file-{id} as collection name file = Files.get_file_by_id(item_id) - if file and (user_role == "admin" or file.user_id == user_id): + if file: collection_names.append(f"file-{item_id}") elif item_type == "note": diff --git a/backend/open_webui/utils/access_control/files.py b/backend/open_webui/utils/access_control/files.py index 11c06f14ad..0be12b9d01 100644 --- a/backend/open_webui/utils/access_control/files.py +++ b/backend/open_webui/utils/access_control/files.py @@ -7,6 +7,7 @@ from open_webui.models.knowledge import Knowledges from open_webui.models.channels import Channels from open_webui.models.chats import Chats from open_webui.models.groups import Groups +from open_webui.models.models import Models from open_webui.models.access_grants import AccessGrants log = logging.getLogger(__name__) @@ -21,6 +22,7 @@ def has_access_to_file( """ Check if a user has the specified access to a file through any of: - Knowledge bases (ownership or access grants) + - Shared workspace models that attach the file directly - Channels the user is a member of - Shared chats @@ -72,4 +74,12 @@ def has_access_to_file( if chats: return True + # Check if the file is directly attached to a shared workspace model + for model in Models.get_models_by_user_id(user.id, permission=access_type, db=db): + knowledge_items = getattr(model.meta, "knowledge", None) or [] + for item in knowledge_items: + if isinstance(item, dict) and item.get("type") == "file" and item.get("id") == file.id: + return True + return False +