refac

backend/open_webui/config.py

@@ -1024,7 +1024,15 @@ RAG_OLLAMA_BASE_URL = os.getenv('RAG_OLLAMA_BASE_URL', OLLAMA_BASE_URL)
 RAG_OLLAMA_API_KEY = os.getenv('RAG_OLLAMA_API_KEY', '')
 
 
-ENABLE_RAG_LOCAL_WEB_FETCH = os.getenv('ENABLE_RAG_LOCAL_WEB_FETCH', 'False').lower() == 'true'
+ENABLE_LOCAL_WEB_FETCH = (
+    os.getenv(
+        'ENABLE_LOCAL_WEB_FETCH',
+        os.getenv('ENABLE_RAG_LOCAL_WEB_FETCH', 'False'),
+    ).lower()
+    == 'true'
+)
+# Deprecated compatibility alias; use ENABLE_LOCAL_WEB_FETCH for new deployments.
+ENABLE_RAG_LOCAL_WEB_FETCH = ENABLE_LOCAL_WEB_FETCH
 
 
 DEFAULT_WEB_FETCH_FILTER_LIST = [

backend/open_webui/retrieval/web/utils.py

@@ -30,7 +30,7 @@ from langchain_community.document_loaders import PlaywrightURLLoader, WebBaseLoa
 from langchain_community.document_loaders.base import BaseLoader
 from langchain_core.documents import Document
 from open_webui.config import (
-    ENABLE_RAG_LOCAL_WEB_FETCH,
+    ENABLE_LOCAL_WEB_FETCH,
     EXTERNAL_WEB_LOADER_API_KEY,
     EXTERNAL_WEB_LOADER_URL,
     FIRECRAWL_API_BASE_URL,
@@ -98,8 +98,8 @@ def validate_url(url: Union[str, Sequence[str]]):
                 log.warning(f'URL blocked by filter list: {url}')
                 raise ValueError(ERROR_MESSAGES.INVALID_URL)
 
-        if not ENABLE_RAG_LOCAL_WEB_FETCH:
-            # Local web fetch is disabled, filter out any URLs that resolve to private IP addresses
+        if not ENABLE_LOCAL_WEB_FETCH:
+            # Local web fetch is disabled, filter out URLs that resolve to non-global IP addresses.
             parsed_url = urllib.parse.urlparse(url)
             # Get IPv4 and IPv6 addresses
             ipv4_addresses, ipv6_addresses = resolve_hostname(parsed_url.hostname)
@@ -140,7 +140,7 @@ def _ssrf_safe_new_conn(self):
     infos = socket.getaddrinfo(host, port, 0, socket.SOCK_STREAM)
     if not infos:
         raise OSError(f'getaddrinfo for {host!r} returned empty list')
-    if not ENABLE_RAG_LOCAL_WEB_FETCH:
+    if not ENABLE_LOCAL_WEB_FETCH:
         for _, _, _, _, sa in infos:
             if not ipaddress.ip_address(sa[0]).is_global:
                 raise ValueError(ERROR_MESSAGES.INVALID_URL)
@@ -196,7 +196,7 @@ class _SSRFSafeResolver(aiohttp.resolver.DefaultResolver):
 
     async def resolve(self, host, port=0, family=socket.AF_INET):
         results = await super().resolve(host, port, family)
-        if not ENABLE_RAG_LOCAL_WEB_FETCH:
+        if not ENABLE_LOCAL_WEB_FETCH:
             for entry in results:
                 if not ipaddress.ip_address(entry['host']).is_global:
                     raise ValueError(ERROR_MESSAGES.INVALID_URL)

backend/open_webui/routers/images.py

@@ -428,7 +428,7 @@ async def get_image_data(data: str, headers=None, trusted_base_url: str | None =
             # ComfyUI on a private network), skip SSRF validation only when
             # the URL shares the exact same origin (scheme + host + port)
             # as the admin-configured base.  This avoids both the global
-            # ENABLE_RAG_LOCAL_WEB_FETCH hammer and a blanket trust flag
+            # ENABLE_LOCAL_WEB_FETCH hammer and a blanket trust flag
             # that would follow arbitrary redirects.
             if trusted_base_url and _is_same_origin(data, trusted_base_url):
                 log.debug(f'Skipping URL validation for trusted backend: {data}')