From e3ba6984534898695b47ee4fc3d6b746e2865abc Mon Sep 17 00:00:00 2001 From: Timothy Jaeryang Baek Date: Thu, 25 Jun 2026 17:34:41 -0400 Subject: [PATCH] refac --- backend/open_webui/config.py | 10 +++++++++- backend/open_webui/retrieval/web/utils.py | 10 +++++----- backend/open_webui/routers/images.py | 2 +- 3 files changed, 15 insertions(+), 7 deletions(-) diff --git a/backend/open_webui/config.py b/backend/open_webui/config.py index 7a1b219a70..d736489a80 100644 --- a/backend/open_webui/config.py +++ b/backend/open_webui/config.py @@ -1024,7 +1024,15 @@ RAG_OLLAMA_BASE_URL = os.getenv('RAG_OLLAMA_BASE_URL', OLLAMA_BASE_URL) RAG_OLLAMA_API_KEY = os.getenv('RAG_OLLAMA_API_KEY', '') -ENABLE_RAG_LOCAL_WEB_FETCH = os.getenv('ENABLE_RAG_LOCAL_WEB_FETCH', 'False').lower() == 'true' +ENABLE_LOCAL_WEB_FETCH = ( + os.getenv( + 'ENABLE_LOCAL_WEB_FETCH', + os.getenv('ENABLE_RAG_LOCAL_WEB_FETCH', 'False'), + ).lower() + == 'true' +) +# Deprecated compatibility alias; use ENABLE_LOCAL_WEB_FETCH for new deployments. +ENABLE_RAG_LOCAL_WEB_FETCH = ENABLE_LOCAL_WEB_FETCH DEFAULT_WEB_FETCH_FILTER_LIST = [ diff --git a/backend/open_webui/retrieval/web/utils.py b/backend/open_webui/retrieval/web/utils.py index eed8156023..327d7e2738 100644 --- a/backend/open_webui/retrieval/web/utils.py +++ b/backend/open_webui/retrieval/web/utils.py @@ -30,7 +30,7 @@ from langchain_community.document_loaders import PlaywrightURLLoader, WebBaseLoa from langchain_community.document_loaders.base import BaseLoader from langchain_core.documents import Document from open_webui.config import ( - ENABLE_RAG_LOCAL_WEB_FETCH, + ENABLE_LOCAL_WEB_FETCH, EXTERNAL_WEB_LOADER_API_KEY, EXTERNAL_WEB_LOADER_URL, FIRECRAWL_API_BASE_URL, @@ -98,8 +98,8 @@ def validate_url(url: Union[str, Sequence[str]]): log.warning(f'URL blocked by filter list: {url}') raise ValueError(ERROR_MESSAGES.INVALID_URL) - if not ENABLE_RAG_LOCAL_WEB_FETCH: - # Local web fetch is disabled, filter out any URLs that resolve to private IP addresses + if not ENABLE_LOCAL_WEB_FETCH: + # Local web fetch is disabled, filter out URLs that resolve to non-global IP addresses. parsed_url = urllib.parse.urlparse(url) # Get IPv4 and IPv6 addresses ipv4_addresses, ipv6_addresses = resolve_hostname(parsed_url.hostname) @@ -140,7 +140,7 @@ def _ssrf_safe_new_conn(self): infos = socket.getaddrinfo(host, port, 0, socket.SOCK_STREAM) if not infos: raise OSError(f'getaddrinfo for {host!r} returned empty list') - if not ENABLE_RAG_LOCAL_WEB_FETCH: + if not ENABLE_LOCAL_WEB_FETCH: for _, _, _, _, sa in infos: if not ipaddress.ip_address(sa[0]).is_global: raise ValueError(ERROR_MESSAGES.INVALID_URL) @@ -196,7 +196,7 @@ class _SSRFSafeResolver(aiohttp.resolver.DefaultResolver): async def resolve(self, host, port=0, family=socket.AF_INET): results = await super().resolve(host, port, family) - if not ENABLE_RAG_LOCAL_WEB_FETCH: + if not ENABLE_LOCAL_WEB_FETCH: for entry in results: if not ipaddress.ip_address(entry['host']).is_global: raise ValueError(ERROR_MESSAGES.INVALID_URL) diff --git a/backend/open_webui/routers/images.py b/backend/open_webui/routers/images.py index 28008b25db..1c6c240d5d 100644 --- a/backend/open_webui/routers/images.py +++ b/backend/open_webui/routers/images.py @@ -428,7 +428,7 @@ async def get_image_data(data: str, headers=None, trusted_base_url: str | None = # ComfyUI on a private network), skip SSRF validation only when # the URL shares the exact same origin (scheme + host + port) # as the admin-configured base. This avoids both the global - # ENABLE_RAG_LOCAL_WEB_FETCH hammer and a blanket trust flag + # ENABLE_LOCAL_WEB_FETCH hammer and a blanket trust flag # that would follow arbitrary redirects. if trusted_base_url and _is_same_origin(data, trusted_base_url): log.debug(f'Skipping URL validation for trusted backend: {data}')