[PR #11087] [MERGED] fix: Add access control usage to files APIs #109970

New Issue

GiteaMirror · 2026-05-18T09:27:07-05:00

GiteaMirror commented

2026-05-18 09:27:07 -05:00

📋 Pull Request Information

Original PR: https://github.com/open-webui/open-webui/pull/11087
Author: @tarmst
Created: 3/3/2025
Status: ✅ Merged
Merged: 3/31/2025
Merged by: @tjbck

Base: dev ← Head: fix-files-access-control

📝 Commits (1)

1ad8049 Add read/write access control for files from knowledge

📊 Changes

1 file changed (+104 additions, -7 deletions)

View changed files

📝 backend/open_webui/routers/files.py (+104 -7)

📄 Description

Pull Request Checklist

Note to first-time contributors: Please open a discussion post in Discussions and describe your changes before submitting a pull request.

Will link issue when Github puts them back up.
Edit: Issues back up, here it is: https://github.com/open-webui/open-webui/issues/8483

Before submitting, make sure you've checked the following:

Target branch: Please verify that the pull request targets the dev branch.
Description: Provide a concise description of the changes made in this pull request.
Changelog: Ensure a changelog entry following the format of Keep a Changelog is added at the bottom of the PR description.
Documentation: Have you updated relevant documentation Open WebUI Docs, or other documentation sources?
Dependencies: Are there any new dependencies? Have you updated the dependency versions in the documentation?
- None
Testing: Have you written and run sufficient tests for validating the changes?
- Tested by running changed functions as a user with no access to the file, read access to the file, and finally write access to the file.
Code review: Have you performed a self-review of your code, addressing any coding standard issues and ensuring adherence to the project's coding standards?
Prefix: To cleary categorize this pull request, prefix the pull request title, using one of the following:
- fix: Bug fix or error correction

Changelog Entry

Description

Fixed files API calls to use read/write permissions assigned by knowledge bases that files are a part of.

Fixed

Fixed files API calls not using read/write permissions from access control.

Additional Information

I think there are 2 ways of doing this: Either assigning read/write access to files when the knowledge base gets updated, or just checking the knowledge base's access when necessary. I opted to check the file's knowledge base because it seemed like the less convoluted option and most of the heavy lifting was already done for me in the original issue (thanks!). Let me know if you'd rather it be so that files' access control gets updated.

I know I introduced a somewhat messy function to the top of the routers file (the function isn't even a route) - Let me know if this should go somewhere else & where it should go. Thanks.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/open-webui/open-webui/pull/11087 **Author:** [@tarmst](https://github.com/tarmst) **Created:** 3/3/2025 **Status:** ✅ Merged **Merged:** 3/31/2025 **Merged by:** [@tjbck](https://github.com/tjbck) **Base:** `dev` ← **Head:** `fix-files-access-control` --- ### 📝 Commits (1) - [`1ad8049`](https://github.com/open-webui/open-webui/commit/1ad80490de3ad957fc83e434eb89937156b8a977) Add read/write access control for files from knowledge ### 📊 Changes **1 file changed** (+104 additions, -7 deletions) <details> <summary>View changed files</summary> 📝 `backend/open_webui/routers/files.py` (+104 -7) </details> ### 📄 Description # Pull Request Checklist ### Note to first-time contributors: Please open a discussion post in [Discussions](https://github.com/open-webui/open-webui/discussions) and describe your changes before submitting a pull request. Will link issue when Github puts them back up. Edit: Issues back up, here it is: https://github.com/open-webui/open-webui/issues/8483 **Before submitting, make sure you've checked the following:** - [x] **Target branch:** Please verify that the pull request targets the `dev` branch. - [x] **Description:** Provide a concise description of the changes made in this pull request. - [x] **Changelog:** Ensure a changelog entry following the format of [Keep a Changelog](https://keepachangelog.com/) is added at the bottom of the PR description. - [x] **Documentation:** Have you updated relevant documentation [Open WebUI Docs](https://github.com/open-webui/docs), or other documentation sources? - [x] **Dependencies:** Are there any new dependencies? Have you updated the dependency versions in the documentation? - None - [x] **Testing:** Have you written and run sufficient tests for validating the changes? - Tested by running changed functions as a user with no access to the file, read access to the file, and finally write access to the file. - [x] **Code review:** Have you performed a self-review of your code, addressing any coding standard issues and ensuring adherence to the project's coding standards? - [x] **Prefix:** To cleary categorize this pull request, prefix the pull request title, using one of the following: - **fix**: Bug fix or error correction # Changelog Entry ### Description - Fixed files API calls to use read/write permissions assigned by knowledge bases that files are a part of. ### Fixed - Fixed files API calls not using read/write permissions from access control. --- ### Additional Information I think there are 2 ways of doing this: Either assigning read/write access to files when the knowledge base gets updated, or just checking the knowledge base's access when necessary. I opted to check the file's knowledge base because it seemed like the less convoluted option and most of the heavy lifting was already done for me in the original issue (thanks!). Let me know if you'd rather it be so that files' access control gets updated. I know I introduced a somewhat messy function to the top of the routers file (the function isn't even a route) - Let me know if this should go somewhere else & where it should go. Thanks. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

GiteaMirror added the pull-request label 2026-05-18 09:27:07 -05:00

GiteaMirror closed this issue

2026-05-18 09:27:09 -05:00

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/open-webui#109970