2f7c1d7 Use ENABLE_ADMIN_CHAT_ACCESS as a default for ENABLE_ADMIN_EXPORT
📊 Changes
1 file changed (+6 additions, -2 deletions)
View changed files
📝backend/open_webui/config.py (+6 -2)
📄 Description
This still retains the ability to manually configure ENABLE_ADMIN_EXPORT, but defaults its value to the value of ENABLE_ADMIN_CHAT_ACCESS if set, as the export contains the chats.
This is a followup to the discussion in #16625 where I found it highly unintuitive that disabling admin chat access, still retains his ability to regain that access by exporting all chats.
Looking at the code, there are examples like
ifPGVECTOR_PGCRYPTOandnotPGVECTOR_PGCRYPTO_KEY:raiseValueError("PGVECTOR_PGCRYPTO is enabled but PGVECTOR_PGCRYPTO_KEY is not set. Please provide a valid key.")
The environment variable ENABLE_ADMIN_EXPORT, now defaults to the value of ENABLE_ADMIN_CHAT_ACCESS, as the export contains the chats of all users.
Changed
If you have set ENABLE_ADMIN_CHAT_ACCESS to false but have not set ENABLE_ADMIN_EXPORT, it will now also be set to false and the respective controls in the admin interface will be hidden.
Security
This might fix a security violation where you wanted your admins to not be able to read user chats, but they still where able to via the export.
By submitting this pull request, I confirm that I have read and fully agree to the Contributor License Agreement (CLA), and I am providing my contributions under its terms.
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.
## 📋 Pull Request Information
**Original PR:** https://github.com/open-webui/open-webui/pull/16738
**Author:** [@dwt](https://github.com/dwt)
**Created:** 8/19/2025
**Status:** ❌ Closed
**Base:** `dev` ← **Head:** `default-ENABLE_ADMIN_EXPORT-to-ENABLE_ADMIN_CHAT_ACCESS`
---
### 📝 Commits (1)
- [`2f7c1d7`](https://github.com/open-webui/open-webui/commit/2f7c1d74e201ae17493654fd0f66e8143652afd7) Use ENABLE_ADMIN_CHAT_ACCESS as a default for ENABLE_ADMIN_EXPORT
### 📊 Changes
**1 file changed** (+6 additions, -2 deletions)
<details>
<summary>View changed files</summary>
📝 `backend/open_webui/config.py` (+6 -2)
</details>
### 📄 Description
This still retains the ability to manually configure ENABLE_ADMIN_EXPORT, but defaults its value to the value of ENABLE_ADMIN_CHAT_ACCESS if set, as the export contains the chats.
This is a followup to the discussion in #16625 where I found it highly unintuitive that disabling admin chat access, still retains his ability to regain that access by exporting all chats.
Looking at the code, there are examples like
```python
if PGVECTOR_PGCRYPTO and not PGVECTOR_PGCRYPTO_KEY:
raise ValueError(
"PGVECTOR_PGCRYPTO is enabled but PGVECTOR_PGCRYPTO_KEY is not set. Please provide a valid key."
)
```
and
```python
if OLLAMA_BASE_URL == "" and OLLAMA_API_BASE_URL != "":
OLLAMA_BASE_URL = (
OLLAMA_API_BASE_URL[:-4]
if OLLAMA_API_BASE_URL.endswith("/api")
else OLLAMA_API_BASE_URL
)
```
So dependant environment variables are not a new thing, which is why I hope you can accept this pull request.
# TODO
- [ ] [update Documentation](https://docs.openwebui.com/getting-started/env-configuration/#enable_admin_export) once we know this pull request has a chance to get merged
# Changelog Entry
### Description
- The environment variable `ENABLE_ADMIN_EXPORT`, now defaults to the value of `ENABLE_ADMIN_CHAT_ACCESS`, as the export contains the chats of all users.
### Changed
- If you have set `ENABLE_ADMIN_CHAT_ACCESS` to `false` but have not set `ENABLE_ADMIN_EXPORT`, it will now also be set to false and the respective controls in the admin interface will be hidden.
### Security
- This might fix a security violation where you wanted your admins to not be able to read user chats, but they still where able to via the export.
---
### Additional Information
- This was first reported by @dwt in #16625
### Screenshots or Videos
-
<img width="1492" height="534" alt="image" src="https://github.com/user-attachments/assets/ca703263-3020-46bd-8731-520dd13fc7c5" />
### Contributor License Agreement
- [x] By submitting this pull request, I confirm that I have read and fully agree to the [Contributor License Agreement (CLA)](/CONTRIBUTOR_LICENSE_AGREEMENT), and I am providing my contributions under its terms.
---
<sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
📋 Pull Request Information
Original PR: https://github.com/open-webui/open-webui/pull/16738
Author: @dwt
Created: 8/19/2025
Status: ❌ Closed
Base:
dev← Head:default-ENABLE_ADMIN_EXPORT-to-ENABLE_ADMIN_CHAT_ACCESS📝 Commits (1)
2f7c1d7Use ENABLE_ADMIN_CHAT_ACCESS as a default for ENABLE_ADMIN_EXPORT📊 Changes
1 file changed (+6 additions, -2 deletions)
View changed files
📝
backend/open_webui/config.py(+6 -2)📄 Description
This still retains the ability to manually configure ENABLE_ADMIN_EXPORT, but defaults its value to the value of ENABLE_ADMIN_CHAT_ACCESS if set, as the export contains the chats.
This is a followup to the discussion in #16625 where I found it highly unintuitive that disabling admin chat access, still retains his ability to regain that access by exporting all chats.
Looking at the code, there are examples like
and
So dependant environment variables are not a new thing, which is why I hope you can accept this pull request.
TODO
Changelog Entry
Description
ENABLE_ADMIN_EXPORT, now defaults to the value ofENABLE_ADMIN_CHAT_ACCESS, as the export contains the chats of all users.Changed
ENABLE_ADMIN_CHAT_ACCESStofalsebut have not setENABLE_ADMIN_EXPORT, it will now also be set to false and the respective controls in the admin interface will be hidden.Security
Additional Information
Screenshots or Videos
Contributor License Agreement
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.