[PR #24693] [MERGED] fix: enforce features.direct_tool_servers on chat-completion tool_servers #131452

New Issue

GiteaMirror · 2026-05-21T16:59:22-05:00

GiteaMirror commented

2026-05-21 16:59:22 -05:00

📋 Pull Request Information

Original PR: https://github.com/open-webui/open-webui/pull/24693
Author: @Classic298
Created: 5/13/2026
Status: ✅ Merged
Merged: 5/14/2026
Merged by: @tjbck

Base: dev ← Head: fix/direct-tool-servers-permission-on-chat-completions

📝 Commits (2)

de788b5 fix: enforce features.direct_tool_servers on chat-completion tool_servers
11aed43 chore: trim verbose comment on tool_servers permission check

📊 Changes

1 file changed (+17 additions, -2 deletions)

View changed files

📝 backend/open_webui/main.py (+17 -2)

📄 Description

The features.direct_tool_servers per-user permission was correctly enforced on the storage path (routers/users.py user/settings/update, which strips toolServers from saved settings when the caller lacks the permission), but the inference path (/api/chat/completions) popped tool_servers straight from the request body into metadata with no permission check. The middleware (utils/middleware.py:2799) then consumed direct_tool_servers to inject system_prompt into the message array and register external tool specs that get invoked during the completion. End result: any authenticated user could bypass the admin-set per-user feature toggle and use inline tool_servers in their chat-completion requests, even when admin had explicitly denied the permission.

Default for USER_PERMISSIONS_FEATURES_DIRECT_TOOL_SERVERS is False (config.py:2750), so under default config no regular user is supposed to be able to use direct tool servers — making this a real boundary bypass on out-of-the-box deployments rather than a corner case.

Mirror the storage-side behaviour at the inference entry point: pop tool_servers from the request body, then silently drop the value if the caller is non-admin and lacks features.direct_tool_servers. Admins always pass; users with the explicit grant always pass; everyone else gets None propagated into metadata, which the middleware already handles as the no-tool-servers case.

Contributor License Agreement

By submitting this pull request, I confirm that I have read and fully agree to the Contributor License Agreement (CLA), and I am providing my contributions under its terms.

Note

Deleting the CLA section will lead to immediate closure of your PR and it will not be merged in.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/open-webui/open-webui/pull/24693 **Author:** [@Classic298](https://github.com/Classic298) **Created:** 5/13/2026 **Status:** ✅ Merged **Merged:** 5/14/2026 **Merged by:** [@tjbck](https://github.com/tjbck) **Base:** `dev` ← **Head:** `fix/direct-tool-servers-permission-on-chat-completions` --- ### 📝 Commits (2) - [`de788b5`](https://github.com/open-webui/open-webui/commit/de788b5701a6992eb001d52aa1a8aace478d5b04) fix: enforce features.direct_tool_servers on chat-completion tool_servers - [`11aed43`](https://github.com/open-webui/open-webui/commit/11aed43c9b7870a853c3173336ede3dd9f8b631c) chore: trim verbose comment on tool_servers permission check ### 📊 Changes **1 file changed** (+17 additions, -2 deletions) <details> <summary>View changed files</summary> 📝 `backend/open_webui/main.py` (+17 -2) </details> ### 📄 Description The features.direct_tool_servers per-user permission was correctly enforced on the storage path (routers/users.py user/settings/update, which strips toolServers from saved settings when the caller lacks the permission), but the inference path (/api/chat/completions) popped tool_servers straight from the request body into metadata with no permission check. The middleware (utils/middleware.py:2799) then consumed direct_tool_servers to inject system_prompt into the message array and register external tool specs that get invoked during the completion. End result: any authenticated user could bypass the admin-set per-user feature toggle and use inline tool_servers in their chat-completion requests, even when admin had explicitly denied the permission. Default for USER_PERMISSIONS_FEATURES_DIRECT_TOOL_SERVERS is False (config.py:2750), so under default config no regular user is supposed to be able to use direct tool servers — making this a real boundary bypass on out-of-the-box deployments rather than a corner case. Mirror the storage-side behaviour at the inference entry point: pop tool_servers from the request body, then silently drop the value if the caller is non-admin and lacks features.direct_tool_servers. Admins always pass; users with the explicit grant always pass; everyone else gets None propagated into metadata, which the middleware already handles as the no-tool-servers case. ### Contributor License Agreement  - [x] By submitting this pull request, I confirm that I have read and fully agree to the [Contributor License Agreement (CLA)](https://github.com/open-webui/open-webui/blob/main/CONTRIBUTOR_LICENSE_AGREEMENT), and I am providing my contributions under its terms. > [!NOTE] > Deleting the CLA section will lead to immediate closure of your PR and it will not be merged in. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

GiteaMirror added the pull-request label 2026-05-21 16:59:22 -05:00

GiteaMirror closed this issue

2026-05-21 16:59:29 -05:00

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/open-webui#131452