As a User I can access the URL Path /admin/settings/ and /workspace -> maybe there are even more paths... #1663

New Issue

2025-11-11T14:49:34-06:00

GiteaMirror commented

2025-11-11 14:49:34 -06:00

Originally created by @wggcch on GitHub (Aug 2, 2024).

Bug Report

Description

Bug Summary:
Given I am logged in as a User

/workspace
Steps to Reproduce:
When I append /workspace to my URL (e.g. http://localhost:3000/workspace)
When I visit the URL

Actual Behavior:
I can open the Workspace Settings

Expected Behavior:
I think it would be better to not be able to visit the page as a user at all or add a "local" /workspace for a more group and user based access

/admin/settings
Steps to Reproduce:
When I append /admin/settings
When I visit the URL

Actual Behavior:
I can open the Admin Settings

Expected Behavior:

As a User I would not expect to enter the Admin settings

Environment

Open WebUI Version: [0.3.10]
Operating System: [ macOS Big Sur]
Browser: [Firefox, Chrome, MS Edge where tested]

Reproduction Details

Confirmation:

[ x ] I have read and followed all the instructions provided in the README.md.
[ x] I am on the latest version of both Open WebUI and Ollama.

Logs and Screenshots

I've made two Screenshots of a User entering the mentioned paths

Installation Method

I've installed openwebui over docker, like its discribed within the readme.md

echo "Starting open webui"
docker run -d -p 3005:8080 \
  --add-host=host.docker.internal:host-gateway \
  -v open-webui:/app/backend/data \
  --name open-webui \
  --env-file ./openwebui.env \
  --restart always \
  ghcr.io/open-webui/open-webui:main

#openwebui.env 
WEBUI_AUTH=True
ENABLE_OAUTH_SIGNUP=False
WEBUI_NAME="MYWEBUI"

Originally created by @wggcch on GitHub (Aug 2, 2024). # Bug Report ## Description **Bug Summary:** Given I am logged in as a User /workspace **Steps to Reproduce:** When I append /workspace to my URL (e.g. http://localhost:3000/workspace) When I visit the URL **Actual Behavior:** I can open the Workspace Settings **Expected Behavior:** I think it would be better to not be able to visit the page as a user at all or add a "local" /workspace for a more group and user based access /admin/settings **Steps to Reproduce:** When I append /admin/settings When I visit the URL **Actual Behavior:** I can open the Admin Settings **Expected Behavior:** As a User I would not expect to enter the Admin settings ## Environment - **Open WebUI Version:** [0.3.10] - **Operating System:** [ macOS Big Sur] - **Browser:** [Firefox, Chrome, MS Edge where tested] ## Reproduction Details **Confirmation:** - [ x ] I have read and followed all the instructions provided in the README.md. - [ x] I am on the latest version of both Open WebUI and Ollama. ## Logs and Screenshots I've made two Screenshots of a User entering the mentioned paths ![Bildschirmfoto 2024-08-02 um 17 10 55](https://github.com/user-attachments/assets/627f58d1-4690-4ed5-bb7a-8586ed501bf6) ![Bildschirmfoto 2024-08-02 um 17 11 41](https://github.com/user-attachments/assets/ef7ef7f2-7801-444c-886c-f99c686299f5) ## Installation Method I've installed openwebui over docker, like its discribed within the readme.md ```console echo "Starting open webui" docker run -d -p 3005:8080 \ --add-host=host.docker.internal:host-gateway \ -v open-webui:/app/backend/data \ --name open-webui \ --env-file ./openwebui.env \ --restart always \ ghcr.io/open-webui/open-webui:main ``` ``` #openwebui.env WEBUI_AUTH=True ENABLE_OAUTH_SIGNUP=False WEBUI_NAME="MYWEBUI" ```

GiteaMirror closed this issue

2025-11-11 14:49:34 -06:00

GiteaMirror commented

2025-11-11 14:49:35 -06:00

@tjbck commented on GitHub (Aug 2, 2024):

Fixed on dev!

@tjbck commented on GitHub (Aug 2, 2024): Fixed on dev!