mirror of
https://github.com/open-webui/open-webui.git
synced 2026-03-24 20:14:58 -05:00
User can delete chat via clicking 'Settings - Chats - Delete Chats' without permission #391
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @changchiyou on GitHub (Mar 2, 2024).
Originally assigned to: @tjbck on GitHub.
Bug Report
Description
Bug Summary:
After admin sets
Allow Chat DeletiontoDon't Allow, user can still delete chat via clickingSettings - Chats - Delete Chatswithout permission.Steps to Reproduce:
Sign-in as admin, set
Allow Chat DeletiontoDon't Allowand sign-out.Sign-in as user, ask some random question with LLM.
(This feature works perfectly) Click the trashcan icon at the left side, and got
You do not have permission to access this resource. Please contact your administrator for assistance.warning message.Click
Settings - Chats - Delete Chats, the chat history gone.after refreshing webpage:
Expected Behavior:
User can't delete chat without permission.
Actual Behavior:
User can do that via clicking
Settings - Chats - Delete Chats.Environment
Reproduction Details
Confirmation:
Logs and Screenshots
Browser Console Logs:
Click me
Docker Container Logs:
Click me
Screenshots (if applicable):
Already provided above at
Steps to Reproduce:section.Installation Method
Run
docker-compose upwith:Click me ☺️
Structure
Code
docker-compose.yml:example.env:litellm/config.yaml:Additional Information
This bug and https://github.com/open-webui/open-webui/issues/988 bug were both identified and tested in environments deployed using the same installation method. Both issues are related to 'Allow Chat Deletion' setting.