[PR #23636] [CLOSED] fix: prevent KB collaborators from permanently deleting files they do not own #42923

New Issue

GiteaMirror · 2026-04-25T14:41:17-05:00

GiteaMirror commented

2026-04-25 14:41:17 -05:00

📋 Pull Request Information

Original PR: https://github.com/open-webui/open-webui/pull/23636
Author: @Classic298
Created: 4/12/2026
Status: ❌ Closed

Base: dev ← Head: fix/kb-file-deletion-ownership

📝 Commits (2)

481ac79 fix: prevent KB collaborators from permanently deleting files they do not own
4fc7fdd merge: resolve conflicts with upstream async DB migration

📊 Changes

1 file changed (+34 additions, -11 deletions)

View changed files

📝 backend/open_webui/routers/knowledge.py (+34 -11)

📄 Description

The file/remove endpoint checked KB write access but not file ownership before calling Files.delete_file_by_id. A collaborator with KB write access could permanently destroy any file linked to the shared KB, affecting all other KBs and chats that reference it.

Collaborators can still unlink files from the KB. Only the file owner or an admin can permanently delete the underlying file.

Contributor License Agreement

By submitting this pull request, I confirm that I have read and fully agree to the Contributor License Agreement (CLA), and I am providing my contributions under its terms.

Note

Deleting the CLA section will lead to immediate closure of your PR and it will not be merged in.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/open-webui/open-webui/pull/23636 **Author:** [@Classic298](https://github.com/Classic298) **Created:** 4/12/2026 **Status:** ❌ Closed **Base:** `dev` ← **Head:** `fix/kb-file-deletion-ownership` --- ### 📝 Commits (2) - [`481ac79`](https://github.com/open-webui/open-webui/commit/481ac79ab7fb9afd5b39345bc7efb916da125f00) fix: prevent KB collaborators from permanently deleting files they do not own - [`4fc7fdd`](https://github.com/open-webui/open-webui/commit/4fc7fddf24b62170255c9292cd643f24f26f14ff) merge: resolve conflicts with upstream async DB migration ### 📊 Changes **1 file changed** (+34 additions, -11 deletions) <details> <summary>View changed files</summary> 📝 `backend/open_webui/routers/knowledge.py` (+34 -11) </details> ### 📄 Description The file/remove endpoint checked KB write access but not file ownership before calling Files.delete_file_by_id. A collaborator with KB write access could permanently destroy any file linked to the shared KB, affecting all other KBs and chats that reference it. Collaborators can still unlink files from the KB. Only the file owner or an admin can permanently delete the underlying file. ### Contributor License Agreement  - [X] By submitting this pull request, I confirm that I have read and fully agree to the [Contributor License Agreement (CLA)](https://github.com/open-webui/open-webui/blob/main/CONTRIBUTOR_LICENSE_AGREEMENT), and I am providing my contributions under its terms. > [!NOTE] > Deleting the CLA section will lead to immediate closure of your PR and it will not be merged in. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

GiteaMirror added the pull-request label 2026-04-25 14:41:17 -05:00

GiteaMirror closed this issue

2026-04-25 14:41:18 -05:00

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/open-webui#42923