[PR #23587] [CLOSED] fix: pass db session to filter_allowed_access_grants in update_note_access_by_id #66123

New Issue

GiteaMirror · 2026-05-06T12:16:30-05:00

GiteaMirror commented

2026-05-06 12:16:30 -05:00

📋 Pull Request Information

Original PR: https://github.com/open-webui/open-webui/pull/23587
Author: @kuishou68
Created: 4/11/2026
Status: ❌ Closed

Base: main ← Head: fix/issue-23586-notes-access-db-param

📝 Commits (1)

941bbcb fix: pass db session to filter_allowed_access_grants in update_note_access_by_id (Closes #23586)

📊 Changes

1 file changed (+1 additions, -0 deletions)

View changed files

📝 backend/open_webui/routers/notes.py (+1 -0)

📄 Description

Closes #23586

Problem

In backend/open_webui/routers/notes.py, the update_note_access_by_id endpoint calls filter_allowed_access_grants without passing the db (SQLAlchemy session) parameter.

The filter_allowed_access_grants function internally calls has_permission() which calls Groups.get_groups_by_member_id(user_id, db=db). Without a valid db session, group-based permission lookups will fail, meaning non-admin users with group-granted sharing.public_notes permission will incorrectly have their access grants stripped/filtered when calling POST /{id}/access/update.

The same function call in update_note_by_id (also in notes.py) correctly passes db=db:

# CORRECT: in update_note_by_id (line ~281)
form_data.access_grants = filter_allowed_access_grants(
    request.app.state.config.USER_PERMISSIONS,
    user.id,
    user.role,
    form_data.access_grants,
    'sharing.public_notes',
    db=db,  # ✅ correctly passed here
)

# BUG: in update_note_access_by_id (line ~345) - missing db=db
form_data.access_grants = filter_allowed_access_grants(
    request.app.state.config.USER_PERMISSIONS,
    user.id,
    user.role,
    form_data.access_grants,
    'sharing.public_notes',
    # ❌ db=db missing!
)

Fix

Added the missing db=db keyword argument to the filter_allowed_access_grants call in update_note_access_by_id:

form_data.access_grants = filter_allowed_access_grants(
    request.app.state.config.USER_PERMISSIONS,
    user.id,
    user.role,
    form_data.access_grants,
    'sharing.public_notes',
    db=db,  # ✅ now correctly passes db session
)

Signed-off-by: cocoon 54054995+kuishou68@users.noreply.github.com

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/open-webui/open-webui/pull/23587 **Author:** [@kuishou68](https://github.com/kuishou68) **Created:** 4/11/2026 **Status:** ❌ Closed **Base:** `main` ← **Head:** `fix/issue-23586-notes-access-db-param` --- ### 📝 Commits (1) - [`941bbcb`](https://github.com/open-webui/open-webui/commit/941bbcba2b2920858a5f8a2c28b4b281c28d9500) fix: pass db session to filter_allowed_access_grants in update_note_access_by_id (Closes #23586) ### 📊 Changes **1 file changed** (+1 additions, -0 deletions) <details> <summary>View changed files</summary> 📝 `backend/open_webui/routers/notes.py` (+1 -0) </details> ### 📄 Description Closes #23586 ## Problem In `backend/open_webui/routers/notes.py`, the `update_note_access_by_id` endpoint calls `filter_allowed_access_grants` without passing the `db` (SQLAlchemy session) parameter. The `filter_allowed_access_grants` function internally calls `has_permission()` which calls `Groups.get_groups_by_member_id(user_id, db=db)`. Without a valid `db` session, group-based permission lookups will fail, meaning non-admin users with group-granted `sharing.public_notes` permission will incorrectly have their access grants stripped/filtered when calling `POST /{id}/access/update`. The **same function call** in `update_note_by_id` (also in `notes.py`) correctly passes `db=db`: ```python # CORRECT: in update_note_by_id (line ~281) form_data.access_grants = filter_allowed_access_grants( request.app.state.config.USER_PERMISSIONS, user.id, user.role, form_data.access_grants, 'sharing.public_notes', db=db, # ✅ correctly passed here ) # BUG: in update_note_access_by_id (line ~345) - missing db=db form_data.access_grants = filter_allowed_access_grants( request.app.state.config.USER_PERMISSIONS, user.id, user.role, form_data.access_grants, 'sharing.public_notes', # ❌ db=db missing! ) ``` ## Fix Added the missing `db=db` keyword argument to the `filter_allowed_access_grants` call in `update_note_access_by_id`: ```python form_data.access_grants = filter_allowed_access_grants( request.app.state.config.USER_PERMISSIONS, user.id, user.role, form_data.access_grants, 'sharing.public_notes', db=db, # ✅ now correctly passes db session ) ``` Signed-off-by: cocoon <54054995+kuishou68@users.noreply.github.com> --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

GiteaMirror added the pull-request label 2026-05-06 12:16:30 -05:00

GiteaMirror closed this issue

2026-05-06 12:16:33 -05:00

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/open-webui#66123