[PR #24447] [CLOSED] refac(audio,cache): allowlist audio extensions and harden cache file … #82537

New Issue

GiteaMirror · 2026-05-13T17:04:54-05:00

GiteaMirror commented

2026-05-13 17:04:54 -05:00

📋 Pull Request Information

Original PR: https://github.com/open-webui/open-webui/pull/24447
Author: @Classic298
Created: 5/8/2026
Status: ❌ Closed

Base: dev ← Head: fix/audio-upload-and-cache-hardening

📝 Commits (1)

8d95dfc refac(audio,cache): allowlist audio extensions and harden cache file serving

📊 Changes

2 files changed (+17 additions, -2 deletions)

View changed files

📝 backend/open_webui/main.py (+9 -1)
📝 backend/open_webui/routers/audio.py (+8 -1)

📄 Description

…serving

Audio transcription upload: validate file extension against a strict allowlist of known audio formats before persisting to disk. Rejects non-audio extensions with HTTP 400.

Cache route: add X-Content-Type-Options: nosniff to all responses. Force Content-Disposition: attachment for file types outside image/audio/video to prevent inline rendering of potentially dangerous content.

Contributor License Agreement

By submitting this pull request, I confirm that I have read and fully agree to the Contributor License Agreement (CLA), and I am providing my contributions under its terms.

Note

Deleting the CLA section will lead to immediate closure of your PR and it will not be merged in.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/open-webui/open-webui/pull/24447 **Author:** [@Classic298](https://github.com/Classic298) **Created:** 5/8/2026 **Status:** ❌ Closed **Base:** `dev` ← **Head:** `fix/audio-upload-and-cache-hardening` --- ### 📝 Commits (1) - [`8d95dfc`](https://github.com/open-webui/open-webui/commit/8d95dfcf73509e44b286f3e10913218b1004140b) refac(audio,cache): allowlist audio extensions and harden cache file serving ### 📊 Changes **2 files changed** (+17 additions, -2 deletions) <details> <summary>View changed files</summary> 📝 `backend/open_webui/main.py` (+9 -1) 📝 `backend/open_webui/routers/audio.py` (+8 -1) </details> ### 📄 Description …serving Audio transcription upload: validate file extension against a strict allowlist of known audio formats before persisting to disk. Rejects non-audio extensions with HTTP 400. Cache route: add X-Content-Type-Options: nosniff to all responses. Force Content-Disposition: attachment for file types outside image/audio/video to prevent inline rendering of potentially dangerous content. ### Contributor License Agreement  - [X] By submitting this pull request, I confirm that I have read and fully agree to the [Contributor License Agreement (CLA)](https://github.com/open-webui/open-webui/blob/main/CONTRIBUTOR_LICENSE_AGREEMENT), and I am providing my contributions under its terms. > [!NOTE] > Deleting the CLA section will lead to immediate closure of your PR and it will not be merged in. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

GiteaMirror added the pull-request label 2026-05-13 17:04:54 -05:00

GiteaMirror closed this issue

2026-05-13 17:04:57 -05:00

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/open-webui#82537