mirror of
https://github.com/open-webui/open-webui.git
synced 2026-07-31 10:36:16 -05:00
Classic298andGitHub
4f94d21780
Unlike all other resource routers (knowledge, models, notes, prompts, tools, skills), the channel router did not call filter_allowed_access_grants. This allowed any user to set wildcard access grants on group channels, bypassing the admin's public sharing permission framework. Adds filter_allowed_access_grants with the sharing.public_channels permission key to both create and update endpoints, matching the pattern used by all other resource routers.