3 people 707efeaed7 fix: scope knowledge sync cleanup deletions to the target knowledge base (#26722) ...

POST /knowledge/{id}/sync/cleanup verified write access to the knowledge base in the URL but then acted on the caller-supplied file_ids and dir_ids without checking they belong to that knowledge base. A user with write access to any knowledge base could pass another knowledge base's directory id to delete its directory subtree and knowledge_file associations, or another file's id to drop its file-{file_id} vector collection. Fetch each directory and skip any whose knowledge_id does not match the URL id (matching the explicit directory-delete endpoint), and gate the per-file vector cleanup on Knowledges.has_file(id, file_id) so a foreign file id cannot trigger collection deletion. Legitimate same-knowledge-base cleanup is unchanged.

Co-authored-by: whyiug <whyiug@users.noreply.github.com>

2026-07-27 02:18:38 -04:00

..

data

…

open_webui

fix: scope knowledge sync cleanup deletions to the target knowledge base (#26722)

2026-07-27 02:18:38 -04:00

.dockerignore

…

.gitignore

…

dev.sh

…

requirements-min.txt

refac

2026-07-26 23:03:32 -04:00

requirements.txt

perf: stop resolving DNS on the thread pool (add aiodns) (#27440)

2026-07-26 23:29:52 -04:00

start_windows.bat

…

start.sh

…