Skip to content

Dev#255

Merged
OrenZhang merged 233 commits intomainfrom
dev
Jan 10, 2026
Merged

Dev#255
OrenZhang merged 233 commits intomainfrom
dev

Conversation

@OrenZhang
Copy link
Copy Markdown
Collaborator

No description provided.

tjbck and others added 25 commits January 9, 2026 18:51
* Update CHANGELOG.md

* Update CHANGELOG.md

* Update CHANGELOG.md

* Update CHANGELOG.md

* Update CHANGELOG.md

* Update CHANGELOG.md

* Update CHANGELOG.md

* Update CHANGELOG.md

* Update CHANGELOG.md

* Update CHANGELOG.md

* Update CHANGELOG.md

* Update CHANGELOG.md

* Update CHANGELOG.md

* Update CHANGELOG.md

* Update CHANGELOG.md

* Update CHANGELOG.md

* Update CHANGELOG.md

* Update CHANGELOG.md

* Update CHANGELOG.md

* Update CHANGELOG.md

* Update CHANGELOG.md

* Update CHANGELOG.md

* Update CHANGELOG.md

* Update CHANGELOG.md

* Update CHANGELOG.md

* Update CHANGELOG.md

* Update CHANGELOG.md

* Update CHANGELOG.md

* Update CHANGELOG.md

* Update CHANGELOG.md

* Update CHANGELOG.md

* Update CHANGELOG.md

* Update CHANGELOG.md

* Update CHANGELOG.md

* Update CHANGELOG.md

* Update CHANGELOG.md

* Update CHANGELOG.md

* Update CHANGELOG.md

* Update CHANGELOG.md

* Update CHANGELOG.md

* Update CHANGELOG.md

* Update CHANGELOG.md

* Update CHANGELOG.md

* Update CHANGELOG.md

* Update CHANGELOG.md

* Update CHANGELOG.md

* Update CHANGELOG.md

* Update CHANGELOG.md

* Update CHANGELOG.md

* Update CHANGELOG.md

* Update CHANGELOG.md

* Update CHANGELOG.md

* Update CHANGELOG.md

* Update CHANGELOG.md

* Update CHANGELOG.md

* Update CHANGELOG.md

* Update CHANGELOG.md

* Update CHANGELOG.md

* Update CHANGELOG.md

* Update CHANGELOG.md

* Update CHANGELOG.md

* Update CHANGELOG.md

* Update CHANGELOG.md
# Conflicts:
#	backend/open_webui/config.py
#	backend/open_webui/models/models.py
#	backend/open_webui/routers/auths.py
#	backend/open_webui/routers/channels.py
#	backend/open_webui/routers/users.py
#	backend/open_webui/utils/auth.py
#	package-lock.json
#	package.json
#	src/lib/components/admin/Settings.svelte
#	src/lib/components/channel/Messages/Message.svelte
#	src/lib/components/workspace/Models/ModelEditor.svelte
#	src/lib/i18n/locales/ar-BH/translation.json
#	src/lib/i18n/locales/ar/translation.json
#	src/lib/i18n/locales/bg-BG/translation.json
#	src/lib/i18n/locales/bn-BD/translation.json
#	src/lib/i18n/locales/bo-TB/translation.json
#	src/lib/i18n/locales/bs-BA/translation.json
#	src/lib/i18n/locales/ca-ES/translation.json
#	src/lib/i18n/locales/ceb-PH/translation.json
#	src/lib/i18n/locales/cs-CZ/translation.json
#	src/lib/i18n/locales/da-DK/translation.json
#	src/lib/i18n/locales/de-DE/translation.json
#	src/lib/i18n/locales/dg-DG/translation.json
#	src/lib/i18n/locales/el-GR/translation.json
#	src/lib/i18n/locales/en-GB/translation.json
#	src/lib/i18n/locales/en-US/translation.json
#	src/lib/i18n/locales/es-ES/translation.json
#	src/lib/i18n/locales/et-EE/translation.json
#	src/lib/i18n/locales/eu-ES/translation.json
#	src/lib/i18n/locales/fa-IR/translation.json
#	src/lib/i18n/locales/fi-FI/translation.json
#	src/lib/i18n/locales/fr-CA/translation.json
#	src/lib/i18n/locales/fr-FR/translation.json
#	src/lib/i18n/locales/gl-ES/translation.json
#	src/lib/i18n/locales/he-IL/translation.json
#	src/lib/i18n/locales/hi-IN/translation.json
#	src/lib/i18n/locales/hr-HR/translation.json
#	src/lib/i18n/locales/hu-HU/translation.json
#	src/lib/i18n/locales/id-ID/translation.json
#	src/lib/i18n/locales/ie-GA/translation.json
#	src/lib/i18n/locales/it-IT/translation.json
#	src/lib/i18n/locales/ja-JP/translation.json
#	src/lib/i18n/locales/ka-GE/translation.json
#	src/lib/i18n/locales/kab-DZ/translation.json
#	src/lib/i18n/locales/ko-KR/translation.json
#	src/lib/i18n/locales/lt-LT/translation.json
#	src/lib/i18n/locales/ms-MY/translation.json
#	src/lib/i18n/locales/nb-NO/translation.json
#	src/lib/i18n/locales/nl-NL/translation.json
#	src/lib/i18n/locales/pa-IN/translation.json
#	src/lib/i18n/locales/pl-PL/translation.json
#	src/lib/i18n/locales/pt-BR/translation.json
#	src/lib/i18n/locales/pt-PT/translation.json
#	src/lib/i18n/locales/ro-RO/translation.json
#	src/lib/i18n/locales/ru-RU/translation.json
#	src/lib/i18n/locales/sk-SK/translation.json
#	src/lib/i18n/locales/sr-RS/translation.json
#	src/lib/i18n/locales/sv-SE/translation.json
#	src/lib/i18n/locales/th-TH/translation.json
#	src/lib/i18n/locales/tk-TM/translation.json
#	src/lib/i18n/locales/tr-TR/translation.json
#	src/lib/i18n/locales/ug-CN/translation.json
#	src/lib/i18n/locales/uk-UA/translation.json
#	src/lib/i18n/locales/ur-PK/translation.json
#	src/lib/i18n/locales/uz-Cyrl-UZ/translation.json
#	src/lib/i18n/locales/uz-Latn-Uz/translation.json
#	src/lib/i18n/locales/vi-VN/translation.json
#	src/lib/i18n/locales/zh-CN/translation.json
#	src/lib/i18n/locales/zh-TW/translation.json
Comment on lines +257 to +262
async with session.post(
server_url,
json={"jsonrpc": "2.0", "method": "initialize", "params": {}, "id": 1},
headers={"Content-Type": "application/json"},
ssl=AIOHTTP_CLIENT_SESSION_SSL,
) as response:

Check failure

Code scanning / CodeQL

Full server-side request forgery Critical

The full URL of this request depends on a
user-provided value
.
The full URL of this request depends on a
user-provided value
.
and tool.user_id != user.id
and not has_access(user.id, "read", tool.access_control, user_group_ids)
):
log.warning(f"Access denied to tool {tool_id} for user {user.id}")

Check failure

Code scanning / CodeQL

Clear-text logging of sensitive information High

This expression logs
sensitive data (password)
as clear text.
This expression logs
sensitive data (password)
as clear text.
This expression logs
sensitive data (password)
as clear text.
This expression logs
sensitive data (private)
as clear text.
This expression logs
sensitive data (private)
as clear text.
This expression logs sensitive data (private) as clear text.
This expression logs sensitive data (private) as clear text.
This expression logs sensitive data (private) as clear text.
# Handle function name collisions
while function_name in tools_dict:
log.warning(
f"Tool {function_name} already exists in another tools!"

Check failure

Code scanning / CodeQL

Clear-text logging of sensitive information High

This expression logs
sensitive data (password)
as clear text.
This expression logs
sensitive data (password)
as clear text.
This expression logs
sensitive data (password)
as clear text.
This expression logs
sensitive data (private)
as clear text.
This expression logs
sensitive data (private)
as clear text.
This expression logs sensitive data (private) as clear text.
This expression logs sensitive data (private) as clear text.
This expression logs sensitive data (private) as clear text.
user, tool_server_connection, user_group_ids
):
log.warning(
f"Access denied to tool server {server_id} for user {user.id}"

Check failure

Code scanning / CodeQL

Clear-text logging of sensitive information High

This expression logs
sensitive data (password)
as clear text.
This expression logs
sensitive data (password)
as clear text.
This expression logs
sensitive data (password)
as clear text.
This expression logs
sensitive data (private)
as clear text.
This expression logs
sensitive data (private)
as clear text.
This expression logs sensitive data (private) as clear text.
This expression logs sensitive data (private) as clear text.
This expression logs sensitive data (private) as clear text.
@OrenZhang OrenZhang merged commit 342358a into main Jan 10, 2026
9 of 10 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.