From 24805ca79e61fa4d5f8e5ca3e0d15be5422ab8fd Mon Sep 17 00:00:00 2001 From: Timothy Jaeryang Baek Date: Sun, 20 Jul 2025 15:17:17 +0400 Subject: [PATCH] refac/fix: channel messages --- backend/open_webui/routers/channels.py | 32 +++++++++++++++----------- 1 file changed, 18 insertions(+), 14 deletions(-) diff --git a/backend/open_webui/routers/channels.py b/backend/open_webui/routers/channels.py index a4173fbd8d..e4390e23f6 100644 --- a/backend/open_webui/routers/channels.py +++ b/backend/open_webui/routers/channels.py @@ -434,13 +434,6 @@ async def update_message_by_id( status_code=status.HTTP_404_NOT_FOUND, detail=ERROR_MESSAGES.NOT_FOUND ) - if user.role != "admin" and not has_access( - user.id, type="read", access_control=channel.access_control - ): - raise HTTPException( - status_code=status.HTTP_403_FORBIDDEN, detail=ERROR_MESSAGES.DEFAULT() - ) - message = Messages.get_message_by_id(message_id) if not message: raise HTTPException( @@ -452,6 +445,15 @@ async def update_message_by_id( status_code=status.HTTP_400_BAD_REQUEST, detail=ERROR_MESSAGES.DEFAULT() ) + if ( + user.role != "admin" + and message.user_id != user.id + and not has_access(user.id, type="read", access_control=channel.access_control) + ): + raise HTTPException( + status_code=status.HTTP_403_FORBIDDEN, detail=ERROR_MESSAGES.DEFAULT() + ) + try: message = Messages.update_message_by_id(message_id, form_data) message = Messages.get_message_by_id(message_id) @@ -641,13 +643,6 @@ async def delete_message_by_id( status_code=status.HTTP_404_NOT_FOUND, detail=ERROR_MESSAGES.NOT_FOUND ) - if user.role != "admin" and not has_access( - user.id, type="read", access_control=channel.access_control - ): - raise HTTPException( - status_code=status.HTTP_403_FORBIDDEN, detail=ERROR_MESSAGES.DEFAULT() - ) - message = Messages.get_message_by_id(message_id) if not message: raise HTTPException( @@ -659,6 +654,15 @@ async def delete_message_by_id( status_code=status.HTTP_400_BAD_REQUEST, detail=ERROR_MESSAGES.DEFAULT() ) + if ( + user.role != "admin" + and message.user_id != user.id + and not has_access(user.id, type="read", access_control=channel.access_control) + ): + raise HTTPException( + status_code=status.HTTP_403_FORBIDDEN, detail=ERROR_MESSAGES.DEFAULT() + ) + try: Messages.delete_message_by_id(message_id) await sio.emit(