From 9964ad0a5b4243d752709f6efb9da7703e43206c Mon Sep 17 00:00:00 2001 From: Timothy Jaeryang Baek Date: Wed, 4 Jun 2025 15:21:08 +0400 Subject: [PATCH] refac: auth cache dir Co-Authored-By: Rodrigo Agundez --- backend/open_webui/main.py | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-) diff --git a/backend/open_webui/main.py b/backend/open_webui/main.py index a75aebb322..8527081e84 100644 --- a/backend/open_webui/main.py +++ b/backend/open_webui/main.py @@ -37,7 +37,7 @@ from fastapi import ( from fastapi.openapi.docs import get_swagger_ui_html from fastapi.middleware.cors import CORSMiddleware -from fastapi.responses import JSONResponse, RedirectResponse +from fastapi.responses import FileResponse, JSONResponse, RedirectResponse from fastapi.staticfiles import StaticFiles from starlette_compress import CompressMiddleware @@ -1634,7 +1634,20 @@ async def healthcheck_with_db(): app.mount("/static", StaticFiles(directory=STATIC_DIR), name="static") -app.mount("/cache", StaticFiles(directory=CACHE_DIR), name="cache") + + +@app.get("/cache/{path:path}") +async def serve_cache_file( + path: str, + user=Depends(get_verified_user), +): + file_path = os.path.abspath(os.path.join(CACHE_DIR, path)) + # prevent path traversal + if not file_path.startswith(os.path.abspath(CACHE_DIR)): + raise HTTPException(status_code=404, detail="File not found") + if not os.path.isfile(file_path): + raise HTTPException(status_code=404, detail="File not found") + return FileResponse(file_path) def swagger_ui_html(*args, **kwargs):