diff --git a/backend/open_webui/config.py b/backend/open_webui/config.py index ae174a65ab..c794065974 100644 --- a/backend/open_webui/config.py +++ b/backend/open_webui/config.py @@ -591,7 +591,11 @@ OAUTH_ALLOWED_ROLES = PersistentConfig( OAUTH_ADMIN_ROLES = PersistentConfig( "OAUTH_ADMIN_ROLES", "oauth.admin_roles", - [role.strip() for role in os.environ.get("OAUTH_ADMIN_ROLES", "admin").split(SEP) if role], + [ + role.strip() + for role in os.environ.get("OAUTH_ADMIN_ROLES", "admin").split(SEP) + if role + ], ) OAUTH_ALLOWED_DOMAINS = PersistentConfig( diff --git a/backend/open_webui/main.py b/backend/open_webui/main.py index 76cb9d7e07..1405a43061 100644 --- a/backend/open_webui/main.py +++ b/backend/open_webui/main.py @@ -1556,13 +1556,15 @@ async def chat_completion( log.info("Chat processing was cancelled") try: event_emitter = get_event_emitter(metadata) - await asyncio.shield(event_emitter( - {"type": "chat:tasks:cancel"}, - )) + await asyncio.shield( + event_emitter( + {"type": "chat:tasks:cancel"}, + ) + ) except Exception as e: pass finally: - raise # re-raise to ensure proper task cancellation handling + raise # re-raise to ensure proper task cancellation handling except Exception as e: log.debug(f"Error processing chat payload: {e}") if metadata.get("chat_id") and metadata.get("message_id"): diff --git a/backend/open_webui/retrieval/loaders/youtube.py b/backend/open_webui/retrieval/loaders/youtube.py index adf51d922c..cba602ed87 100644 --- a/backend/open_webui/retrieval/loaders/youtube.py +++ b/backend/open_webui/retrieval/loaders/youtube.py @@ -83,7 +83,7 @@ class YoutubeLoader: TranscriptsDisabled, YouTubeTranscriptApi, ) - from youtube_transcript_api.proxies import (GenericProxyConfig) + from youtube_transcript_api.proxies import GenericProxyConfig except ImportError: raise ImportError( 'Could not import "youtube_transcript_api" Python package. ' @@ -91,7 +91,9 @@ class YoutubeLoader: ) if self.proxy_url: - youtube_proxies = GenericProxyConfig(http_url=self.proxy_url, https_url=self.proxy_url) + youtube_proxies = GenericProxyConfig( + http_url=self.proxy_url, https_url=self.proxy_url + ) log.debug(f"Using proxy URL: {self.proxy_url[:14]}...") else: youtube_proxies = None diff --git a/backend/open_webui/utils/mcp/client.py b/backend/open_webui/utils/mcp/client.py index 67903b94d8..6edfca4f6c 100644 --- a/backend/open_webui/utils/mcp/client.py +++ b/backend/open_webui/utils/mcp/client.py @@ -9,6 +9,7 @@ from mcp.client.auth import OAuthClientProvider, TokenStorage from mcp.client.streamable_http import streamablehttp_client from mcp.shared.auth import OAuthClientInformationFull, OAuthClientMetadata, OAuthToken + class MCPClient: def __init__(self): self.session: Optional[ClientSession] = None @@ -35,7 +36,6 @@ class MCPClient: except Exception as e: await asyncio.shield(self.disconnect()) raise e - async def list_tool_specs(self) -> Optional[dict]: if not self.session: diff --git a/docs/SECURITY.md b/docs/SECURITY.md index fd4f5e8391..a9463269df 100644 --- a/docs/SECURITY.md +++ b/docs/SECURITY.md @@ -44,7 +44,7 @@ We appreciate the community's interest in identifying potential vulnerabilities. > - Screenshots/videos demonstrating the exploit (supplementary to written steps) > > **Failure to provide a reproducible PoC may lead to closure of the report** -> +> > We will notify you, if we struggle to reproduce the exploit using your PoC to allow you to improve your PoC. > However, if we repeatedly cannot reproduce the exploit using the PoC, the report may be closed. @@ -65,8 +65,7 @@ We appreciate the community's interest in identifying potential vulnerabilities. 9. **CVSS Scoring Accuracy:** If you include a CVSS score with your report, it must accurately reflect the vulnerability according to CVSS methodology. Common errors include 1) rating PR:N (None) when authentication is required, 2) scoring hypothetical attack chains instead of the actual vulnerability, or 3) inflating severity without evidence. **We will adjust inaccurate CVSS scores.** Intentionally inflated scores may result in report rejection. -> [!WARNING] -> **Using CVE Precedents:** If you cite other CVEs to support your report, ensure they are **genuinely comparable** in vulnerability type, threat model, and attack vector. Citing CVEs from different product categories, different vulnerability classes or different deployment models will lead us to suspect the use of AI in your report. +> [!WARNING] > **Using CVE Precedents:** If you cite other CVEs to support your report, ensure they are **genuinely comparable** in vulnerability type, threat model, and attack vector. Citing CVEs from different product categories, different vulnerability classes or different deployment models will lead us to suspect the use of AI in your report. 11. **Admin Actions Are Out of Scope:** Vulnerabilities that require an administrator to actively perform unsafe actions are **not considered valid vulnerabilities**. Admins have full system control and are expected to understand the security implications of their actions and configurations. This includes but is not limited to: adding malicious external servers (models, tools, webhooks), pasting untrusted code into Functions/Tools, or intentionally weakening security settings. **Reports requiring admin negligence or social engineering of admins may be rejected.** diff --git a/src/app.css b/src/app.css index cf5d0360cc..6a85c69d7e 100644 --- a/src/app.css +++ b/src/app.css @@ -152,10 +152,10 @@ select { -webkit-appearance: none; } -.dark select:not([class*="bg-transparent"]) { +.dark select:not([class*='bg-transparent']) { @apply bg-gray-900 text-gray-300; } - + .dark select option { @apply bg-gray-850 text-white; } diff --git a/src/app.html b/src/app.html index 432d59795f..9333dc8ba3 100644 --- a/src/app.html +++ b/src/app.html @@ -23,11 +23,7 @@ href="/static/apple-touch-icon.png" crossorigin="use-credentials" /> - + {#if showWebSearchButton || showImageGenerationButton || showCodeInterpreterButton || showToolsButton || (toggleFilters && toggleFilters.length > 0)} -
+