From a046e070442f7f48a3d875b7224511b6f4d86aa7 Mon Sep 17 00:00:00 2001 From: G30 <50341825+silentoplayz@users.noreply.github.com> Date: Thu, 24 Sep 2026 00:05:37 -0400 Subject: [PATCH] fix: save a file edit made through write access to a shared knowledge base (#30448) --- backend/open_webui/routers/retrieval.py | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/backend/open_webui/routers/retrieval.py b/backend/open_webui/routers/retrieval.py index 6c5f32ccb0..b9375e56c6 100644 --- a/backend/open_webui/routers/retrieval.py +++ b/backend/open_webui/routers/retrieval.py @@ -1936,10 +1936,10 @@ async def process_file( The session is committed before external API calls, and updates use a fresh session. """ config = await get_retrieval_config() - if user.role == 'admin': - file = await Files.get_file_by_id(form_data.file_id, db=db) - else: - file = await Files.get_file_by_id_and_user_id(form_data.file_id, user.id, db=db) + file = await Files.get_file_by_id(form_data.file_id, db=db) + if file and file.user_id != user.id and user.role != 'admin': + if not await has_access_to_file(file.id, 'write', user, db=db): + file = None if file: try: