starred/open-webui
1
0
Fork 0
mirror of https://github.com/open-webui/open-webui.git synced 2026-09-28 02:07:05 -04:00
Code Issues Packages Projects Releases Wiki Activity

fix: gravatar profile image

Browse Source
This commit is contained in:
Timothy Jaeryang Baek
2026-04-01 05:33:41 -05:00
parent eb5c95ef8e
commit b898fc0258
3 changed files with 17 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/open_webui/utils/validate.py
+9
View File
@@ -6,6 +6,11 @@ _ALLOWED_STATIC_PATHS = (
'/static/favicon.png',
)
# External URL prefixes that are explicitly trusted for profile images
_ALLOWED_URL_PREFIXES = (
'https://www.gravatar.com/avatar/',
)
def validate_profile_image_url(url: str) -> str:
"""
@@ -15,6 +20,7 @@ def validate_profile_image_url(url: str) -> str:
- Empty string (falls back to default avatar)
- data:image/* URIs (base64-encoded uploads from the frontend)
- Known static asset paths (/user.png, /static/favicon.png)
- Trusted external URLs (e.g. Gravatar)
Returns the url unchanged if valid, raises ValueError otherwise.
"""
@@ -33,4 +39,7 @@ def validate_profile_image_url(url: str) -> str:
if url in _ALLOWED_STATIC_PATHS:
return url
if any(url.startswith(prefix) for prefix in _ALLOWED_URL_PREFIXES):
return url
raise ValueError('Invalid profile image URL: only data URIs and default avatars are allowed.')