Classic298 73776d54b8 fix: enforce public sharing permission checks across all resource types (#21358) ...

The sharePublic prop in editor components (Knowledge, Tools, Skills,
Prompts, Models) incorrectly included an "|| edit" / "|| write_access"
condition, allowing users with write access to see and use the "Public"
sharing option regardless of their actual public sharing permission.
Additionally, all backend access/update endpoints only verified write
authorization but did not check the corresponding sharing.public_*
permission, allowing direct API calls to bypass frontend restrictions
entirely.
Frontend: removed the edit/write_access bypass from sharePublic in all
five editor components so visibility is gated solely by the user's
sharing.public_* permission or admin role.
Backend: added has_public_read_access_grant checks to the access/update
endpoints in knowledge.py, tools.py, prompts.py, skills.py, models.py,
and notes.py. Public grants are silently stripped when the user lacks
the corresponding permission.
Fixes #21356

2026-02-13 11:22:32 -06:00

..

data

…

open_webui

fix: enforce public sharing permission checks across all resource types (#21358)

2026-02-13 11:22:32 -06:00

.dockerignore

…

.gitignore

…

dev.sh

…

requirements-min.txt

refac

2026-02-12 16:54:32 -06:00

requirements.txt

refac

2026-02-12 16:54:32 -06:00

start_windows.bat

…

start.sh

…