fix: bind per-session state to the requesting user in multi-user mode - #143
Open
EllaFr wants to merge 1 commit into
Open
fix: bind per-session state to the requesting user in multi-user mode#143EllaFr wants to merge 1 commit into
EllaFr wants to merge 1 commit into
Conversation
Multi-user mode namespaces filesystem access per user, but per-session working-directory state was keyed by X-Session-Id alone and was not namespaced per user. Key it by (user, session id) so a session id resolves only within the caller's own namespace. Also require X-User-Id when multi-user mode is enabled, and validate the /files/cwd target in all modes rather than in single-user mode only. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
In multi-user mode the file endpoints isolate users through
UserFS, but per-session working-directory state isn't namespaced the same way._session_cwdsis keyed byX-Session-Idalone with no owner, so the same entry is addressed regardless of who sends the request,POST /files/cwdwrites to whatever session id the request names, and its target validation is skipped whenever multi-user mode is active.get_filesystemalso falls back to an unscopedUserFSwhenX-User-Idis absent, which skips per-user path validation entirely.Key
_session_cwdsby(user, session id), taking the user from the server-derivedX-User-Idthe Open WebUI proxy already sends, so a reused session id resolves within the caller's own namespace rather than reaching another user's state.X-User-Idis now required when multi-user mode is enabled instead of silently falling back to an unscoped filesystem, and thePOST /files/cwdtarget is validated in all modes throughUserFS.isdirrather than in single-user mode only. Single-user mode is unchanged.Contributor License Agreement
Note
Deleting the CLA section will lead to immediate closure of your PR and it will not be merged in.