Merge remote-tracking branch 'upstream/dev' into dev

Author: github-actions[bot]

backend/open_webui/models/prompts.py

@@ -10,7 +10,8 @@
 
 
 from pydantic import BaseModel, ConfigDict
-from sqlalchemy import BigInteger, Boolean, Column, String, Text, JSON
+from sqlalchemy import BigInteger, Boolean, Column, String, Text, JSON, or_, func, cast
+
 
 from open_webui.utils.access_control import has_access
 
@@ -85,7 +86,18 @@ class PromptAccessResponse(PromptUserResponse):
     write_access: Optional[bool] = False
 
 
+class PromptListResponse(BaseModel):
+    items: list[PromptUserResponse]
+    total: int
+
+
+class PromptAccessListResponse(BaseModel):
+    items: list[PromptAccessResponse]
+    total: int
+
+
 class PromptForm(BaseModel):
+
     command: str
     name: str  # Changed from title
     content: str
@@ -227,7 +239,109 @@ def get_prompts_by_user_id(
             or has_access(user_id, permission, prompt.access_control, user_group_ids)
         ]
 
+    def search_prompts(
+        self,
+        user_id: str,
+        filter: dict = {},
+        skip: int = 0,
+        limit: int = 30,
+        db: Optional[Session] = None,
+    ) -> PromptListResponse:
+        with get_db_context(db) as db:
+            from open_webui.models.users import User, UserModel
+
+            # Join with User table for user filtering and sorting
+            query = db.query(Prompt, User).outerjoin(User, User.id == Prompt.user_id)
+            query = query.filter(Prompt.is_active == True)
+
+            if filter:
+                query_key = filter.get("query")
+                if query_key:
+                    query = query.filter(
+                        or_(
+                            Prompt.name.ilike(f"%{query_key}%"),
+                            Prompt.command.ilike(f"%{query_key}%"),
+                            Prompt.content.ilike(f"%{query_key}%"),
+                            User.name.ilike(f"%{query_key}%"),
+                            User.email.ilike(f"%{query_key}%"),
+                        )
+                    )
+
+                view_option = filter.get("view_option")
+                if view_option == "created":
+                    query = query.filter(Prompt.user_id == user_id)
+                elif view_option == "shared":
+                    query = query.filter(Prompt.user_id != user_id)
+
+                # Apply access control filtering
+                group_ids = filter.get("group_ids", [])
+                filter_user_id = filter.get("user_id")
+
+                if filter_user_id:
+                    # User must have access: owner OR public OR explicit access
+                    access_conditions = [
+                        Prompt.user_id == filter_user_id,  # Owner
+                        Prompt.access_control == None,  # Public
+                    ]
+                    query = query.filter(or_(*access_conditions))
+
+                tag = filter.get("tag")
+                if tag:
+                    # Search for tag in JSON array field
+                    like_pattern = f'%"{tag.lower()}"%'
+                    tags_text = func.lower(cast(Prompt.tags, String))
+                    query = query.filter(tags_text.like(like_pattern))
+
+                order_by = filter.get("order_by")
+                direction = filter.get("direction")
+
+                if order_by == "name":
+                    if direction == "asc":
+                        query = query.order_by(Prompt.name.asc())
+                    else:
+                        query = query.order_by(Prompt.name.desc())
+                elif order_by == "created_at":
+                    if direction == "asc":
+                        query = query.order_by(Prompt.created_at.asc())
+                    else:
+                        query = query.order_by(Prompt.created_at.desc())
+                elif order_by == "updated_at":
+                    if direction == "asc":
+                        query = query.order_by(Prompt.updated_at.asc())
+                    else:
+                        query = query.order_by(Prompt.updated_at.desc())
+                else:
+                    query = query.order_by(Prompt.updated_at.desc())
+            else:
+                query = query.order_by(Prompt.updated_at.desc())
+
+            # Count BEFORE pagination
+            total = query.count()
+
+            if skip:
+                query = query.offset(skip)
+            if limit:
+                query = query.limit(limit)
+
+            items = query.all()
+
+            prompts = []
+            for prompt, user in items:
+                prompts.append(
+                    PromptUserResponse(
+                        **PromptModel.model_validate(prompt).model_dump(),
+                        user=(
+                            UserResponse(**UserModel.model_validate(user).model_dump())
+                            if user
+                            else None
+                        ),
+                    )
+                )
+
+            return PromptListResponse(items=prompts, total=total)
+
     def update_prompt_by_command(
+
         self,
         command: str,
         form_data: PromptForm,

backend/open_webui/routers/images.py

@@ -16,6 +16,7 @@
 
 from open_webui.config import CACHE_DIR
 from open_webui.constants import ERROR_MESSAGES
+from open_webui.retrieval.web.utils import validate_url
 from open_webui.env import ENABLE_FORWARD_USER_INFO_HEADERS
 
 from open_webui.models.chats import Chats
@@ -881,6 +882,8 @@ async def load_url_image(data):
                 return data
 
             if data.startswith("http://") or data.startswith("https://"):
+                # Validate URL to prevent SSRF attacks against local/private networks
+                validate_url(data)
                 r = await asyncio.to_thread(requests.get, data)
                 r.raise_for_status()
 
@@ -910,7 +913,8 @@ async def load_url_image(data):
         if isinstance(form_data.image, str):
             form_data.image = await load_url_image(form_data.image)
         elif isinstance(form_data.image, list):
-            form_data.image = [await load_url_image(img) for img in form_data.image]
+            # Load all images in parallel for better performance
+            form_data.image = list(await asyncio.gather(*[load_url_image(img) for img in form_data.image]))
     except Exception as e:
         raise HTTPException(status_code=400, detail=ERROR_MESSAGES.DEFAULT(e))
 

backend/open_webui/routers/prompts.py

@@ -5,9 +5,11 @@
     PromptForm,
     PromptUserResponse,
     PromptAccessResponse,
+    PromptAccessListResponse,
     PromptModel,
     Prompts,
 )
+from open_webui.models.groups import Groups
 from open_webui.models.prompt_history import (
     PromptHistories,
     PromptHistoryModel,
@@ -34,6 +36,8 @@ class PromptMetadataForm(BaseModel):
 
 router = APIRouter()
 
+PAGE_ITEM_COUNT = 30
+
 
 ############################
 # GetPrompts
@@ -67,26 +71,57 @@ async def get_prompt_tags(
         return sorted(list(tags))
 
 
-@router.get("/list", response_model=list[PromptAccessResponse])
+@router.get("/list", response_model=PromptAccessListResponse)
 async def get_prompt_list(
-    user=Depends(get_verified_user), db: Session = Depends(get_session)
+    query: Optional[str] = None,
+    view_option: Optional[str] = None,
+    tag: Optional[str] = None,
+    order_by: Optional[str] = None,
+    direction: Optional[str] = None,
+    page: Optional[int] = 1,
+    user=Depends(get_verified_user),
+    db: Session = Depends(get_session),
 ):
-    if user.role == "admin" and BYPASS_ADMIN_ACCESS_CONTROL:
-        prompts = Prompts.get_prompts(db=db)
-    else:
-        prompts = Prompts.get_prompts_by_user_id(user.id, "read", db=db)
-
-    return [
-        PromptAccessResponse(
-            **prompt.model_dump(),
-            write_access=(
-                (user.role == "admin" and BYPASS_ADMIN_ACCESS_CONTROL)
-                or user.id == prompt.user_id
-                or has_access(user.id, "write", prompt.access_control, db=db)
-            ),
-        )
-        for prompt in prompts
-    ]
+    limit = PAGE_ITEM_COUNT
+
+    page = max(1, page)
+    skip = (page - 1) * limit
+
+    filter = {}
+    if query:
+        filter["query"] = query
+    if view_option:
+        filter["view_option"] = view_option
+    if tag:
+        filter["tag"] = tag
+    if order_by:
+        filter["order_by"] = order_by
+    if direction:
+        filter["direction"] = direction
+
+    if not (user.role == "admin" and BYPASS_ADMIN_ACCESS_CONTROL):
+        groups = Groups.get_groups_by_member_id(user.id, db=db)
+        if groups:
+            filter["group_ids"] = [group.id for group in groups]
+
+        filter["user_id"] = user.id
+
+    result = Prompts.search_prompts(user.id, filter=filter, skip=skip, limit=limit, db=db)
+
+    return PromptAccessListResponse(
+        items=[
+            PromptAccessResponse(
+                **prompt.model_dump(),
+                write_access=(
+                    (user.role == "admin" and BYPASS_ADMIN_ACCESS_CONTROL)
+                    or user.id == prompt.user_id
+                    or has_access(user.id, "write", prompt.access_control, db=db)
+                ),
+            )
+            for prompt in result.items
+        ],
+        total=result.total,
+    )
 
 
 ############################

backend/open_webui/tools/builtin.py

@@ -36,6 +36,7 @@
 from open_webui.models.channels import Channels, ChannelMember, Channel
 from open_webui.models.messages import Messages, Message
 from open_webui.models.groups import Groups
+from open_webui.utils.sanitize import strip_markdown_code_fences
 
 log = logging.getLogger(__name__)
 
@@ -370,6 +371,9 @@ async def execute_code(
         return json.dumps({"error": "Request context not available"})
 
     try:
+        # Strip markdown fences if model included them
+        code = strip_markdown_code_fences(code)
+
         # Import blocked modules from config (same as middleware)
         from open_webui.config import CODE_INTERPRETER_BLOCKED_MODULES
 

backend/open_webui/utils/files.py

@@ -18,6 +18,7 @@
 from open_webui.models.chats import Chats
 from open_webui.models.files import Files
 from open_webui.routers.files import upload_file_handler
+from open_webui.retrieval.web.utils import validate_url
 
 import mimetypes
 import base64
@@ -33,6 +34,8 @@
 def get_image_base64_from_url(url: str) -> Optional[str]:
     try:
         if url.startswith("http"):
+            # Validate URL to prevent SSRF attacks against local/private networks
+            validate_url(url)
             # Download the image from the URL
             response = requests.get(url)
             response.raise_for_status()

src/lib/apis/prompts/index.ts

@@ -136,7 +136,67 @@ export const getPromptTags = async (token: string = '') => {
 	return res;
 };
 
+export const getPromptItems = async (
+	token: string = '',
+	query: string | null,
+	viewOption: string | null,
+	selectedTag: string | null,
+	orderBy: string | null,
+	direction: string | null,
+	page: number
+) => {
+	let error = null;
+
+	const searchParams = new URLSearchParams();
+	if (query) {
+		searchParams.append('query', query);
+	}
+	if (viewOption) {
+		searchParams.append('view_option', viewOption);
+	}
+	if (selectedTag) {
+		searchParams.append('tag', selectedTag);
+	}
+	if (orderBy) {
+		searchParams.append('order_by', orderBy);
+	}
+	if (direction) {
+		searchParams.append('direction', direction);
+	}
+	if (page) {
+		searchParams.append('page', page.toString());
+	}
+
+	const res = await fetch(`${WEBUI_API_BASE_URL}/prompts/list?${searchParams.toString()}`, {
+		method: 'GET',
+		headers: {
+			Accept: 'application/json',
+			'Content-Type': 'application/json',
+			authorization: `Bearer ${token}`
+		}
+	})
+		.then(async (res) => {
+			if (!res.ok) throw await res.json();
+			return res.json();
+		})
+		.then((json) => {
+			return json;
+		})
+		.catch((err) => {
+			error = err;
+			console.error(err);
+			return null;
+		});
+
+	if (error) {
+		throw error;
+	}
+
+	return res;
+};
+
 export const getPromptList = async (token: string = '') => {
+
 	let error = null;
 
 	const res = await fetch(`${WEBUI_API_BASE_URL}/prompts/list`, {