Merge pull request open-webui#23120 from open-webui/dev

0.8.12

Author: tjbck

CHANGELOG.md

@@ -5,6 +5,22 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.8.12] - 2026-03-26
+
+### Added
+
+- 🌐 **Translation updates.** Translations for Simplified Chinese, Catalan, Portuguese (Brazil), Finnish, and Lithuanian were enhanced and expanded.
+
+### Fixed
+
+- 🔒 **Terminal server connection security.** Terminal server verification and policy saving now proxy through the backend, preventing API key exposure and CORS errors when connecting to in-cluster services. [Commit](https://github.com/open-webui/open-webui/commit/a6413257079a52fa4487eda36543f3955d0fbd53), [Commit](https://github.com/open-webui/open-webui/commit/4567cdc0d9cb7b42b6eba7b676c0ced3f4850d31)
+- 🛠️ **Terminal tools exception handling.** Exceptions in middleware.py due to invalid return values from get_terminal_tools() have been resolved. [Commit](https://github.com/open-webui/open-webui/commit/52a06bd48aff34fb2211aac2879f0cd028129267)
+- 📦 **Missing beautifulsoup4 dependency.** Users can now start Open WebUI using uvx without encountering the "bs4 module missing" error. [Commit](https://github.com/open-webui/open-webui/commit/1994d65306bbcc7406584e1bfef82f5d353fc91c)
+- 🔌 **API files list error.** The /api/v1/files/ endpoint no longer returns a 500 error, fixing a regression that prevented file listing via the API. [Commit](https://github.com/open-webui/open-webui/commit/11f52921dc21c2dc61c03f12bcdf6f19140a350c)
+- 📜 **License data loading.** License data now loads correctly, displaying the expected color and logo in the interface. [Commit](https://github.com/open-webui/open-webui/commit/16335f866ea4cedf00c4971963622fcc1fe02d82)
+- 👑 **Admin model visibility.** Administrators can now see models even when no access control is configured yet, allowing them to manage all available models. [Commit](https://github.com/open-webui/open-webui/commit/f3f8f9874f55282603c2650b91801640cb3f69cb)
+- 📊 **Tool call embed visibility.** Rich UI embeds from tool calls (like visualizations) are now rendered outside collapsed groups and remain visible without requiring manual expansion. [Commit](https://github.com/open-webui/open-webui/commit/4c872a8d128757d4a6f311fb86bc382af2ba5d0d), [Commit](https://github.com/open-webui/open-webui/commit/308fa924a5b2b7e08cd1e8f15b9c8c96e1de8f02)
+
 ## [0.8.11] - 2026-03-25
 
 ### Added

backend/open_webui/models/files.py

@@ -87,7 +87,7 @@ class FileModelResponse(BaseModel):
 
     filename: str
     data: Optional[dict] = None
-    meta: FileMeta
+    meta: Optional[FileMeta] = None
 
     created_at: int  # timestamp in epoch
     updated_at: Optional[int] = None  # timestamp in epoch, optional for legacy files
@@ -246,7 +246,7 @@ def get_file_list(
             total = query.count()
 
             items = [
-                FileModel.model_validate(file)
+                FileModelResponse.model_validate(file, from_attributes=True)
                 for file in query.order_by(File.updated_at.desc(), File.id.desc()).offset(skip).limit(limit).all()
             ]
 

backend/open_webui/retrieval/utils.py

@@ -30,6 +30,7 @@
 from open_webui.models.chats import Chats
 from open_webui.models.notes import Notes
 from open_webui.models.access_grants import AccessGrants
+from open_webui.utils.access_control.files import has_access_to_file
 
 from open_webui.retrieval.vector.main import GetResult
 from open_webui.utils.headers import include_user_info_headers
@@ -1042,7 +1043,11 @@ async def get_sources_from_items(
                     }
                 elif item.get('id'):
                     file_object = Files.get_file_by_id(item.get('id'))
-                    if file_object:
+                    if file_object and (
+                        user.role == 'admin'
+                        or file_object.user_id == user.id
+                        or has_access_to_file(item.get('id'), 'read', user)
+                    ):
                         query_result = {
                             'documents': [[file_object.data.get('content', '')]],
                             'metadatas': [

backend/open_webui/routers/configs.py

@@ -269,6 +269,92 @@ async def set_terminal_servers_config(
     }
 
 
+@router.post('/terminal_servers/verify')
+async def verify_terminal_server_connection(
+    request: Request, form_data: TerminalServerConnection, user=Depends(get_admin_user)
+):
+    """
+    Verify the connection to a terminal server by detecting its type.
+
+    Tries GET {url}/api/v1/policies (orchestrator) then GET {url}/api/config
+    (plain terminal).  Returns ``{status: true, type: "orchestrator"|"terminal"}``.
+    """
+    base_url = (form_data.url or '').rstrip('/')
+    if not base_url:
+        raise HTTPException(status_code=400, detail='Terminal server URL is required')
+
+    headers = {}
+    if form_data.auth_type == 'bearer' and form_data.key:
+        headers['Authorization'] = f'Bearer {form_data.key}'
+
+    try:
+        async with aiohttp.ClientSession(
+            trust_env=True,
+            timeout=aiohttp.ClientTimeout(total=AIOHTTP_CLIENT_TIMEOUT),
+        ) as session:
+            # Orchestrators expose a policies API; plain terminals don't.
+            try:
+                async with session.get(f'{base_url}/api/v1/policies', headers=headers) as resp:
+                    if resp.ok:
+                        return {'status': True, 'type': 'orchestrator'}
+            except Exception:
+                pass
+
+            # Fall back to open-terminal config endpoint.
+            try:
+                async with session.get(f'{base_url}/api/config', headers=headers) as resp:
+                    if resp.ok:
+                        return {'status': True, 'type': 'terminal'}
+            except Exception:
+                pass
+
+    except Exception as e:
+        log.debug(f'Failed to connect to the terminal server: {e}')
+
+    raise HTTPException(status_code=400, detail='Failed to connect to the terminal server')
+
+
+class TerminalServerPolicyForm(BaseModel):
+    url: str
+    key: Optional[str] = ''
+    auth_type: Optional[str] = 'bearer'
+    policy_id: str
+    policy_data: dict
+
+
+@router.post('/terminal_servers/policy')
+async def put_terminal_server_policy(
+    request: Request, form_data: TerminalServerPolicyForm, user=Depends(get_admin_user)
+):
+    """
+    Proxy a policy PUT to an orchestrator terminal server.
+    """
+    base_url = (form_data.url or '').rstrip('/')
+    if not base_url:
+        raise HTTPException(status_code=400, detail='Terminal server URL is required')
+
+    headers = {'Content-Type': 'application/json'}
+    if form_data.auth_type == 'bearer' and form_data.key:
+        headers['Authorization'] = f'Bearer {form_data.key}'
+
+    try:
+        async with aiohttp.ClientSession(
+            trust_env=True,
+            timeout=aiohttp.ClientTimeout(total=AIOHTTP_CLIENT_TIMEOUT),
+        ) as session:
+            policy_url = f'{base_url}/api/v1/policies/{form_data.policy_id}'
+            async with session.put(policy_url, headers=headers, json=form_data.policy_data) as resp:
+                if resp.ok:
+                    return await resp.json()
+                detail = await resp.text()
+                raise HTTPException(status_code=resp.status, detail=detail)
+    except HTTPException:
+        raise
+    except Exception as e:
+        log.debug(f'Failed to save policy to terminal server: {e}')
+        raise HTTPException(status_code=400, detail='Failed to save policy to terminal server')
+
+
 @router.post('/tool_servers/verify')
 async def verify_tool_servers_config(request: Request, form_data: ToolServerConnection, user=Depends(get_admin_user)):
     """

backend/open_webui/routers/utils.py

@@ -42,6 +42,12 @@ async def format_code(form_data: CodeForm, user=Depends(get_admin_user)):
 
 @router.post('/code/execute')
 async def execute_code(request: Request, form_data: CodeForm, user=Depends(get_verified_user)):
+    if not request.app.state.config.ENABLE_CODE_EXECUTION:
+        raise HTTPException(
+            status_code=403,
+            detail='Code execution is disabled',
+        )
+
     if request.app.state.config.CODE_EXECUTION_ENGINE == 'jupyter':
         output = await execute_code_jupyter(
             request.app.state.config.CODE_EXECUTION_JUPYTER_URL,

backend/open_webui/utils/auth.py

@@ -143,8 +143,15 @@ def nt(b):
             pn, pt = nt(pb)
 
             data = json.loads(aesgcm.decrypt(pn, pt, None).decode())
-            if not data.get('exp') or data.get('exp') < datetime.now().date():
-                return False
+
+            exp = data.get('exp')
+            if exp:
+                if isinstance(exp, str):
+                    from datetime import date
+
+                    exp = date.fromisoformat(exp)
+                if exp < datetime.now().date():
+                    return False
 
             data_handler(data)
             return True

backend/open_webui/utils/middleware.py

@@ -2607,12 +2607,17 @@ async def tool_function(**kwargs):
         # so system terminals work even when no other tools are selected)
         if terminal_id:
             try:
-                terminal_tools, system_prompt = await get_terminal_tools(
+                terminal_result = await get_terminal_tools(
                     request,
                     terminal_id,
                     user,
                     extra_params,
                 )
+                if isinstance(terminal_result, tuple):
+                    terminal_tools, system_prompt = terminal_result
+                else:
+                    terminal_tools = terminal_result
+                    system_prompt = None
                 if terminal_tools:
                     tools_dict = {**tools_dict, **terminal_tools}
                 if system_prompt:

backend/open_webui/utils/models.py

@@ -452,6 +452,10 @@ def get_filtered_models(models, user, db=None):
                     or model['id'] in accessible_model_ids
                 ):
                     filtered_models.append(model)
+            elif user.role == 'admin':
+                # No DB entry means no access control configured yet;
+                # only admins can see unconfigured models.
+                filtered_models.append(model)
 
         return filtered_models
     else:

backend/open_webui/utils/tools.py

@@ -956,7 +956,7 @@ async def get_terminal_tools(
     terminal_id: str,
     user: UserModel,
     extra_params: dict,
-) -> tuple[dict[str, dict], Optional[str]]:
+) -> dict[str, dict] | tuple[dict[str, dict], Optional[str]]:
     """Resolve tools for a terminal server identified by terminal_id.
 
     - Finds the connection in TERMINAL_SERVER_CONNECTIONS