Algorithm5838
diff --git a/‎CHANGELOG.md‎
Lines changed: 98 additions & 0 deletions b/‎CHANGELOG.md‎
Lines changed: 98 additions & 0 deletions
diff --git a/‎backend/open_webui/__init__.py‎
Lines changed: 7 additions & 0 deletions b/‎backend/open_webui/__init__.py‎
Lines changed: 7 additions & 0 deletions
diff --git a/‎backend/open_webui/config.py‎
Lines changed: 62 additions & 5 deletions b/‎backend/open_webui/config.py‎
Lines changed: 62 additions & 5 deletions
diff --git a/‎backend/open_webui/env.py‎
Lines changed: 23 additions & 11 deletions b/‎backend/open_webui/env.py‎
Lines changed: 23 additions & 11 deletions
diff --git a/‎backend/open_webui/functions.py‎
Lines changed: 1 addition & 1 deletion b/‎backend/open_webui/functions.py‎
Lines changed: 1 addition & 1 deletion
diff --git a/‎backend/open_webui/internal/db.py‎
Lines changed: 10 additions & 0 deletions b/‎backend/open_webui/internal/db.py‎
Lines changed: 10 additions & 0 deletions
@@ -1,6 +1,7 @@
 import base64
 import os
 import random
+import sys
 from pathlib import Path
 from typing import Annotated
 
@@ -68,12 +69,18 @@ def serve(
     import open_webui.main  # noqa: F401
     from open_webui.env import UVICORN_WORKERS  # Import the workers setting
 
+    # On Windows, uvicorn's default loop factory hardcodes ProactorEventLoop,
+    # which is incompatible with psycopg v3 async.  Setting loop='none' lets
+    # asyncio.run() respect the WindowsSelectorEventLoopPolicy set in db.py.
+    loop = 'none' if sys.platform == 'win32' else 'auto'
+
     uvicorn.run(
         'open_webui.main:app',
         host=host,
         port=port,
         forwarded_allow_ips='*',
         workers=UVICORN_WORKERS,
+        loop=loop,
     )
 
 
 
@@ -328,6 +328,17 @@ async def _async_persist(self, key):
         except Exception as e:
             log.error(f'Failed to async-persist config key {key}: {e}')
 
+    def _sync_to_redis(self):
+        """Push all in-memory config values to Redis, e.g. after a bulk import."""
+        if not self._redis or not ENABLE_PERSISTENT_CONFIG:
+            return
+        for key, pc in self._state.items():
+            redis_key = f'{self._redis_key_prefix}:config:{key}'
+            try:
+                self._redis.set(redis_key, json.dumps(pc.value))
+            except Exception as e:
+                log.error(f'Failed to sync config key {key} to Redis: {e}')
+
     def __getattr__(self, key):
         if key not in self._state:
             raise AttributeError(f"Config key '{key}' not found")
@@ -1197,6 +1208,12 @@ def reachable(host: str, port: int) -> bool:
     tool_server_connections,
 )
 
+OAUTH_CLIENT_TIMEOUT = PersistentConfig(
+    'OAUTH_CLIENT_TIMEOUT',
+    'oauth.client.timeout',
+    os.environ.get('OAUTH_CLIENT_TIMEOUT', ''),
+)
+
 ####################################
 # TERMINAL_SERVER
 ####################################
@@ -1299,10 +1316,16 @@ def reachable(host: str, port: int) -> bool:
     [],
 )
 
+try:
+    default_model_metadata = json.loads(os.environ.get('DEFAULT_MODEL_METADATA', '{}'))
+except Exception as e:
+    log.exception(f'Error loading DEFAULT_MODEL_METADATA: {e}')
+    default_model_metadata = {}
+
 DEFAULT_MODEL_METADATA = PersistentConfig(
     'DEFAULT_MODEL_METADATA',
     'models.default_metadata',
-    {},
+    default_model_metadata,
 )
 
 try:
@@ -1477,6 +1500,10 @@ def reachable(host: str, port: int) -> bool:
 
 USER_PERMISSIONS_CHAT_SHARE = os.environ.get('USER_PERMISSIONS_CHAT_SHARE', 'True').lower() == 'true'
 
+USER_PERMISSIONS_CHAT_ALLOW_PUBLIC_SHARING = (
+    os.environ.get('USER_PERMISSIONS_CHAT_ALLOW_PUBLIC_SHARING', 'False').lower() == 'true'
+)
+
 USER_PERMISSIONS_CHAT_EXPORT = os.environ.get('USER_PERMISSIONS_CHAT_EXPORT', 'True').lower() == 'true'
 
 USER_PERMISSIONS_CHAT_STT = os.environ.get('USER_PERMISSIONS_CHAT_STT', 'True').lower() == 'true'
@@ -1557,6 +1584,7 @@ def reachable(host: str, port: int) -> bool:
         'public_skills': USER_PERMISSIONS_WORKSPACE_SKILLS_ALLOW_PUBLIC_SHARING,
         'notes': USER_PERMISSIONS_NOTES_ALLOW_SHARING,
         'public_notes': USER_PERMISSIONS_NOTES_ALLOW_PUBLIC_SHARING,
+        'public_chats': USER_PERMISSIONS_CHAT_ALLOW_PUBLIC_SHARING,
     },
     'access_grants': {
         'allow_users': USER_PERMISSIONS_ACCESS_GRANTS_ALLOW_USERS,
@@ -2051,6 +2079,12 @@ class BannerModel(BaseModel):
     os.environ.get('VOICE_MODE_PROMPT_TEMPLATE', ''),
 )
 
+ENABLE_VOICE_MODE_PROMPT = PersistentConfig(
+    'ENABLE_VOICE_MODE_PROMPT',
+    'task.voice.prompt.enable',
+    os.environ.get('ENABLE_VOICE_MODE_PROMPT', 'True').lower() == 'true',
+)
+
 DEFAULT_VOICE_MODE_PROMPT_TEMPLATE = """You are a friendly, concise voice assistant.
 
 Everything you say will be spoken aloud.
@@ -2627,13 +2661,17 @@ class BannerModel(BaseModel):
 )
 
 
-ENABLE_ONEDRIVE_PERSONAL = os.environ.get('ENABLE_ONEDRIVE_PERSONAL', 'True').lower() == 'true'
-ENABLE_ONEDRIVE_BUSINESS = os.environ.get('ENABLE_ONEDRIVE_BUSINESS', 'True').lower() == 'true'
-
 ONEDRIVE_CLIENT_ID = os.environ.get('ONEDRIVE_CLIENT_ID', '')
 ONEDRIVE_CLIENT_ID_PERSONAL = os.environ.get('ONEDRIVE_CLIENT_ID_PERSONAL', ONEDRIVE_CLIENT_ID)
 ONEDRIVE_CLIENT_ID_BUSINESS = os.environ.get('ONEDRIVE_CLIENT_ID_BUSINESS', ONEDRIVE_CLIENT_ID)
 
+ENABLE_ONEDRIVE_PERSONAL = os.environ.get('ENABLE_ONEDRIVE_PERSONAL', 'True').lower() == 'true' and bool(
+    ONEDRIVE_CLIENT_ID_PERSONAL
+)
+ENABLE_ONEDRIVE_BUSINESS = os.environ.get('ENABLE_ONEDRIVE_BUSINESS', 'True').lower() == 'true' and bool(
+    ONEDRIVE_CLIENT_ID_BUSINESS
+)
+
 ONEDRIVE_SHAREPOINT_URL = PersistentConfig(
     'ONEDRIVE_SHAREPOINT_URL',
     'onedrive.sharepoint_url',
@@ -3252,7 +3290,7 @@ class BannerModel(BaseModel):
 WEB_SEARCH_TRUST_ENV = PersistentConfig(
     'WEB_SEARCH_TRUST_ENV',
     'rag.web.search.trust_env',
-    os.getenv('WEB_SEARCH_TRUST_ENV', 'False').lower() == 'true',
+    os.getenv('WEB_SEARCH_TRUST_ENV', 'True').lower() == 'true',
 )
 
 
@@ -3310,6 +3348,12 @@ class BannerModel(BaseModel):
     os.getenv('BRAVE_SEARCH_API_KEY', ''),
 )
 
+BRAVE_SEARCH_CONTEXT_TOKENS = PersistentConfig(
+    'BRAVE_SEARCH_CONTEXT_TOKENS',
+    'rag.web.search.brave_search_context_tokens',
+    int(os.getenv('BRAVE_SEARCH_CONTEXT_TOKENS', '8192')),
+)
+
 KAGI_SEARCH_API_KEY = PersistentConfig(
     'KAGI_SEARCH_API_KEY',
     'rag.web.search.kagi_search_api_key',
@@ -3947,6 +3991,19 @@ class BannerModel(BaseModel):
     ],
 )
 
+AUDIO_STT_ALLOWED_EXTENSIONS = PersistentConfig(
+    'AUDIO_STT_ALLOWED_EXTENSIONS',
+    'audio.stt.allowed_extensions',
+    [
+        ext.strip()
+        for ext in os.environ.get(
+            'AUDIO_STT_ALLOWED_EXTENSIONS',
+            'mp3,wav,m4a,webm,ogg,flac,mp4,mpga,mpeg',
+        ).split(',')
+        if ext.strip()
+    ],
+)
+
 AUDIO_STT_AZURE_API_KEY = PersistentConfig(
     'AUDIO_STT_AZURE_API_KEY',
     'audio.stt.azure.api_key',
 
@@ -1,21 +1,21 @@
+import datetime as dt
 import importlib.metadata
 import json
 import logging
 import os
 import pkgutil
-import sys
+import re
 import shutil
+import sys
 import traceback
-from datetime import datetime, timezone
+from pathlib import Path
 from typing import Any
 from uuid import uuid4
-from pathlib import Path
-from cryptography.hazmat.primitives import serialization
-import re
-
 
 import markdown
 from bs4 import BeautifulSoup
+from cryptography.hazmat.primitives import serialization
+
 from open_webui.constants import ERROR_MESSAGES
 
 ####################################
@@ -43,7 +43,8 @@
 
 DOCKER = os.environ.get('DOCKER', 'False').lower() == 'true'
 
-# device type embedding models - "cpu" (default), "cuda" (nvidia gpu required) or "mps" (apple silicon) - choosing this right can lead to better performance
+# device type for embedding models - "cpu" (default), "cuda" (nvidia gpu required), or "mps" (apple silicon)
+# choosing this correctly can lead to better performance
 USE_CUDA = os.environ.get('USE_CUDA_DOCKER', 'false')
 
 if USE_CUDA.lower() == 'true':
@@ -87,7 +88,7 @@ class JSONFormatter(logging.Formatter):
 
     def format(self, record: logging.LogRecord) -> str:
         log_entry: dict[str, Any] = {
-            'ts': datetime.fromtimestamp(record.created, tz=timezone.utc).isoformat(timespec='milliseconds'),
+            'ts': dt.datetime.fromtimestamp(record.created, tz=dt.UTC).isoformat(timespec='milliseconds'),
             'level': _LEVEL_MAP.get(record.levelname, record.levelname.lower()),
             'msg': record.getMessage(),
             'caller': record.name,
@@ -180,7 +181,7 @@ def parse_section(section):
 
 try:
     changelog_path = BASE_DIR / 'CHANGELOG.md'
-    with open(str(changelog_path.absolute()), 'r', encoding='utf8') as file:
+    with open(str(changelog_path.absolute()), encoding='utf8') as file:
         changelog_content = file.read()
 
 except Exception:
@@ -248,6 +249,17 @@ def parse_section(section):
 
 ENABLE_EASTER_EGGS = os.environ.get('ENABLE_EASTER_EGGS', 'True').lower() == 'true'
 
+####################################
+# ENABLE_PROFILE_IMAGE_URL_FORWARDING
+####################################
+
+# When True (default), the user and model profile-image endpoints
+# honour external http(s) URLs stored in profile_image_url by issuing a
+# 302 redirect to the original origin.  Set to False to suppress the
+# redirect (prevents client-side IP/UA/Referer leaks to attacker-
+# controlled origins) and fall through to the default image instead.
+ENABLE_PROFILE_IMAGE_URL_FORWARDING = os.environ.get('ENABLE_PROFILE_IMAGE_URL_FORWARDING', 'True').lower() == 'true'
+
 ####################################
 # WEBUI_BUILD_HASH
 ####################################
@@ -339,7 +351,7 @@ def parse_section(section):
 
 DATABASE_POOL_SIZE = os.environ.get('DATABASE_POOL_SIZE', None)
 
-if DATABASE_POOL_SIZE != None:
+if DATABASE_POOL_SIZE is not None:
     try:
         DATABASE_POOL_SIZE = int(DATABASE_POOL_SIZE)
     except Exception:
@@ -652,7 +664,7 @@ def parse_section(section):
 -----BEGIN PUBLIC KEY-----
 {LICENSE_PUBLIC_KEY}
 -----END PUBLIC KEY-----
-""".encode('utf-8')
+""".encode()
     )
 
 
 
@@ -284,7 +284,7 @@ async def get_function_params(function_module, form_data, user, extra_params=Non
         if params:
             system = params.pop('system', None)
             form_data = apply_model_params_to_body_openai(params, form_data)
-            form_data = apply_system_prompt_to_body(system, form_data, metadata, user)
+            form_data = await apply_system_prompt_to_body(system, form_data, metadata, user)
 
     pipe_id = get_pipe_id(form_data)
     function_module = await get_function_module_by_id(request, pipe_id)
 
@@ -1,4 +1,5 @@
 import os
+import sys
 import json
 import logging
 from contextlib import asynccontextmanager, contextmanager
@@ -332,6 +333,15 @@ def get_session():
 # all work without any stripping or translation.
 ASYNC_SQLALCHEMY_DATABASE_URL = _make_async_url(SQLALCHEMY_DATABASE_URL)
 
+# psycopg v3 cannot run in async mode under Windows' default
+# ProactorEventLoop — switch to SelectorEventLoop before creating
+# the async engine.  This runs at import time, which is early enough
+# to cover every entry point (workers, reload, direct invocations).
+if sys.platform == 'win32' and _is_postgres_url(DATABASE_URL):
+    import asyncio
+
+    asyncio.set_event_loop_policy(asyncio.WindowsSelectorEventLoopPolicy())
+
 if 'sqlite' in ASYNC_SQLALCHEMY_DATABASE_URL:
     # Generous default — async coroutines + no session sharing = high connection demand.
     _sqlite_pool_size = DATABASE_POOL_SIZE if isinstance(DATABASE_POOL_SIZE, int) and DATABASE_POOL_SIZE > 0 else 512