OSSForks/ollama-webui
1
0
Fork 0
mirror of https://github.com/zebrajr/ollama-webui.git synced 2025-12-05 12:20:26 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity

chore: format

Browse Source
This commit is contained in:
Timothy Jaeryang Baek 2025-10-16 11:36:26 -05:00
parent d0da1d722c
commit fd0e9652a8
2 changed files with 95 additions and 86 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
docs/SECURITY.md
View File

@ -32,18 +32,20 @@ We appreciate the community's interest in identifying potential vulnerabilities.
> [!NOTE] > [!NOTE]
> A PoC (Proof of Concept) is a **demonstration of exploitation of a vulnerability**. Your PoC must show: > A PoC (Proof of Concept) is a **demonstration of exploitation of a vulnerability**. Your PoC must show:
>
> 1. What security boundary was crossed (Confidentiality, Integrity, Availability, Authenticity, Non-repudiation) > 1. What security boundary was crossed (Confidentiality, Integrity, Availability, Authenticity, Non-repudiation)
> 2. How this vulnerability was abused > 2. How this vulnerability was abused
> 3. What actions the attacker can now perform > 3. What actions the attacker can now perform
> >
> **Examples of valid PoCs:** > **Examples of valid PoCs:**
>
> - Step-by-step reproduction instructions with exact commands > - Step-by-step reproduction instructions with exact commands
> - Complete exploit code with detailed execution instructions > - Complete exploit code with detailed execution instructions
> - Screenshots/videos demonstrating the exploit (supplementary to written steps) > - Screenshots/videos demonstrating the exploit (supplementary to written steps)
> >
> **Failure to provide a reproducible PoC may lead to closure of the report** > **Failure to provide a reproducible PoC may lead to closure of the report**
> We will notify you, if we struggle to reproduce the exploit using your PoC to allow you to improve your PoC > We will notify you, if we struggle to reproduce the exploit using your PoC to allow you to improve your PoC
> However, if we repeatedly cannot reproduce the exploit using the PoC, the report may be closed > However, if we repeatedly cannot reproduce the exploit using the PoC, the report may be closed
5. **Required Patch or Actionable Remediation Plan Submission**: Along with the PoC, reporters must provide a patch or some actionable steps to remediate the identified vulnerability. This helps us evaluate and implement fixes rapidly. 5. **Required Patch or Actionable Remediation Plan Submission**: Along with the PoC, reporters must provide a patch or some actionable steps to remediate the identified vulnerability. This helps us evaluate and implement fixes rapidly.
@ -53,17 +55,16 @@ We appreciate the community's interest in identifying potential vulnerabilities.
> [!NOTE] > [!NOTE]
> **Note**: If you believe you have found a security issue that > **Note**: If you believe you have found a security issue that
> 1) affects default configurations **or** >
> 2) represents a genuine bypass of intended security controls **or** > 1. affects default configurations **or**
> 3) works only with non-default configurations **but the configuration in question is likely to be used by production deployments** > 2. represents a genuine bypass of intended security controls **or**
> **then we absolutely want to hear about it.** This policy is intended to filter configuration issues and deployment problems, not to discourage legitimate security research. > 3. works only with non-default configurations **but the configuration in question is likely to be used by production deployments** > **then we absolutely want to hear about it.** This policy is intended to filter configuration issues and deployment problems, not to discourage legitimate security research.
8. **Threat Model Understanding Required**: Reports must demonstrate understanding of Open WebUI's self-hosted, authenticated, role-based access control architecture. Comparing Open WebUI to services with fundamentally different security models without acknowledging the architectural differences may result in report rejection. 8. **Threat Model Understanding Required**: Reports must demonstrate understanding of Open WebUI's self-hosted, authenticated, role-based access control architecture. Comparing Open WebUI to services with fundamentally different security models without acknowledging the architectural differences may result in report rejection.
9. **CVSS Scoring Accuracy:** If you include a CVSS score with your report, it must accurately reflect the vulnerability according to CVSS methodology. Common errors include 1) rating PR:N (None) when authentication is required, 2) scoring hypothetical attack chains instead of the actual vulnerability, or 3) inflating severity without evidence. **We will adjust inaccurate CVSS scores.** Intentionally inflated scores may result in report rejection. 9. **CVSS Scoring Accuracy:** If you include a CVSS score with your report, it must accurately reflect the vulnerability according to CVSS methodology. Common errors include 1) rating PR:N (None) when authentication is required, 2) scoring hypothetical attack chains instead of the actual vulnerability, or 3) inflating severity without evidence. **We will adjust inaccurate CVSS scores.** Intentionally inflated scores may result in report rejection.
> [!WARNING] > [!WARNING] > **Using CVE Precedents:** If you cite other CVEs to support your report, ensure they are **genuinely comparable** in vulnerability type, threat model, and attack vector. Citing CVEs from different product categories, different vulnerability classes or different deployment models will lead us to suspect the use of AI in your report.
> **Using CVE Precedents:** If you cite other CVEs to support your report, ensure they are **genuinely comparable** in vulnerability type, threat model, and attack vector. Citing CVEs from different product categories, different vulnerability classes or different deployment models will lead us to suspect the use of AI in your report.
11. **Admin Actions Are Out of Scope:** Vulnerabilities that require an administrator to actively perform unsafe actions are **not considered valid vulnerabilities**. Admins have full system control and are expected to understand the security implications of their actions and configurations. This includes but is not limited to: adding malicious external servers (models, tools, webhooks), pasting untrusted code into Functions/Tools, or intentionally weakening security settings. **Reports requiring admin negligence or social engineering of admins may be rejected.** 11. **Admin Actions Are Out of Scope:** Vulnerabilities that require an administrator to actively perform unsafe actions are **not considered valid vulnerabilities**. Admins have full system control and are expected to understand the security implications of their actions and configurations. This includes but is not limited to: adding malicious external servers (models, tools, webhooks), pasting untrusted code into Functions/Tools, or intentionally weakening security settings. **Reports requiring admin negligence or social engineering of admins may be rejected.**
@ -71,10 +72,12 @@ We appreciate the community's interest in identifying potential vulnerabilities.
> [!NOTE] > [!NOTE]
> AI-aided vulnerability reports **will not be rejected by us by default.** But: > AI-aided vulnerability reports **will not be rejected by us by default.** But:
>
> - If we suspect you used AI (but you did not disclose it to us), we will be asking tough follow-up questions to validate your understanding of the reported vulnerability and Open WebUI itself. > - If we suspect you used AI (but you did not disclose it to us), we will be asking tough follow-up questions to validate your understanding of the reported vulnerability and Open WebUI itself.
> - If we suspect you used AI (but you did not disclose it to us) **and** your report ends up being invalid/not a vulnerability/not reproducible, then you **may be banned** from reporting future vulnerabilities. > - If we suspect you used AI (but you did not disclose it to us) **and** your report ends up being invalid/not a vulnerability/not reproducible, then you **may be banned** from reporting future vulnerabilities.
> >
> This measure was necessary due to the extreme rise in clearly AI written vulnerability reports, where the vast majority of them > This measure was necessary due to the extreme rise in clearly AI written vulnerability reports, where the vast majority of them
>
> - were not a vulnerability > - were not a vulnerability
> - were faulty configurations rather than a real vulnerability > - were faulty configurations rather than a real vulnerability
> - did not provide a PoC > - did not provide a PoC
@ -90,6 +93,7 @@ If you want to report a vulnerability and can meet the outlined requirements, [o
## Product Security And For Non-Vulnerability Security Concerns: ## Product Security And For Non-Vulnerability Security Concerns:
If your concern does not meet the vulnerability requirements outlined above, such as: If your concern does not meet the vulnerability requirements outlined above, such as:
- Suggestions for better default configuration values - Suggestions for better default configuration values
- Security hardening recommendations - Security hardening recommendations
- Deployment best practices guidance - Deployment best practices guidance
@ -99,6 +103,7 @@ If your concern does not meet the vulnerability requirements outlined above, suc
- General security questions about production deployment - General security questions about production deployment
**then use one of the following channels instead:** **then use one of the following channels instead:**
- **Documentation issues/improvement ideas:** Open an issue on our [Documentation Repository](https://github.com/open-webui/docs) - **Documentation issues/improvement ideas:** Open an issue on our [Documentation Repository](https://github.com/open-webui/docs)
- **Feature requests:** Create a discussion in [GitHub Discussions - Ideas](https://github.com/open-webui/open-webui/discussions/) to discuss with the community if this feature request is wanted by multiple people - **Feature requests:** Create a discussion in [GitHub Discussions - Ideas](https://github.com/open-webui/open-webui/discussions/) to discuss with the community if this feature request is wanted by multiple people
- **Configuration help:** Ask the community for help and guidance on our [Discord Server](https://discord.gg/5rJgQTnV4s) or on [Reddit](https://www.reddit.com/r/OpenWebUI/) - **Configuration help:** Ask the community for help and guidance on our [Discord Server](https://discord.gg/5rJgQTnV4s) or on [Reddit](https://www.reddit.com/r/OpenWebUI/)

162
src/lib/components/admin/Settings/Documents.svelte
View File

@ -759,89 +759,93 @@
bind:value={RAGConfig.MISTRAL_OCR_API_KEY} bind:value={RAGConfig.MISTRAL_OCR_API_KEY}
/> />
</div> </div>
{:else if RAGConfig.CONTENT_EXTRACTION_ENGINE === 'mineru'} {:else if RAGConfig.CONTENT_EXTRACTION_ENGINE === 'mineru'}
<!-- API Mode Selection --> <!-- API Mode Selection -->
<div class="flex w-full mt-2">
<div class="flex-1 flex justify-between">
<div class="self-center text-xs font-medium">
{$i18n.t('API Mode')}
</div>
<select
class="dark:bg-gray-900 w-fit pr-8 rounded-sm px-2 text-xs bg-transparent outline-hidden"
bind:value={RAGConfig.MINERU_API_MODE}
on:change={() => {
// Auto-update URL when switching modes if it's empty or matches the opposite mode's default
const cloudUrl = 'https://mineru.net/api/v4';
const localUrl = 'http://localhost:8000';
if (RAGConfig.MINERU_API_MODE === 'cloud') {
if (!RAGConfig.MINERU_API_URL || RAGConfig.MINERU_API_URL === localUrl) {
RAGConfig.MINERU_API_URL = cloudUrl;
}
} else {
if (!RAGConfig.MINERU_API_URL || RAGConfig.MINERU_API_URL === cloudUrl) {
RAGConfig.MINERU_API_URL = localUrl;
}
}
}}
>
<option value="local">{$i18n.t('Self-Hosted')}</option>
<option value="cloud">{$i18n.t('minerU managed (Cloud API)')}</option>
</select>
</div>
</div>
<!-- API URL -->
<div class="flex w-full mt-2">
<input
class="flex-1 w-full text-sm bg-transparent outline-hidden"
placeholder={RAGConfig.MINERU_API_MODE === 'cloud'
? $i18n.t('https://mineru.net/api/v4')
: $i18n.t('http://localhost:8000')}
bind:value={RAGConfig.MINERU_API_URL}
/>
</div>
<!-- API Key (Cloud only) -->
{#if RAGConfig.MINERU_API_MODE === 'cloud'}
<div class="flex w-full mt-2"> <div class="flex w-full mt-2">
<SensitiveInput <div class="flex-1 flex justify-between">
placeholder={$i18n.t('Enter MinerU API Key')} <div class="self-center text-xs font-medium">
bind:value={RAGConfig.MINERU_API_KEY} {$i18n.t('API Mode')}
</div>
<select
class="dark:bg-gray-900 w-fit pr-8 rounded-sm px-2 text-xs bg-transparent outline-hidden"
bind:value={RAGConfig.MINERU_API_MODE}
on:change={() => {
// Auto-update URL when switching modes if it's empty or matches the opposite mode's default
const cloudUrl = 'https://mineru.net/api/v4';
const localUrl = 'http://localhost:8000';
if (RAGConfig.MINERU_API_MODE === 'cloud') {
if (!RAGConfig.MINERU_API_URL || RAGConfig.MINERU_API_URL === localUrl) {
RAGConfig.MINERU_API_URL = cloudUrl;
}
} else {
if (!RAGConfig.MINERU_API_URL || RAGConfig.MINERU_API_URL === cloudUrl) {
RAGConfig.MINERU_API_URL = localUrl;
}
}
}}
>
<option value="local">{$i18n.t('Self-Hosted')}</option>
<option value="cloud">{$i18n.t('minerU managed (Cloud API)')}</option>
</select>
</div>
</div>
<!-- API URL -->
<div class="flex w-full mt-2">
<input
class="flex-1 w-full text-sm bg-transparent outline-hidden"
placeholder={RAGConfig.MINERU_API_MODE === 'cloud'
? $i18n.t('https://mineru.net/api/v4')
: $i18n.t('http://localhost:8000')}
bind:value={RAGConfig.MINERU_API_URL}
/> />
</div> </div>
<!-- API Key (Cloud only) -->
{#if RAGConfig.MINERU_API_MODE === 'cloud'}
<div class="flex w-full mt-2">
<SensitiveInput
placeholder={$i18n.t('Enter MinerU API Key')}
bind:value={RAGConfig.MINERU_API_KEY}
/>
</div>
{/if}
<!-- Parameters -->
<div class="flex justify-between w-full mt-2">
<div class="self-center text-xs font-medium">
<Tooltip
content={$i18n.t(
'Advanced parameters for MinerU parsing (enable_ocr, enable_formula, enable_table, language, model_version, page_ranges)'
)}
placement="top-start"
>
{$i18n.t('Parameters')}
</Tooltip>
</div>
<div class="">
<Textarea
value={typeof RAGConfig.MINERU_PARAMS === 'object' &&
RAGConfig.MINERU_PARAMS !== null &&
Object.keys(RAGConfig.MINERU_PARAMS).length > 0
? JSON.stringify(RAGConfig.MINERU_PARAMS, null, 2)
: ''}
on:input={(e) => {
try {
const value = e.target.value.trim();
RAGConfig.MINERU_PARAMS = value ? JSON.parse(value) : {};
} catch (err) {
// Keep the string value if JSON is invalid (user is still typing)
RAGConfig.MINERU_PARAMS = e.target.value;
}
}}
placeholder={`{\n "enable_ocr": false,\n "enable_formula": true,\n "enable_table": true,\n "language": "en",\n "model_version": "pipeline",\n "page_ranges": ""\n}`}
minSize={100}
/>
</div>
</div>
{/if} {/if}
<!-- Parameters -->
<div class="flex justify-between w-full mt-2">
<div class="self-center text-xs font-medium">
<Tooltip
content={$i18n.t('Advanced parameters for MinerU parsing (enable_ocr, enable_formula, enable_table, language, model_version, page_ranges)')}
placement="top-start"
>
{$i18n.t('Parameters')}
</Tooltip>
</div>
<div class="">
<Textarea
value={typeof RAGConfig.MINERU_PARAMS === 'object' && RAGConfig.MINERU_PARAMS !== null && Object.keys(RAGConfig.MINERU_PARAMS).length > 0
? JSON.stringify(RAGConfig.MINERU_PARAMS, null, 2)
: ''}
on:input={(e) => {
try {
const value = e.target.value.trim();
RAGConfig.MINERU_PARAMS = value ? JSON.parse(value) : {};
} catch (err) {
// Keep the string value if JSON is invalid (user is still typing)
RAGConfig.MINERU_PARAMS = e.target.value;
}
}}
placeholder={`{\n "enable_ocr": false,\n "enable_formula": true,\n "enable_table": true,\n "language": "en",\n "model_version": "pipeline",\n "page_ranges": ""\n}`}
minSize={100}
/>
</div>
</div>
{/if}
</div> </div>
<div class=" mb-2.5 flex w-full justify-between"> <div class=" mb-2.5 flex w-full justify-between">