- Catch NotImplementedError as the primary fallback since os.access(..., effective_ids=True) is not implemented on Windows
- Also catch AttributeError, OSError, and TypeError as supplementary guards
- Prevents crashes when checking file writability on Windows platforms, primarily fixing directory listing operations (/files/list, stat, listdir)
Fixes#174
The result of a command now includes the folder it ran in. Open WebUI used to put the terminal's current folder into the instructions the model gets for running commands, which threw away the provider's prompt cache for the whole chat whenever the folder changed. With the folder in each result, Open WebUI can drop it from those instructions and the model still knows where it is.
The Open WebUI security policy now lives on the documentation site, and the old file in the Open WebUI repository only points there. The link here goes straight to the docs page so reporters land on the full policy in one click. The last-updated date is refreshed.
The MCP server now gates its HTTP transports with a token verifier that
requires the connecting client to present the API key, compared with
hmac.compare_digest to match the FastAPI layer. The stdio transport is
local and does not pass through the HTTP auth layer, so it keeps working
unchanged. Raises the fastmcp floor to >=4.0.0, where the auth API used
here is available.
* docs: add security policy and correct multi-user mode wording
The README promised that files, commands and terminals are isolated between users in multi-user mode. A single shared container cannot hold that promise: everyone shares one kernel, one process list, one network stack and one temp directory, and provisioning per-user accounts requires elevated privileges inside that container. The wording now says what the mode actually gives you, which is a separate workspace per user so people and their agents do not walk over each other's files, and it points at Terminals for deployments where users have to be protected from each other.
The new SECURITY.md adopts the Open WebUI security policy wherever it is semantically applicable, names this repository as the reporting channel, and writes down what is designed behaviour here: the API key is a full-access credential, X-User-Id is asserted by the caller, the latest image gives its user passwordless sudo, and bare metal runs as your own user. It also states what remains in scope, so that reports crossing out of the instance still get the attention they deserve.
* docs: point per-user isolation at Terminals and its enterprise license
The pointer to Terminals now says what it actually gives you, a separate container per user with its own files, processes, limits and network boundary, and states that production use needs an Open WebUI Enterprise License, with the deployment and licensing docs linked. The same note is added where the security policy sends people to Terminals.
* docs: link the enterprise license to the docs page
FastMCP.from_fastapi() uses an internal httpx client to call the
FastAPI routes. Without auth headers, every tool call (run_command,
read_file, etc.) hits the verify_api_key guard and returns 401.
Fixes tool calls returning: 'HTTP error 401: Unauthorized - Invalid API key'
All LLM-exposed file endpoints (list_files, read_file, write_file,
display_file, replace_file_content, grep_search, glob_search) now
read the X-Session-Id header and resolve relative paths against the
session's working directory instead of always using fs.home.
- Added optional cwd parameter to UserFS.resolve_path()
- Relative paths join against cwd if provided, else fs.home
- Absolute paths are unaffected
- execute endpoint also resolves relative cwd param against session cwd
Timothy Jaeryang Baek
Alan Chow
Classic298
hussein
EntropyYue