From 059327cd19fbc3a931432b91520610ad5bb4009e Mon Sep 17 00:00:00 2001
From: Dave <davixk83@gmail.com>
Date: Wed, 4 Jun 2025 06:27:25 +0200
Subject: [PATCH 1/5] refac: update .gitattributes and .prettierrc for
 consistent line endings

---
 .gitattributes | 50 +++++++++++++++++++++++++++++++++++++++++++++++++-
 .prettierrc    |  3 ++-
 2 files changed, 51 insertions(+), 2 deletions(-)

diff --git a/.gitattributes b/.gitattributes
index 526c8a38d..9a5dc81db 100644
--- a/.gitattributes
+++ b/.gitattributes
@@ -1 +1,49 @@
-*.sh text eol=lf
\ No newline at end of file
+# TypeScript
+*.ts     text eol=lf
+*.tsx    text eol=lf
+
+# JavaScript
+*.js     text eol=lf
+*.jsx    text eol=lf
+*.mjs    text eol=lf
+*.cjs    text eol=lf
+
+# Svelte
+*.svelte text eol=lf
+
+# HTML/CSS
+*.html   text eol=lf
+*.css    text eol=lf
+*.scss   text eol=lf
+*.less   text eol=lf
+
+# Config files and JSON
+*.json   text eol=lf
+*.jsonc  text eol=lf
+*.yml    text eol=lf
+*.yaml   text eol=lf
+*.toml   text eol=lf
+
+# Shell scripts
+*.sh     text eol=lf
+
+# Markdown & docs
+*.md     text eol=lf
+*.mdx    text eol=lf
+*.txt    text eol=lf
+
+# Git-related
+.gitattributes text eol=lf
+.gitignore     text eol=lf
+
+# Prettier and other dotfiles
+.prettierrc     text eol=lf
+.prettierignore text eol=lf
+.eslintrc       text eol=lf
+.eslintignore   text eol=lf
+.stylelintrc    text eol=lf
+.editorconfig   text eol=lf
+
+# Misc
+*.env     text eol=lf
+*.lock    text eol=lf
\ No newline at end of file
diff --git a/.prettierrc b/.prettierrc
index a77fddea9..22558729f 100644
--- a/.prettierrc
+++ b/.prettierrc
@@ -5,5 +5,6 @@
 	"printWidth": 100,
 	"plugins": ["prettier-plugin-svelte"],
 	"pluginSearchDirs": ["."],
-	"overrides": [{ "files": "*.svelte", "options": { "parser": "svelte" } }]
+	"overrides": [{ "files": "*.svelte", "options": { "parser": "svelte" } }],
+	"endOfLine": "lf"
 }

From 5fb5daf07fc86cf6809d5edc54089daa61f7fe9d Mon Sep 17 00:00:00 2001
From: Dave <davixk83@gmail.com>
Date: Wed, 4 Jun 2025 06:32:06 +0200
Subject: [PATCH 2/5] refac: standardize formatting in .gitattributes for
 consistency

---
 .gitattributes | 54 +++++++++++++++++++++++++-------------------------
 1 file changed, 27 insertions(+), 27 deletions(-)

diff --git a/.gitattributes b/.gitattributes
index 9a5dc81db..bf368a4c6 100644
--- a/.gitattributes
+++ b/.gitattributes
@@ -1,49 +1,49 @@
 # TypeScript
-*.ts     text eol=lf
-*.tsx    text eol=lf
+*.ts text eol=lf
+*.tsx text eol=lf
 
 # JavaScript
-*.js     text eol=lf
-*.jsx    text eol=lf
-*.mjs    text eol=lf
-*.cjs    text eol=lf
+*.js text eol=lf
+*.jsx text eol=lf
+*.mjs text eol=lf
+*.cjs text eol=lf
 
 # Svelte
 *.svelte text eol=lf
 
 # HTML/CSS
-*.html   text eol=lf
-*.css    text eol=lf
-*.scss   text eol=lf
-*.less   text eol=lf
+*.html text eol=lf
+*.css text eol=lf
+*.scss text eol=lf
+*.less text eol=lf
 
 # Config files and JSON
-*.json   text eol=lf
-*.jsonc  text eol=lf
-*.yml    text eol=lf
-*.yaml   text eol=lf
-*.toml   text eol=lf
+*.json text eol=lf
+*.jsonc text eol=lf
+*.yml text eol=lf
+*.yaml text eol=lf
+*.toml text eol=lf
 
 # Shell scripts
-*.sh     text eol=lf
+*.sh text eol=lf
 
 # Markdown & docs
-*.md     text eol=lf
-*.mdx    text eol=lf
-*.txt    text eol=lf
+*.md text eol=lf
+*.mdx text eol=lf
+*.txt text eol=lf
 
 # Git-related
 .gitattributes text eol=lf
-.gitignore     text eol=lf
+.gitignore text eol=lf
 
 # Prettier and other dotfiles
-.prettierrc     text eol=lf
+.prettierrc text eol=lf
 .prettierignore text eol=lf
-.eslintrc       text eol=lf
-.eslintignore   text eol=lf
-.stylelintrc    text eol=lf
-.editorconfig   text eol=lf
+.eslintrc text eol=lf
+.eslintignore text eol=lf
+.stylelintrc text eol=lf
+.editorconfig text eol=lf
 
 # Misc
-*.env     text eol=lf
-*.lock    text eol=lf
\ No newline at end of file
+*.env text eol=lf
+*.lock text eol=lf
\ No newline at end of file

From 9964ad0a5b4243d752709f6efb9da7703e43206c Mon Sep 17 00:00:00 2001
From: Timothy Jaeryang Baek <tim@openwebui.com>
Date: Wed, 4 Jun 2025 15:21:08 +0400
Subject: [PATCH 3/5] refac: auth cache dir

Co-Authored-By: Rodrigo Agundez <rragundez@users.noreply.github.com>
---
 backend/open_webui/main.py | 17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)

diff --git a/backend/open_webui/main.py b/backend/open_webui/main.py
index a75aebb32..8527081e8 100644
--- a/backend/open_webui/main.py
+++ b/backend/open_webui/main.py
@@ -37,7 +37,7 @@ from fastapi import (
 from fastapi.openapi.docs import get_swagger_ui_html
 
 from fastapi.middleware.cors import CORSMiddleware
-from fastapi.responses import JSONResponse, RedirectResponse
+from fastapi.responses import FileResponse, JSONResponse, RedirectResponse
 from fastapi.staticfiles import StaticFiles
 
 from starlette_compress import CompressMiddleware
@@ -1634,7 +1634,20 @@ async def healthcheck_with_db():
 
 
 app.mount("/static", StaticFiles(directory=STATIC_DIR), name="static")
-app.mount("/cache", StaticFiles(directory=CACHE_DIR), name="cache")
+
+
+@app.get("/cache/{path:path}")
+async def serve_cache_file(
+    path: str,
+    user=Depends(get_verified_user),
+):
+    file_path = os.path.abspath(os.path.join(CACHE_DIR, path))
+    # prevent path traversal
+    if not file_path.startswith(os.path.abspath(CACHE_DIR)):
+        raise HTTPException(status_code=404, detail="File not found")
+    if not os.path.isfile(file_path):
+        raise HTTPException(status_code=404, detail="File not found")
+    return FileResponse(file_path)
 
 
 def swagger_ui_html(*args, **kwargs):

From 91e826cc27e673cfd1586b3aa4bdd2b1724b5153 Mon Sep 17 00:00:00 2001
From: Timothy Jaeryang Baek <tim@openwebui.com>
Date: Wed, 4 Jun 2025 15:43:23 +0400
Subject: [PATCH 4/5] refac

---
 src/lib/components/chat/Messages/Markdown/HTMLToken.svelte | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/lib/components/chat/Messages/Markdown/HTMLToken.svelte b/src/lib/components/chat/Messages/Markdown/HTMLToken.svelte
index 8e12f4bf0..299619d8f 100644
--- a/src/lib/components/chat/Messages/Markdown/HTMLToken.svelte
+++ b/src/lib/components/chat/Messages/Markdown/HTMLToken.svelte
@@ -28,7 +28,7 @@
 			<!-- svelte-ignore a11y-media-has-caption -->
 			<video
 				class="w-full my-2"
-				src={videoSrc}
+				src={videoSrc.replaceAll('&amp;', '&')}
 				title="Video player"
 				frameborder="0"
 				referrerpolicy="strict-origin-when-cross-origin"

From bbafeca4957298ea25064fcefc4f2ee73f8ce87e Mon Sep 17 00:00:00 2001
From: Timothy Jaeryang Baek <tim@openwebui.com>
Date: Wed, 4 Jun 2025 15:53:07 +0400
Subject: [PATCH 5/5] refac: reserved `__user__` param format

---
 backend/open_webui/functions.py        |  8 ++------
 backend/open_webui/utils/chat.py       | 14 ++------------
 backend/open_webui/utils/middleware.py | 14 ++------------
 3 files changed, 6 insertions(+), 30 deletions(-)

diff --git a/backend/open_webui/functions.py b/backend/open_webui/functions.py
index 20fabb2dc..6eb5c1bbd 100644
--- a/backend/open_webui/functions.py
+++ b/backend/open_webui/functions.py
@@ -25,6 +25,7 @@ from open_webui.socket.main import (
 )
 
 
+from open_webui.models.users import UserModel
 from open_webui.models.functions import Functions
 from open_webui.models.models import Models
 
@@ -227,12 +228,7 @@ async def generate_function_chat_completion(
         "__task__": __task__,
         "__task_body__": __task_body__,
         "__files__": files,
-        "__user__": {
-            "id": user.id,
-            "email": user.email,
-            "name": user.name,
-            "role": user.role,
-        },
+        "__user__": user.model_dump() if isinstance(user, UserModel) else {},
         "__metadata__": metadata,
         "__request__": request,
     }
diff --git a/backend/open_webui/utils/chat.py b/backend/open_webui/utils/chat.py
index 4bd744e3c..268c910e3 100644
--- a/backend/open_webui/utils/chat.py
+++ b/backend/open_webui/utils/chat.py
@@ -320,12 +320,7 @@ async def chat_completed(request: Request, form_data: dict, user: Any):
     extra_params = {
         "__event_emitter__": get_event_emitter(metadata),
         "__event_call__": get_event_call(metadata),
-        "__user__": {
-            "id": user.id,
-            "email": user.email,
-            "name": user.name,
-            "role": user.role,
-        },
+        "__user__": user.model_dump() if isinstance(user, UserModel) else {},
         "__metadata__": metadata,
         "__request__": request,
         "__model__": model,
@@ -424,12 +419,7 @@ async def chat_action(request: Request, action_id: str, form_data: dict, user: A
                     params[key] = value
 
             if "__user__" in sig.parameters:
-                __user__ = {
-                    "id": user.id,
-                    "email": user.email,
-                    "name": user.name,
-                    "role": user.role,
-                }
+                __user__ = (user.model_dump() if isinstance(user, UserModel) else {},)
 
                 try:
                     if hasattr(function_module, "UserValves"):
diff --git a/backend/open_webui/utils/middleware.py b/backend/open_webui/utils/middleware.py
index 21659ea27..6510d7c99 100644
--- a/backend/open_webui/utils/middleware.py
+++ b/backend/open_webui/utils/middleware.py
@@ -727,12 +727,7 @@ async def process_chat_payload(request, form_data, user, metadata, model):
     extra_params = {
         "__event_emitter__": event_emitter,
         "__event_call__": event_call,
-        "__user__": {
-            "id": user.id,
-            "email": user.email,
-            "name": user.name,
-            "role": user.role,
-        },
+        "__user__": user.model_dump() if isinstance(user, UserModel) else {},
         "__metadata__": metadata,
         "__request__": request,
         "__model__": model,
@@ -1327,12 +1322,7 @@ async def process_chat_response(
     extra_params = {
         "__event_emitter__": event_emitter,
         "__event_call__": event_caller,
-        "__user__": {
-            "id": user.id,
-            "email": user.email,
-            "name": user.name,
-            "role": user.role,
-        },
+        "__user__": user.model_dump() if isinstance(user, UserModel) else {},
         "__metadata__": metadata,
         "__request__": request,
         "__model__": model,