diff --git a/backend/open_webui/apps/webui/routers/chats.py b/backend/open_webui/apps/webui/routers/chats.py index 5beea549e..db95337d5 100644 --- a/backend/open_webui/apps/webui/routers/chats.py +++ b/backend/open_webui/apps/webui/routers/chats.py @@ -17,7 +17,10 @@ from open_webui.constants import ERROR_MESSAGES from open_webui.env import SRC_LOG_LEVELS from fastapi import APIRouter, Depends, HTTPException, Request, status from pydantic import BaseModel + + from open_webui.utils.utils import get_admin_user, get_verified_user +from open_webui.utils.access_control import has_permission log = logging.getLogger(__name__) log.setLevel(SRC_LOG_LEVELS["MODELS"]) @@ -50,9 +53,10 @@ async def get_session_user_chat_list( @router.delete("/", response_model=bool) async def delete_all_user_chats(request: Request, user=Depends(get_verified_user)): - if user.role == "user" and not request.app.state.config.USER_PERMISSIONS.get( - "chat", {} - ).get("delete", {}): + + if user.role == "user" and not has_permission( + user.id, "chat.delete", request.app.state.config.USER_PERMISSIONS + ): raise HTTPException( status_code=status.HTTP_401_UNAUTHORIZED, detail=ERROR_MESSAGES.ACCESS_PROHIBITED, @@ -385,8 +389,8 @@ async def delete_chat_by_id(request: Request, id: str, user=Depends(get_verified return result else: - if not request.app.state.config.USER_PERMISSIONS.get("chat", {}).get( - "delete", {} + if not has_permission( + user.id, "chat.delete", request.app.state.config.USER_PERMISSIONS ): raise HTTPException( status_code=status.HTTP_401_UNAUTHORIZED, diff --git a/src/lib/components/admin/Settings/Users.svelte b/src/lib/components/admin/Settings/Users.svelte deleted file mode 100644 index a0ec10780..000000000 --- a/src/lib/components/admin/Settings/Users.svelte +++ /dev/null @@ -1,214 +0,0 @@ - - -
{ - // console.log('submit'); - - await setDefaultModels(localStorage.token, defaultModelId); - await updateUserDefaultPermissions(localStorage.token, { - chat: { - deletion: chatDeletion, - editing: chatEdit, - temporary: chatTemporary - } - }); - await updateModelFilterConfig(localStorage.token, whitelistEnabled, whitelistModels); - saveHandler(); - - await config.set(await getBackendConfig()); - }} -> -
-
-
{$i18n.t('User Permissions')}
- -
-
{$i18n.t('Allow Chat Deletion')}
- - -
- -
-
{$i18n.t('Allow Chat Editing')}
- - -
- -
-
{$i18n.t('Allow Temporary Chat')}
- - -
-
- - -
- -
- -
-
diff --git a/src/lib/components/chat/MessageInput.svelte b/src/lib/components/chat/MessageInput.svelte index eb50bdedf..8e45d6b5e 100644 --- a/src/lib/components/chat/MessageInput.svelte +++ b/src/lib/components/chat/MessageInput.svelte @@ -92,6 +92,11 @@ }; const uploadFileHandler = async (file) => { + if (!($user?.permissions?.chat?.file_upload ?? true)) { + toast.error($i18n.t('You do not have permission to upload files.')); + return null; + } + console.log(file); const tempItemId = uuidv4(); diff --git a/src/lib/components/chat/Messages/ResponseMessage.svelte b/src/lib/components/chat/Messages/ResponseMessage.svelte index ed6628d52..29a6eeecd 100644 --- a/src/lib/components/chat/Messages/ResponseMessage.svelte +++ b/src/lib/components/chat/Messages/ResponseMessage.svelte @@ -729,7 +729,7 @@ {#if message.done} {#if !readOnly} - {#if $user.role === 'user' ? ($config?.permissions?.chat?.editing ?? true) : true} + {#if $user.role === 'user' ? ($user?.permissions?.chat?.edit ?? true) : true}