From 50413f34824ea49d5b94d3a97f3fe4bb2e881e38 Mon Sep 17 00:00:00 2001 From: Timothy Jaeryang Baek Date: Mon, 31 Aug 2026 10:47:49 -0400 Subject: [PATCH] refac --- backend/open_webui/routers/images.py | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/backend/open_webui/routers/images.py b/backend/open_webui/routers/images.py index 51570000c5..f08705546b 100644 --- a/backend/open_webui/routers/images.py +++ b/backend/open_webui/routers/images.py @@ -918,6 +918,14 @@ async def image_edits( return data if data.startswith('http://') or data.startswith('https://'): + parsed = urlparse(data) + if ( + parsed.netloc == urlparse(str(request.base_url)).netloc + and parsed.path.startswith('/api/v1/files/') + and '/content' in parsed.path + ): + return await load_url_image(parsed.path) + # Validate URL to prevent SSRF attacks against local/private networks. # allow_redirects=False prevents redirect-based SSRF: validate_url() is # called only on the originally-submitted URL; following 3xx redirects