Skip to content

fix: restrict user file access to current user only #5177

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Aug 10, 2025
Merged

fix: restrict user file access to current user only #5177

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
73180d1
fix: restrict user file access to current user only
Subash-Mohan Aug 9, 2025
e5241b5
fix: enhance user file access control for recent folder
Subash-Mohan Aug 10, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 14 additions & 5 deletions backend/onyx/file_store/utils.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,8 @@

logger = setup_logger()

RECENT_FOLDER_ID = -1


def user_file_id_to_plaintext_file_name(user_file_id: int) -> str:
"""Generate a consistent file name for storing plaintext content of a user file."""
Expand Down Expand Up @@ -244,14 +246,21 @@ def get_user_files_as_user(
Fetches all UserFile database records for a given user.
"""
user_files = get_user_files(user_file_ids, user_folder_ids, db_session)
current_user_files = []
for user_file in user_files:
# Note: if user_id is None, then all files should be None as well
# (since auth must be disabled in this case)
Comment on lines 251 to 252
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

logic: The comment about user_id being None when auth is disabled suggests this function handles both authenticated and unauthenticated scenarios, but the filtering logic doesn't account for this properly - it would filter out all files when user_id is None.

Suggested change
# Note: if user_id is None, then all files should be None as well
# (since auth must be disabled in this case)
current_user_files = []
for user_file in user_files:
# Note: if user_id is None, then all files should be None as well
# (since auth must be disabled in this case)
if user_file.user_id == user_id:
current_user_files.append(user_file)
return current_user_files

if user_file.user_id != user_id:
raise ValueError(
f"User {user_id} does not have access to file {user_file.id}"
)
return user_files
if user_file.folder_id == RECENT_FOLDER_ID:
if user_file.user_id == user_id:
current_user_files.append(user_file)
else:
if user_file.user_id != user_id:
raise ValueError(
f"User {user_id} does not have access to file {user_file.id}"
)
current_user_files.append(user_file)

return current_user_files


def save_file_from_url(url: str) -> str:
Expand Down
Loading