open-webui/openapi-servers
1
0
Fork 0
mirror of https://github.com/open-webui/openapi-servers.git synced 2026-08-24 12:02:55 -04:00
Code Issues 2 Packages Projects Releases Wiki Activity

[PR #34] [MERGED] feat: Implement delete confirmation system, general filesystem operation improvements #6

New Issue
Closed
opened 2026-02-15 20:17:03 -05:00 by yindo · 0 comments
yindo commented 2026-02-15 20:17:03 -05:00
Owner
Copy Link
Copy Source

📋 Pull Request Information

Original PR: https://github.com/open-webui/openapi-servers/pull/34
Author: @taylorwilsdon
Created: 4/17/2025
Status: ✅ Merged
Merged: 4/17/2025
Merged by: @tjbck

Base: main ← Head: filesystem_enh

📝 Commits (10+)

  • 07be65f Refactor allowed directories to config.py; implement two-step delete_path with token-based confirmation and pending state; update related models, validation, and error handling
  • 2110943 absolute import for config
  • b0b1e6e Implement more reliable mechanism for file delete confirmation
  • 8bd8f1d fix relative import
  • 569d890 re-implement pending_confirmation
  • 5478ae0 migrate pending confirmation store to local filestore for persistence between sessions
  • 2b08d17 Update main.py
  • 4de55a5 Update main.py
  • 90ab5c0 improve deletion flow with shorter confirmations
  • 51887d2 merge

📊 Changes

2 files changed (+172 additions, -52 deletions)

View changed files

➕ servers/filesystem/config.py (+7 -0)
📝 servers/filesystem/main.py (+165 -52)

📄 Description

Enhance delete_path endpoint with two-step confirmation

Summary

This PR improves the security of the /delete_path endpoint by introducing a two-step delete confirmation process using ephemeral confirmation tokens. My main goal here @tjbck was to ensure that hallucinations or runaway LLMs don't inadvertently go blowing away parts of a user's filesystem.

Major Changes

  • ✳️ Introduced a two-step confirmation mechanism for file/directory deletion:
    • First request returns a confirmation token and expiry timestamp.
    • Second request (with token) confirms and executes deletion.
  • New response model: ConfirmationRequiredResponse.
  • Updated DeletePathRequest model to replace confirm_delete with confirmation_token.
  • Persistence logic:
    • Pending confirmation tokens are stored in .pending_confirmations.json.
    • Expired or mismatched requests are safely rejected.
  • Token expires after 60 seconds.

Additional Improvements

  • 🔄 Moved ALLOWED_DIRECTORIES config into a new config.py file.
  • 🧼 Removed unused print/debug statements.
  • ⚙��� Minor imports and dependency updates for clarity (e.g. uuid, json, Union).

Version

Bumped API version from 0.1.0 → 0.1.1.

✅ Safe for review and merge.

Screenshot:
Screenshot 2025-04-17 at 11 43 54 AM

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/open-webui/openapi-servers/pull/34 **Author:** [@taylorwilsdon](https://github.com/taylorwilsdon) **Created:** 4/17/2025 **Status:** ✅ Merged **Merged:** 4/17/2025 **Merged by:** [@tjbck](https://github.com/tjbck) **Base:** `main` ← **Head:** `filesystem_enh` --- ### 📝 Commits (10+) - [`07be65f`](https://github.com/open-webui/openapi-servers/commit/07be65fcf7fb1b3c1f94bec40d5e237095e322f4) Refactor allowed directories to config.py; implement two-step delete_path with token-based confirmation and pending state; update related models, validation, and error handling - [`2110943`](https://github.com/open-webui/openapi-servers/commit/2110943fde3e51ce47126bb7fedb34b0001cc844) absolute import for config - [`b0b1e6e`](https://github.com/open-webui/openapi-servers/commit/b0b1e6eb6d2363bbf520a9123a545aa52b4d79df) Implement more reliable mechanism for file delete confirmation - [`8bd8f1d`](https://github.com/open-webui/openapi-servers/commit/8bd8f1d712b0bb3a9d120051ebe006320917bd41) fix relative import - [`569d890`](https://github.com/open-webui/openapi-servers/commit/569d8905ef2b8adecd8debc8553820c7b1ce9926) re-implement pending_confirmation - [`5478ae0`](https://github.com/open-webui/openapi-servers/commit/5478ae007b3b276fc383027934a45698297e7b2d) migrate pending confirmation store to local filestore for persistence between sessions - [`2b08d17`](https://github.com/open-webui/openapi-servers/commit/2b08d17ddcd9ee95c7815cd8210753313beb721c) Update main.py - [`4de55a5`](https://github.com/open-webui/openapi-servers/commit/4de55a5c950a68e9f8701fc9304fbcc39948f3d7) Update main.py - [`90ab5c0`](https://github.com/open-webui/openapi-servers/commit/90ab5c0686b9097c31b8931407cf7e874940fb20) improve deletion flow with shorter confirmations - [`51887d2`](https://github.com/open-webui/openapi-servers/commit/51887d2aefa9eefd5da12653e971bc1c1822a618) merge ### 📊 Changes **2 files changed** (+172 additions, -52 deletions) <details> <summary>View changed files</summary> ➕ `servers/filesystem/config.py` (+7 -0) 📝 `servers/filesystem/main.py` (+165 -52) </details> ### 📄 Description ## Enhance delete_path endpoint with two-step confirmation ### Summary This PR improves the security of the /delete_path endpoint by introducing a two-step delete confirmation process using ephemeral confirmation tokens. My main goal here @tjbck was to ensure that hallucinations or runaway LLMs don't inadvertently go blowing away parts of a user's filesystem. ### Major Changes - ✳️ Introduced a two-step confirmation mechanism for file/directory deletion: - First request returns a confirmation token and expiry timestamp. - Second request (with token) confirms and executes deletion. - New response model: ConfirmationRequiredResponse. - Updated DeletePathRequest model to replace confirm_delete with confirmation_token. - Persistence logic: - Pending confirmation tokens are stored in .pending_confirmations.json. - Expired or mismatched requests are safely rejected. - Token expires after 60 seconds. ### Additional Improvements - 🔄 Moved ALLOWED_DIRECTORIES config into a new config.py file. - 🧼 Removed unused print/debug statements. - ⚙��� Minor imports and dependency updates for clarity (e.g. uuid, json, Union). ### Version Bumped API version from 0.1.0 → 0.1.1. --- ✅ Safe for review and merge. Screenshot: <img width="1530" alt="Screenshot 2025-04-17 at 11 43 54 AM" src="https://github.com/user-attachments/assets/c6d484f1-1ae0-4c4e-a755-d9ef2f28739f" /> --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
yindo added the pull-request label 2026-02-15 20:17:03 -05:00
yindo closed this issue 2026-02-15 20:17:03 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
pull-request
Mirrored from GitHub Pull Request
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: open-webui/openapi-servers#6
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?