NoLog.cz/gancio-upstream
6
0
Fork 0
mirror of https://framagit.org/les/gancio.git synced 2025-01-31 16:42:22 +01:00
Code Issues Projects Releases Packages Wiki Activity

security fix, do not pass smtp password with front-end

Browse source
This commit is contained in:
lesion 2022-02-01 23:34:05 +01:00
parent 00a47be884
commit 2a07026590
No known key found for this signature in database
GPG key ID: 352918250B012177
2 changed files with 8 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
components/admin/Settings.vue
View file

@ -83,7 +83,7 @@ export default {
computed: {
...mapState(['settings']),
showSMTPAlert () {
return !this.setup && (!this.settings.admin_email || !this.settings.smtp || !this.settings.smtp.host || !this.settings.smtp.user)
return !this.setup && (!this.settings.admin_email || !this.settings.smtp || !this.settings.smtp.host || !this.settings.smtp.auth.user)
},
instance_locale: {
get () { return this.settings.instance_locale },

7
server/helpers.js
View file

@ -65,6 +65,13 @@ module.exports = {
// initialize settings
req.settings = { ...settingsController.settings }
if (req.settings.smtp && req.settings.smtp.auth && req.settings.smtp.auth.pass) {
if (req.user.is_admin) {
delete req.settings.smtp.auth.pass
} else {
delete req.settings.smtp
}
}
req.settings.baseurl = config.baseurl
req.settings.hostname = config.hostname
req.settings.title = req.settings.title || config.title