happyz
/
memos
mirror of https://github.com/usememos/memos.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
memos/server/router/api/v1
History
memoclaw 9d3a74bccc fix(api): make credentials write-only and restrict sensitive settings to admins 
Security fixes for credential leakage across three resources:

- NOTIFICATION setting: restrict GetInstanceSetting to admin-only
  (was publicly accessible, exposing SMTP credentials)
- SMTP password: never return SmtpPassword in API responses (write-only)
- S3 secret: never return AccessKeySecret in API responses (write-only)
- OAuth2 ClientSecret: never return in API responses for any role
  (was previously returned to admins); remove redactIdentityProviderResponse
  in favor of omitting the field at the conversion layer
- Preserve-on-empty: when updating settings with an empty credential
  field, preserve the existing stored value instead of overwriting
  (applies to SmtpPassword, AccessKeySecret, and ClientSecret)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 		2026-03-29 07:34:00 +08:00
..
test fix(api): make credentials write-only and restrict sensitive settings to admins 2026-03-29 07:34:00 +08:00
acl_config.go feat(memo): add share links for private memos (#5742) 2026-03-19 23:47:22 +08:00
acl_config_test.go fix(api): remove public activity service (#5734) 2026-03-18 22:42:57 +08:00
attachment_exif_test.go feat: implement EXIF metadata stripping for image uploads 2026-01-26 22:18:44 +08:00
attachment_service.go fix: prevent local attachment uploads from overwriting files 2026-03-26 21:46:51 +08:00
auth_service.go fix(api): restrict user email exposure to self and admins (#5784) 2026-03-25 22:02:08 +08:00
auth_service_client_info_test.go refactor: remove deprecated Sessions and AccessTokens settings 2025-12-19 08:35:57 +08:00
common.go refactor: migrate HOST roles to ADMIN 2026-01-20 23:38:30 +08:00
connect_handler.go fix(api): remove public activity service (#5734) 2026-03-18 22:42:57 +08:00
connect_interceptors.go refactor: consolidate duplicated auth logic into auth package 2026-02-24 23:08:16 +08:00
connect_services.go feat(memo): add share links for private memos (#5742) 2026-03-19 23:47:22 +08:00
header_carrier.go fix(backend): correct generic type parameter in withHeaderCarrier helper 2025-12-12 08:06:13 +08:00
health_service.go refactor(store): remove deprecated migration_history table and backward compatibility code 2025-12-01 22:54:30 +08:00
idp_service.go fix(api): make credentials write-only and restrict sensitive settings to admins 2026-03-29 07:34:00 +08:00
instance_service.go fix(api): make credentials write-only and restrict sensitive settings to admins 2026-03-29 07:34:00 +08:00
memo_attachment_service.go fix(store): allow memo/attachment deletion when local file is missing 2026-02-23 10:26:40 +08:00
memo_relation_service.go fix: replace echo.NewHTTPError with status.Errorf 2026-02-08 19:23:34 +08:00
memo_service.go fix(api): improve SSE hub design and fix double-broadcast on comments 2026-03-29 07:33:40 +08:00
memo_service_converter.go fix(api): switch user resource names to usernames (#5779) 2026-03-25 09:11:17 +08:00
memo_service_filter.go refactor: deprecate old filter 2025-07-22 21:25:57 +08:00
memo_share_service.go feat(memo): add share links for private memos (#5742) 2026-03-19 23:47:22 +08:00
reaction_service.go fix(api): improve SSE hub design and fix double-broadcast on comments 2026-03-29 07:33:40 +08:00
resource_name.go fix(api): switch user resource names to usernames (#5779) 2026-03-25 09:11:17 +08:00
shortcut_service.go fix(api): switch user resource names to usernames (#5779) 2026-03-25 09:11:17 +08:00
sse_event_helpers.go fix(api): improve SSE hub design and fix double-broadcast on comments 2026-03-29 07:33:40 +08:00
sse_handler.go fix(api): improve SSE hub design and fix double-broadcast on comments 2026-03-29 07:33:40 +08:00
sse_hub.go fix(api): improve SSE hub design and fix double-broadcast on comments 2026-03-29 07:33:40 +08:00
sse_hub_test.go fix(api): improve SSE hub design and fix double-broadcast on comments 2026-03-29 07:33:40 +08:00
sse_service_test.go fix(api): improve SSE hub design and fix double-broadcast on comments 2026-03-29 07:33:40 +08:00
user_resource_name.go fix(api): switch user resource names to usernames (#5779) 2026-03-25 09:11:17 +08:00
user_service.go fix(api): restrict user email exposure to self and admins (#5784) 2026-03-25 22:02:08 +08:00
user_service_stats.go fix(api): switch user resource names to usernames (#5779) 2026-03-25 09:11:17 +08:00
v1.go fix(api): improve SSE hub design and fix double-broadcast on comments 2026-03-29 07:33:40 +08:00