mirror of https://github.com/usememos/memos.git
9d3a74bccc
Security fixes for credential leakage across three resources: - NOTIFICATION setting: restrict GetInstanceSetting to admin-only (was publicly accessible, exposing SMTP credentials) - SMTP password: never return SmtpPassword in API responses (write-only) - S3 secret: never return AccessKeySecret in API responses (write-only) - OAuth2 ClientSecret: never return in API responses for any role (was previously returned to admins); remove redactIdentityProviderResponse in favor of omitting the field at the conversion layer - Preserve-on-empty: when updating settings with an empty credential field, preserve the existing stored value instead of overwriting (applies to SmtpPassword, AccessKeySecret, and ClientSecret) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| attachment_service_test.go | ||
| auth_test.go | ||
| idp_service_test.go | ||
| instance_admin_cache_test.go | ||
| instance_service_test.go | ||
| memo_attachment_service_test.go | ||
| memo_relation_service_test.go | ||
| memo_service_test.go | ||
| memo_share_service_test.go | ||
| reaction_service_test.go | ||
| shortcut_service_test.go | ||
| sse_handler_test.go | ||
| test_helper.go | ||
| user_email_visibility_test.go | ||
| user_notification_test.go | ||
| user_resource_name_test.go | ||
| user_service_registration_test.go | ||
| user_service_stats_test.go | ||