mirror of
https://github.com/pewdiepie-archdaemon/odysseus.git
synced 2026-09-24 08:37:58 +00:00
a51a1fc4fc
/api/auth/settings is auth-exempt (the frontend + the pre-login page read it for keybinds/TTS prefs), so non-admin and unauthenticated callers get a scrubbed copy. The previous scrub only blanked TOP-LEVEL string values whose key matched a short suffix list — so a secret nested under a non-secret parent key, or stored under a key outside the list, would leak. A real exposure when the app is reachable over a Cloudflare tunnel / reverse proxy. - src/settings_scrub.py: NEW stdlib-only module with the scrub helpers (deep/ recursive; broadened secret-key patterns). Kept separate from auth_routes so it imports + unit-tests WITHOUT pulling the FastAPI / auth / database chain (addresses review: the test no longer fails at collection on the DB import). - routes/auth_routes.py: import scrub_settings from the module. - tests/test_settings_scrub.py: import the tiny module directly. Ran: pytest tests/test_settings_scrub.py (8 passed); verified the test pulls no db/auth modules into sys.modules; py_compile routes/auth_routes.py. Co-authored-by: Kanaru92 <107661007+Kanaru92@users.noreply.github.com> |
||
|---|---|---|
| .. | ||
| __init__.py | ||
| admin_wipe_routes.py | ||
| api_token_routes.py | ||
| assistant_routes.py | ||
| auth_routes.py | ||
| backup_routes.py | ||
| calendar_routes.py | ||
| chat_helpers.py | ||
| chat_routes.py | ||
| cleanup_routes.py | ||
| compare_routes.py | ||
| contacts_routes.py | ||
| cookbook_helpers.py | ||
| cookbook_routes.py | ||
| diagnostics_routes.py | ||
| document_helpers.py | ||
| document_routes.py | ||
| editor_draft_routes.py | ||
| email_helpers.py | ||
| email_pollers.py | ||
| email_routes.py | ||
| embedding_routes.py | ||
| emoji_routes.py | ||
| font_routes.py | ||
| gallery_helpers.py | ||
| gallery_routes.py | ||
| history_routes.py | ||
| hwfit_routes.py | ||
| mcp_routes.py | ||
| memory_routes.py | ||
| model_routes.py | ||
| note_routes.py | ||
| personal_routes.py | ||
| prefs_routes.py | ||
| preset_routes.py | ||
| research_routes.py | ||
| search_routes.py | ||
| session_routes.py | ||
| shell_routes.py | ||
| signature_routes.py | ||
| skills_routes.py | ||
| stt_routes.py | ||
| task_routes.py | ||
| tts_routes.py | ||
| upload_routes.py | ||
| vault_routes.py | ||
| webhook_routes.py | ||