From f618aa830a97bf6cdf0d410216b16b2b7f63e72e Mon Sep 17 00:00:00 2001 From: Kenneth Skovhede Date: Thu, 29 Aug 2024 11:23:31 +0200 Subject: [PATCH] Prevent the settings hash from being exposed as it has no value outside the settings update check. --- Duplicati/WebserverCore/Endpoints/V1/ServerSetting.cs | 2 ++ 1 file changed, 2 insertions(+) diff --git a/Duplicati/WebserverCore/Endpoints/V1/ServerSetting.cs b/Duplicati/WebserverCore/Endpoints/V1/ServerSetting.cs index 5dc87bf35..376631c76 100644 --- a/Duplicati/WebserverCore/Endpoints/V1/ServerSetting.cs +++ b/Duplicati/WebserverCore/Endpoints/V1/ServerSetting.cs @@ -20,6 +20,7 @@ public class ServerSetting : IEndpointV1 private static readonly string[] GUARDED_OUTPUT = [ Server.Database.ServerSettings.CONST.JWT_CONFIG, Server.Database.ServerSettings.CONST.PBKDF_CONFIG, + Server.Database.ServerSettings.CONST.PRELOAD_SETTINGS_HASH, // Not used anymore, but not completely removed Server.Database.ServerSettings.CONST.SERVER_PASSPHRASE, Server.Database.ServerSettings.CONST.SERVER_PASSPHRASE_SALT, @@ -31,6 +32,7 @@ public class ServerSetting : IEndpointV1 private static readonly string[] GUARDED_INPUT = [ Server.Database.ServerSettings.CONST.JWT_CONFIG, Server.Database.ServerSettings.CONST.PBKDF_CONFIG, + Server.Database.ServerSettings.CONST.PRELOAD_SETTINGS_HASH, Server.Database.ServerSettings.CONST.SERVER_PASSPHRASE, Server.Database.ServerSettings.CONST.SERVER_PASSPHRASE_SALT, Server.Database.ServerSettings.CONST.SERVER_SSL_CERTIFICATE,