mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-08-22 07:02:16 +03:00
3d80529280
GET /api/settings/obsidian/webdav returned the plaintext webdavPassword to any caller the handler admitted — including an anonymous caller reaching it through the requireLogin=false open mode (the default management pipeline already blocks non-manage keys). The plaintext is now returned only to a genuine management principal (dashboard session or manage-scope key); everyone else gets a `webdavPasswordSet` flag instead. The dashboard's authenticated reveal view is unchanged. Reported by @0raN9ewww via GHSA-62vw-4m6w-cqqq (and the credential-exposure portion of GHSA-p855-p6fm-76r3).