mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-09-17 12:22:34 +03:00
ad54249c54
The Token Plan console cookie is a browser credential for the operator's cloud-console account — same class as the ollama/opencode cookies that sanitizeProviderSpecificDataForResponse already strips — but the four qwen/alibaba fields (qwenCloudCookie, qwenCloudSecToken, alibabaConsoleCookie, alibabaConsoleSecToken) were missing from the strip list, so GET /api/providers returned the operator's console session in the clear to any dashboard session. The edit modal depended on that leak: it initialized the cookie fields from the round-tripped response. It now starts them empty, matching the ollama pattern — the quota-scraping assign skips empty fields and the PUT handler's partial merge preserves keys the payload does not carry, so 'leave blank to keep the stored cookie' (already what the field hints promise) holds for real. Found in the 2026-09-01 audit of the Token Plan quota feature.