Salastil/odysseus
1
0
Fork 0
mirror of https://github.com/pewdiepie-archdaemon/odysseus.git synced 2026-08-10 07:28:41 -04:00
Code Issues Packages Projects Releases Wiki Activity

fix(email): hide OAuth tokens from config response (#5651)

Browse Source
This commit is contained in:
RaresKeY
2026-07-22 12:58:16 +02:00
committed by GitHub
parent 16b04a9792
commit 93f97e74cd
2 changed files with 57 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
routes/email_routes.py
+7
View File
@@ -4699,6 +4699,13 @@ def setup_email_routes():
cfg = _get_email_config(owner=owner)
cfg["smtp_password"] = "***" if cfg["smtp_password"] else ""
cfg["imap_password"] = "***" if cfg["imap_password"] else ""
# `_get_email_config` includes encrypted OAuth fields for the server's
# IMAP/SMTP helpers. They are implementation secrets, not client
# configuration, so keep them out of this browser-facing response just
# as the account-list endpoint does.
cfg.pop("oauth_access_token", None)
cfg.pop("oauth_refresh_token", None)
cfg.pop("oauth_token_expiry", None)
# Include preferences from settings.json
settings = _load_settings()
cfg["email_auto_summarize"] = bool(settings.get("email_auto_summarize", False))