remote/navidrome
1
0
Fork 0
mirror of https://github.com/navidrome/navidrome.git synced 2026-10-29 22:47:48 +01:00
Code Issues Projects Releases Packages Wiki Activity

feat(api): restrict access to library and config endpoints to admin users

Browse source 
Signed-off-by: Deluan <deluan@navidrome.org>
This commit is contained in:
Deluan 2025-06-06 14:54:28 -04:00
commit 7dce0da557
5 changed files with 178 additions and 110 deletions
Download patch file Download diff file Expand all files Collapse all files

6
server/nativeapi/config.go
View file

@ -9,7 +9,6 @@ import (
"github.com/navidrome/navidrome/conf"
"github.com/navidrome/navidrome/log"
"github.com/navidrome/navidrome/model/request"
)
// sensitiveFieldsPartialMask contains configuration field names that should be redacted
@ -99,11 +98,6 @@ func applySensitiveFieldMasking(ctx context.Context, config map[string]interface
func getConfig(w http.ResponseWriter, r *http.Request) {
ctx := r.Context()
user, _ := request.UserFrom(ctx)
if !user.IsAdmin {
http.Error(w, "Config endpoint is only available to admin users", http.StatusUnauthorized)
return
}
// Marshal the actual configuration struct to preserve original field names
configBytes, err := json.Marshal(*conf.Server)