From 875a5775619c59e1ac42e9b5b4b251e8a450a96b Mon Sep 17 00:00:00 2001 From: Martin McKeaveney Date: Wed, 19 Jan 2022 10:30:22 +0100 Subject: [PATCH] don't strip secrets from DB and only hide from client --- packages/server/src/api/controllers/datasource.js | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/packages/server/src/api/controllers/datasource.js b/packages/server/src/api/controllers/datasource.js index 198c1bf36b..5ab3c0a865 100644 --- a/packages/server/src/api/controllers/datasource.js +++ b/packages/server/src/api/controllers/datasource.js @@ -101,8 +101,13 @@ exports.update = async function (ctx) { const db = new CouchDB(ctx.appId) const datasourceId = ctx.params.datasourceId let datasource = await db.get(datasourceId) + const auth = datasource.config.auth await invalidateVariables(datasource, ctx.request.body) datasource = { ...datasource, ...ctx.request.body } + if (auth && !ctx.request.body.auth) { + // don't strip auth config from DB + datasource.config.auth = auth + } const response = await db.put(datasource) datasource._rev = response.rev