mirror of
https://github.com/farion1231/cc-switch.git
synced 2026-05-17 18:38:57 +08:00
Jason
0a301a497c
Two components (ProviderList, UsageScriptModal) directly spread the full settings object from the query into settingsApi.save(), which includes webdavSync with an empty password (cleared by get_settings_for_frontend for security). The backend merge_settings_for_save only preserved existing WebDAV config when the incoming field was None, not when it was present with an empty password. Frontend fix: strip webdavSync before saving in both components, matching the pattern already used by useSettings hook. Backend defense-in-depth: merge_settings_for_save now backfills the existing password when the incoming one is empty, preventing future regressions from similar oversights.