From c2d35afc3e0201608f4ef60922f8769875462254 Mon Sep 17 00:00:00 2001 From: ddmoney420 Date: Tue, 3 Mar 2026 14:51:57 -0700 Subject: [PATCH] Whitelist safe config keys broadcast to clients (closes #898) The socket connect handler was sending the entire config object to every client, including YTDL_OPTIONS (which can contain proxy auth, cookies paths, etc). Whitelist only the keys the frontend needs. Co-Authored-By: Claude Opus 4.6 --- app/main.py | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/app/main.py b/app/main.py index dad519b..98879cc 100644 --- a/app/main.py +++ b/app/main.py @@ -345,7 +345,15 @@ async def history(request): async def connect(sid, environ): log.info(f"Client connected: {sid}") await sio.emit('all', serializer.encode(dqueue.get()), to=sid) - await sio.emit('configuration', serializer.encode(config), to=sid) + safe_config = { + k: getattr(config, k, None) for k in ( + 'CUSTOM_DIRS', 'CREATE_CUSTOM_DIRS', 'DELETE_FILE_ON_TRASHCAN', + 'PUBLIC_HOST_URL', 'PUBLIC_HOST_AUDIO_URL', 'OUTPUT_TEMPLATE', + 'OUTPUT_TEMPLATE_CHAPTER', 'DEFAULT_OPTION_PLAYLIST_ITEM_LIMIT', + 'DOWNLOAD_DIRS_INDEXABLE', 'DEFAULT_THEME', 'URL_PREFIX', + ) if hasattr(config, k) + } + await sio.emit('configuration', serializer.encode(safe_config), to=sid) if config.CUSTOM_DIRS: await sio.emit('custom_dirs', serializer.encode(get_custom_dirs()), to=sid) if config.YTDL_OPTIONS_FILE: