mirror of
https://github.com/EstrellaXD/Auto_Bangumi.git
synced 2026-03-20 03:46:40 +08:00
When GET /config/get returns config to the frontend, sensitive fields (password, token, api_key, secret) are masked as '********'. If the user changes any non-sensitive setting (e.g. ssl: true → false) and saves, the frontend sends back the masked placeholder verbatim. The backend was saving it directly, overwriting the real credential with the literal string '********', breaking authentication silently. Add _restore_sensitive() to substitute any '********' placeholder with the current in-memory value before writing to disk. Non-sensitive fields and genuinely new values are unaffected. Fixes #995