mirror of
https://github.com/farion1231/cc-switch.git
synced 2026-06-16 13:34:04 +08:00
Two components (ProviderList, UsageScriptModal) directly spread the full settings object from the query into settingsApi.save(), which includes webdavSync with an empty password (cleared by get_settings_for_frontend for security). The backend merge_settings_for_save only preserved existing WebDAV config when the incoming field was None, not when it was present with an empty password. Frontend fix: strip webdavSync before saving in both components, matching the pattern already used by useSettings hook. Backend defense-in-depth: merge_settings_for_save now backfills the existing password when the incoming one is empty, preventing future regressions from similar oversights.