Skip to content

Conversation

@ThanhNguyxn
Copy link

Description / 问题描述

Fixes #220 - When loginDomain setting is disabled (= 1), the /api/setting/websiteConfig API was still returning the full domainList array, exposing domain information to clients even when the admin explicitly chose not to show domains in the login form.

Changes / 修改内容

Modified mail-worker/src/service/setting-service.js:

  • The websiteConfig function now conditionally returns domainList based on the loginDomain setting
  • When loginDomain === 0 (enabled): Returns the full domain list
  • When loginDomain !== 0 (disabled): Returns an empty array []

Before / 之前

domainList: settingRow.domainList,  // Always returned

After / 之后

domainList: settingRow.loginDomain === 0 ? settingRow.domainList : [],

Testing / 测试

This change aligns the API behavior with the frontend behavior where the domain selector is only shown when loginDomain === 0 (see mail-vue/src/views/login/index.vue line 19).


This is a minimal, targeted fix that prevents information disclosure while maintaining backward compatibility for users who have loginDomain enabled.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Bug] 不勾选【登陆框域名】的情况下 登陆页仍然获取域名列表

1 participant