Description / 问题描述

Fixes #220 - When loginDomain setting is disabled (= 1), the /api/setting/websiteConfig API was still returning the full domainList array, exposing domain information to clients even when the admin explicitly chose not to show domains in the login form.

Changes / 修改内容

Modified mail-worker/src/service/setting-service.js:

• The websiteConfig function now conditionally returns domainList based on the loginDomain setting
• When loginDomain === 0 (enabled): Returns the full domain list
• When loginDomain !== 0 (disabled): Returns an empty array []

Before / 之前

domainList: settingRow.domainList,  // Always returned

After / 之后

domainList: settingRow.loginDomain === 0 ? settingRow.domainList : [],

Testing / 测试

This change aligns the API behavior with the frontend behavior where the domain selector is only shown when loginDomain === 0 (see mail-vue/src/views/login/index.vue line 19).

This is a minimal, targeted fix that prevents information disclosure while maintaining backward compatibility for users who have loginDomain enabled.