administrator/frigate
1
0
Fork 0
mirror of https://github.com/blakeblackshear/frigate.git synced 2026-05-07 14:05:28 +03:00
Code Issues Actions 2 Packages Projects Releases Wiki Activity

restrict config vars for viewer users

Browse Source
This commit is contained in:
Josh Hawkins 2026-05-01 10:04:58 -05:00
parent 3809904ea8
commit 8aa1e1b373
1 changed files with 6 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
frigate/api/app.py
View File

@ -146,8 +146,13 @@ def config(request: Request):
for name, detector in config_obj.detectors.items() for name, detector in config_obj.detectors.items()
} }
# remove the mqtt password # remove environment_vars for non-admin users
if request.headers.get("remote-role") != "admin":
config.pop("environment_vars", None)
# remove mqtt credentials
config["mqtt"].pop("password", None) config["mqtt"].pop("password", None)
config["mqtt"].pop("user", None)
# remove the proxy secret # remove the proxy secret
config["proxy"].pop("auth_secret", None) config["proxy"].pop("auth_secret", None)