starred/windmill
1
0
Fork 0
mirror of https://github.com/windmill-labs/windmill.git synced 2026-09-21 00:02:30 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: let non-superadmins read the default allowed origins setting

Browse Source 
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
hugocasa
2026-08-25 15:51:02 +02:00
co-authored by Claude Opus 5
parent 165db54ec0
commit 35fb9c525e
1 changed files with 5 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/windmill-api-settings/src/lib.rs
+5
View File
@@ -1287,6 +1287,11 @@ pub async fn get_global_setting(
&& key != EMAIL_DOMAIN_SETTING
&& key != APP_WORKSPACED_ROUTE_SETTING
&& key != HTTP_ROUTE_WORKSPACED_ROUTE_SETTING
// The route editor shows the inherited default to whoever is editing a
// trigger, who is usually not a superadmin. Not a secret either: any
// browser discovers the list by reading Access-Control-Allow-Origin off
// a response.
&& key != HTTP_ROUTE_DEFAULT_ALLOWED_ORIGINS_SETTING
&& key != WS_BASE_URL_SETTING
{
require_super_admin(&db, &authed).await?;