From 35fb9c525e05d00793e6b7ca6a5a5809407bd43d Mon Sep 17 00:00:00 2001 From: hugocasa Date: Tue, 25 Aug 2026 15:51:02 +0200 Subject: [PATCH] fix: let non-superadmins read the default allowed origins setting Co-Authored-By: Claude Opus 5 --- backend/windmill-api-settings/src/lib.rs | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/backend/windmill-api-settings/src/lib.rs b/backend/windmill-api-settings/src/lib.rs index aa4a2043c5..30dfb57930 100644 --- a/backend/windmill-api-settings/src/lib.rs +++ b/backend/windmill-api-settings/src/lib.rs @@ -1287,6 +1287,11 @@ pub async fn get_global_setting( && key != EMAIL_DOMAIN_SETTING && key != APP_WORKSPACED_ROUTE_SETTING && key != HTTP_ROUTE_WORKSPACED_ROUTE_SETTING + // The route editor shows the inherited default to whoever is editing a + // trigger, who is usually not a superadmin. Not a secret either: any + // browser discovers the list by reading Access-Control-Allow-Origin off + // a response. + && key != HTTP_ROUTE_DEFAULT_ALLOWED_ORIGINS_SETTING && key != WS_BASE_URL_SETTING { require_super_admin(&db, &authed).await?;