admin/config: export will hide any field that ends with "password" or starts with "_", so that this can be leveraged by plugins' config ("token" is also included as a special case)
Massimo Melina committed
Nov 30, 2025 at 17:00 UTC
028789c59b8e6251482d0eda788c0f0d3ea6bf0d
2 files changed
+4
-2
admin/src/ConfigFilePage.ts
+2
-2
@@ -62,8 +62,8 @@ export default function ConfigFilePage() {
62
63
function exportConfig() {
64
const s = (text || '')
65
- .replace(/^(\s*(\w*password(?!_change)\w*|srp):\s*).+\n/gm, '$1removed\n')
66
- .replace(/(:\/\/)[^/@\s]+@/g, '$1removed@')
65
+ .replace(/^(\s*(\w*password|_\w*|token|srp):\s*).+\n/gm, '$1removed\n')
66
+ .replace(/(:\/\/)[^/@\s]+@/g, '$1removed@') // url credentials
67
+ prefix('custom_html: | # this is currently ignored by hfs, just here for reference\n', data!.customHtml?.replace(/^/gm, ' '))
68
if (!s) return
69
downloadFileWithContent('config_no_passwords.yaml', s)
dev-plugins.md
+2
@@ -174,6 +174,8 @@ used must be strictly JSON (thus, no single quotes, only double quotes for strin
174
When necessary your plugin will read its value using `api.getConfig('message')` in the backend,
175
or `HFS.getPluginConfig('message')` in the frontend, but the latter must be enabled using the `frontend` flag in the config.
176
To handle more complex cases, you can pass a function to `config` instead of an object. The function will receive a parameter `values`.
177
+ If any of your config contains sensitive information, ensure the name ends with `password`, or it starts with `_`.
178
+ This way HFS will remove it when the user clicks "export without passwords".
179
180
- `configDialog: DialogOptions` object to override dialog options. Please refer to sources for details.
181
- `onFrontendConfig: (config: object) => (void | object)` manipulate config values exposed to frontend.