fix: Dashboard config objects stored on server with public read / write access (#2997)

mtrezza · web-flow · commit 31a4639bb44f · 2025-10-05T14:08:16.000+02:00
diff --git a/src/lib/ServerConfigStorage.js b/src/lib/ServerConfigStorage.js
@@ -59,6 +59,9 @@ export default class ServerConfigStorage {
     this._clearAllValueFields(configObject);
     configObject.set(valueType, value);
 
+    // Set empty ACL so object is only accessible with master key
+    configObject.setACL(new Parse.ACL());
+
     // Use master key for operations
     return configObject.save(null, { useMasterKey: true });
   }

Original file line number	Diff line number	Diff line change
`@@ -59,6 +59,9 @@ export default class ServerConfigStorage {`
`59`	`59`	`this._clearAllValueFields(configObject);`
`60`	`60`	`configObject.set(valueType, value);`
`61`	`61`
	`62`	`+ // Set empty ACL so object is only accessible with master key`
	`63`	`+ configObject.setACL(new Parse.ACL());`
	`64`	`+`
`62`	`65`	`// Use master key for operations`
`63`	`66`	`return configObject.save(null, { useMasterKey: true });`
`64`	`67`	`}`