Isaac ConnorandClaude Opus 5.5 47ec378403 fix: do not show Private option values to System viewers refs GHSA-7g3f-93q8-fhwj ...

The Options page admits System=View and wrote every Config value into
its inputs, only disabling them for users who cannot edit. The Private
flag was never consulted, so a read-only administrator received
ZM_AUTH_HASH_SECRET, which is enough to sign a token for any user, and
the other Private credentials on their tabs.

For a Private option, show its value only to System editors; others see
that it is hidden. The note about a value overridden in zm.conf, which
printed the overriding value, is skipped for those options too.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-07 08:09:33 -04:00

..

ba_ba.php

…

big5_big5.php

…

cs_cz.php

…

de_de.php

…

default.php

…

dk_dk.php

…

en_gb.php

fix: do not show Private option values to System viewers refs GHSA-7g3f-93q8-fhwj

2026-10-07 08:09:33 -04:00

en_us.php

…

es_ar.php

…

es_es.php

…

es_la.php

…

et_ee.php

…

fr_fr.php

…

he_il.php

…

hu_hu.php

…

it_it.php

…

ja_jp.php

…

nl_nl.php

…

no_nb.php

…

pl_pl.php

…

pt_br.php

…

ro_ro.php

…

ru_ru.php

Russian translation update

2026-09-30 17:46:22 +03:00

se_se.php

…

tr_tr.php

…

updateLangs.php

…

zh_cn.php

…

zh_tw.php

…