From e4db112296bc648a250eef4e6a110e9f978b3e2f Mon Sep 17 00:00:00 2001 From: cproudlock Date: Wed, 2 Sep 2026 17:49:38 -0400 Subject: [PATCH] Use a valuetype the settings column actually documents printedparts_kiosk_token declared valuetype 'secret'. The column documents string, boolean, integer and json, and that was the only 'secret' in the codebase - it worked only because Setting.get falls through to the raw string when it recognises nothing. Masking never depended on it: settings.py::_is_secret keys on the NAME containing 'token', so the value is still hidden in API reads and in the audit log. Changed to string, which is what it is. Scope: product --- plugins/printedparts/plugin.py | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/plugins/printedparts/plugin.py b/plugins/printedparts/plugin.py index 7fc89f41..9d788bb0 100644 --- a/plugins/printedparts/plugin.py +++ b/plugins/printedparts/plugin.py @@ -162,7 +162,11 @@ class PrintedpartsPlugin(BasePlugin): { 'key': 'printedparts_kiosk_token', 'value': '', - 'valuetype': 'secret', + # string, not 'secret': the column documents string/boolean/ + # integer/json only. Masking is keyed on the NAME containing + # 'token' (settings.py::_is_secret), so this is still hidden in + # the API and the audit log. + 'valuetype': 'string', 'category': 'printedparts', 'description': 'Device token the kiosk sends as X-Kiosk-Token. ' 'Generate one, then open the kiosk once as '