scriptoriumadmin/litellm
1
0
Fork 0
mirror of https://github.com/BerriAI/litellm.git synced 2026-10-03 02:22:24 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 81

fix(mcp/ui): clear value for user-scope env vars before submit

Browse source 
A stale admin secret left in form state after switching an env var's
scope from instance to per-user was forwarded to the backend as the
user-scope value, which is returned unredacted to authorized non-admin
users. Per-user entries carry no admin value, so drop it on submit.
This commit is contained in:
mateo-berri 2026-06-03 20:54:32 +00:00
parent e9eeca1bb7
commit 0dcf316f59
No known key found for this signature in database
2 changed files with 2 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
ui/litellm-dashboard/src/components/mcp_tools/create_mcp_server.tsx
View file

@ -65,7 +65,7 @@ const normalizeEnvVars = (list: unknown): EnvVarEntry[] => {
const scope = (entry as Record<string, unknown>).scope === "user" ? "user" : "global";
out.push({
name,
value: String((entry as Record<string, unknown>).value ?? ""),
value: scope === "user" ? "" : String((entry as Record<string, unknown>).value ?? ""),
scope,
description: ((entry as Record<string, unknown>).description as string | undefined) || undefined,
});

2
ui/litellm-dashboard/src/components/mcp_tools/mcp_server_edit.tsx
View file

@ -444,7 +444,7 @@ const MCPServerEdit: React.FC<MCPServerEditProps> = ({
const scope = entry?.scope === "user" ? "user" : "global";
acc.push({
name,
value: String(entry?.value ?? ""),
value: scope === "user" ? "" : String(entry?.value ?? ""),
scope,
description: (entry?.description as string | undefined) || undefined,
});