Security fixes: use tojson filter, fix Tuple import, remove raw value exposure

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>

app/utils/settings_service.py

@@ -8,7 +8,7 @@ This module provides functionality to:
 """
 
 import logging
-from typing import Any, Dict, List, Optional
+from typing import Any, Dict, List, Optional, Tuple
 from sqlalchemy.orm import Session
 from sqlalchemy.exc import SQLAlchemyError
 
@@ -290,7 +290,7 @@ def get_settings_by_category() -> Dict[str, List[str]]:
     return categories
 
 
-def validate_setting_value(key: str, value: str) -> tuple[bool, Optional[str]]:
+def validate_setting_value(key: str, value: str) -> Tuple[bool, Optional[str]]:
     """
     Validate a setting value based on its metadata.
     

app/views/settings.py

@@ -57,7 +57,6 @@ async def settings_page(request: Request, db: Session = Depends(get_db)):
                 
                 settings_data[category].append({
                     "key": key,
-                    "value": value if value is not None else "",
                     "display_value": display_value if display_value is not None else "",
                     "metadata": metadata
                 })

frontend/templates/settings.html

@@ -160,8 +160,8 @@ function settingsApp() {
       // Initialize form data from current settings
       {% for category, settings_list in settings_data.items() %}
         {% for setting in settings_list %}
-          this.formData['{{ setting.key }}'] = '{{ setting.value }}';
-          this.originalData['{{ setting.key }}'] = '{{ setting.value }}';
+          this.formData['{{ setting.key }}'] = {{ setting.display_value|tojson }};
+          this.originalData['{{ setting.key }}'] = {{ setting.display_value|tojson }};
           this.showPassword['{{ setting.key }}'] = false;
         {% endfor %}
       {% endfor %}