From 4b4c208035dcc7bf4ebecf2e1ba3b7089537d4bd Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sat, 7 Feb 2026 22:38:58 +0000
Subject: [PATCH] Security fixes: use tojson filter, fix Tuple import, remove
 raw value exposure

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
---
 app/utils/settings_service.py    | 4 ++--
 app/views/settings.py            | 1 -
 frontend/templates/settings.html | 4 ++--
 3 files changed, 4 insertions(+), 5 deletions(-)

diff --git a/app/utils/settings_service.py b/app/utils/settings_service.py
index 410e1032..0a8bff19 100644
--- a/app/utils/settings_service.py
+++ b/app/utils/settings_service.py
@@ -8,7 +8,7 @@ This module provides functionality to:
 """
 
 import logging
-from typing import Any, Dict, List, Optional
+from typing import Any, Dict, List, Optional, Tuple
 from sqlalchemy.orm import Session
 from sqlalchemy.exc import SQLAlchemyError
 
@@ -290,7 +290,7 @@ def get_settings_by_category() -> Dict[str, List[str]]:
     return categories
 
 
-def validate_setting_value(key: str, value: str) -> tuple[bool, Optional[str]]:
+def validate_setting_value(key: str, value: str) -> Tuple[bool, Optional[str]]:
     """
     Validate a setting value based on its metadata.
     
diff --git a/app/views/settings.py b/app/views/settings.py
index 162f6ef9..ecb9d799 100644
--- a/app/views/settings.py
+++ b/app/views/settings.py
@@ -57,7 +57,6 @@ async def settings_page(request: Request, db: Session = Depends(get_db)):
                 
                 settings_data[category].append({
                     "key": key,
-                    "value": value if value is not None else "",
                     "display_value": display_value if display_value is not None else "",
                     "metadata": metadata
                 })
diff --git a/frontend/templates/settings.html b/frontend/templates/settings.html
index df6a3aca..11757ab6 100644
--- a/frontend/templates/settings.html
+++ b/frontend/templates/settings.html
@@ -160,8 +160,8 @@ function settingsApp() {
       // Initialize form data from current settings
       {% for category, settings_list in settings_data.items() %}
         {% for setting in settings_list %}
-          this.formData['{{ setting.key }}'] = '{{ setting.value }}';
-          this.originalData['{{ setting.key }}'] = '{{ setting.value }}';
+          this.formData['{{ setting.key }}'] = {{ setting.display_value|tojson }};
+          this.originalData['{{ setting.key }}'] = {{ setting.display_value|tojson }};
           this.showPassword['{{ setting.key }}'] = false;
         {% endfor %}
       {% endfor %}