From b0749e95d2c0c609ef9a521448b102634b21322a Mon Sep 17 00:00:00 2001
From: shamoon <4887959+shamoon@users.noreply.github.com>
Date: Mon, 13 Jul 2026 09:40:10 -0700
Subject: [PATCH] Security: narrow settings props for signin page

---
 src/__tests__/pages/auth/signin.test.jsx | 27 +++++++++++++++++++++---
 src/pages/auth/signin.jsx                | 10 ++++++++-
 2 files changed, 33 insertions(+), 4 deletions(-)

diff --git a/src/__tests__/pages/auth/signin.test.jsx b/src/__tests__/pages/auth/signin.test.jsx
index 9b40b147f..c9babf09d 100644
--- a/src/__tests__/pages/auth/signin.test.jsx
+++ b/src/__tests__/pages/auth/signin.test.jsx
@@ -60,9 +60,22 @@ describe("pages/auth/signin", () => {
     expect(screen.getByRole("button", { name: /login via oidc/i })).toBeInTheDocument();
   });
 
-  it("getServerSideProps returns providers and settings", async () => {
+  it("getServerSideProps returns providers and only public sign-in settings", async () => {
     getProviders.mockResolvedValueOnce({ foo: { id: "foo", name: "Foo" } });
-    getSettingsMock.mockReturnValueOnce({ theme: "dark" });
+    getSettingsMock.mockReturnValueOnce({
+      theme: "dark",
+      color: "slate",
+      title: "Homepage",
+      background: { image: "background.jpg", opacity: 20 },
+      backgroundOpacity: 10,
+      providers: {
+        longhorn: {
+          username: "admin",
+          password: "secret",
+        },
+      },
+      layout: { Internal: { style: "row" } },
+    });
 
     const res = await getServerSideProps({});
 
@@ -71,8 +84,16 @@ describe("pages/auth/signin", () => {
     expect(res).toEqual({
       props: {
         providers: { foo: { id: "foo", name: "Foo" } },
-        settings: { theme: "dark" },
+        settings: {
+          theme: "dark",
+          color: "slate",
+          title: "Homepage",
+          background: { image: "background.jpg", opacity: 20 },
+          backgroundOpacity: 10,
+        },
       },
     });
+    expect(res.props.settings).not.toHaveProperty("providers");
+    expect(res.props.settings).not.toHaveProperty("layout");
   });
 });
diff --git a/src/pages/auth/signin.jsx b/src/pages/auth/signin.jsx
index bd352911d..fad910091 100644
--- a/src/pages/auth/signin.jsx
+++ b/src/pages/auth/signin.jsx
@@ -6,6 +6,8 @@ import { BiShieldQuarter } from "react-icons/bi";
 
 import { getSettings } from "utils/config/config";
 
+const PUBLIC_SIGN_IN_SETTINGS = ["theme", "color", "title", "background", "backgroundOpacity"];
+
 export default function SignIn({ providers, settings }) {
   const router = useRouter();
   const [password, setPassword] = useState("");
@@ -201,7 +203,13 @@ export default function SignIn({ providers, settings }) {
 
 export async function getServerSideProps(context) {
   const providers = await getProviders();
-  const settings = getSettings();
+  const homepageSettings = getSettings();
+  const settings = Object.fromEntries(
+    PUBLIC_SIGN_IN_SETTINGS.filter((key) => Object.prototype.hasOwnProperty.call(homepageSettings, key)).map((key) => [
+      key,
+      homepageSettings[key],
+    ]),
+  );
   return {
     props: { providers, settings },
   };