From 51cbeccb080af16c19b85739a62bc5733fda06fb Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Bar=C4=B1=C5=9F=20Soner=20U=C5=9Fakl=C4=B1?=
 <barisusakli@gmail.com>
Date: Tue, 16 Nov 2021 19:20:18 -0500
Subject: [PATCH] refactor: clone settings before returning

prevents plugins from mistakenly modifying saved settings in cache
---
 src/meta/settings.js | 22 +++++++++++++---------
 1 file changed, 13 insertions(+), 9 deletions(-)

diff --git a/src/meta/settings.js b/src/meta/settings.js
index badfa791bd..01944dac0e 100644
--- a/src/meta/settings.js
+++ b/src/meta/settings.js
@@ -1,5 +1,7 @@
 'use strict';
 
+const _ = require('lodash');
+
 const db = require('../database');
 const plugins = require('../plugins');
 const Meta = require('./index');
@@ -11,29 +13,31 @@ const Settings = module.exports;
 Settings.get = async function (hash) {
 	const cached = cache.get(`settings:${hash}`);
 	if (cached) {
-		return cached;
+		return _.cloneDeep(cached);
 	}
-	let data = await db.getObject(`settings:${hash}`) || {};
-	const sortedLists = await db.getSetMembers(`settings:${hash}:sorted-lists`);
-
+	const [data, sortedLists] = await Promise.all([
+		db.getObject(`settings:${hash}`),
+		db.getSetMembers(`settings:${hash}:sorted-lists`),
+	]);
+	const values = data || {};
 	await Promise.all(sortedLists.map(async (list) => {
 		const members = await db.getSortedSetRange(`settings:${hash}:sorted-list:${list}`, 0, -1) || [];
 		const keys = [];
 
-		data[list] = [];
+		values[list] = [];
 		for (const order of members) {
 			keys.push(`settings:${hash}:sorted-list:${list}:${order}`);
 		}
 
 		const objects = await db.getObjects(keys);
 		objects.forEach((obj) => {
-			data[list].push(obj);
+			values[list].push(obj);
 		});
 	}));
 
-	({ values: data } = await plugins.hooks.fire('filter:settings.get', { plugin: hash, values: data }));
-	cache.set(`settings:${hash}`, data);
-	return data;
+	const result = await plugins.hooks.fire('filter:settings.get', { plugin: hash, values: values });
+	cache.set(`settings:${hash}`, result.values);
+	return _.cloneDeep(result.values);
 };
 
 Settings.getOne = async function (hash, field) {