- Shipped
- 27 ஆகஸ்ட், 2026 அன்று 3:00 PM UTC
- Author
- Kamo
- Commit
- a7ad320
Entering the credentials in the UI reported success and changed nothing. systemConfigApi.update serialises an explicit allowlist rather than the caller's object, so the seven kamoPbx fields never left the browser — SecurityService never even received a request. This is the third allowlist in the same path. Adding a column to SystemConfiguration means touching all three: this one, the controller's UpdateBody, and its toDto. Missing any one fails silently in a different place. Three tests pin it, including that the '***' keep-sentinel survives — dropping or rewriting it would overwrite the master credential on every save.