Ensure credentials object is removed before returning node in getFlow…

… request Fixes #3953
node-red · Dec 3, 2022 · c18018f · c18018f
1 parent 14e74af
commit c18018f
Showing 1 changed file with 11 additions and 3 deletions.
diff --git a/packages/node_modules/@node-red/runtime/lib/flows/index.js b/packages/node_modules/@node-red/runtime/lib/flows/index.js
@@ -641,14 +641,18 @@ function getFlow(id) {
                 if (node.type === 'link out') {
                     delete node.wires;
                 }
+                delete node.credentials;
                 return node;
             })
         }
     }
     if (flow.configs) {
         var configIds = Object.keys(flow.configs);
         result.configs = configIds.map(function(configId) {
-            return clone(flow.configs[configId]);
+            const node = clone(flow.configs[configId]);
+            delete node.credentials;
+            return node
+
         })
         if (result.configs.length === 0) {
             delete result.configs;
@@ -660,12 +664,16 @@ function getFlow(id) {
             var subflow = clone(flow.subflows[subflowId]);
             var nodeIds = Object.keys(subflow.nodes);
             subflow.nodes = nodeIds.map(function(id) {
-                return subflow.nodes[id];
+                const node = clone(subflow.nodes[id])
+                delete node.credentials
+                return node
             });
             if (subflow.configs) {
                 var configIds = Object.keys(subflow.configs);
                 subflow.configs = configIds.map(function(id) {
-                    return subflow.configs[id];
+                    const node = clone(subflow.configs[id])
+                    delete node.credentials
+                    return node
                 })
             }
             delete subflow.instances;