From b3488f14cae45f98c3c4688cf742bc5590b54460 Mon Sep 17 00:00:00 2001
From: Hermes <hermes@nousagent.com>
Date: Sat, 8 Aug 2026 03:30:20 -0700
Subject: [PATCH] =?UTF-8?q?[grade=3DA]=20P0-3:=20backups=20config=20route?=
 =?UTF-8?q?=20=E2=80=94=20destructure=20req.body=20to=20backups/defaultRet?=
 =?UTF-8?q?ention=20only?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 dashcaddy-api/routes/backups.js | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/dashcaddy-api/routes/backups.js b/dashcaddy-api/routes/backups.js
index b870e56..ae79e5a 100644
--- a/dashcaddy-api/routes/backups.js
+++ b/dashcaddy-api/routes/backups.js
@@ -484,7 +484,14 @@ module.exports = function({ backupManager, licenseManager, asyncHandler }) {
 
   // Update backup configuration
   router.post('/backups/config', asyncHandler(async (req, res) => {
-    backupManager.updateConfig(req.body);
+    // P0-3 fix: was `backupManager.updateConfig(req.body)` which allowed
+    // arbitrary keys from HTTP request body to be merged into persisted config.
+    // Now destructure only the two known top-level fields.
+    const { backups, defaultRetention } = req.body || {};
+    const patch = {};
+    if (backups !== undefined) patch.backups = backups;
+    if (defaultRetention !== undefined) patch.defaultRetention = defaultRetention;
+    backupManager.updateConfig(patch);
     success(res, { message: 'Backup configuration updated' });
   }, 'backups-config-update'));