From ad9e49e3cf66b0cc9a327f6d8a895b23bbd6fea9 Mon Sep 17 00:00:00 2001
From: Karl Ludwig Weise <ludwig@ludwigweise.de>
Date: Tue, 5 May 2026 11:53:52 +0200
Subject: [PATCH] Prevent data leak from get tenant endpoint

---
 src/routes/api/tenants/[id]/+server.ts | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/src/routes/api/tenants/[id]/+server.ts b/src/routes/api/tenants/[id]/+server.ts
index 6aa0942..4a6faeb 100644
--- a/src/routes/api/tenants/[id]/+server.ts
+++ b/src/routes/api/tenants/[id]/+server.ts
@@ -471,7 +471,20 @@ export const GET: RequestHandler = async ({ params, locals }) => {
     });
 
     return json({
-      tenant: tenantData,
+      tenant: {
+        id: tenantData.id,
+        createdAt: tenantData.createdAt,
+        updatedAt: tenantData.updatedAt,
+        languages: tenantData.languages,
+        defaultLanguage: tenantData.defaultLanguage,
+        shortName: tenantData.shortName,
+        longName: tenantData.longName,
+        descriptions: tenantData.descriptions || {},
+        domain: tenantData.domain,
+        logo: tenantData.logo,
+        setupState: tenantData.setupState,
+        links: tenantData.links,
+      },
     });
   } catch (error) {
     logError(log)("Error getting tenant details", error, locals.user?.id, params.id);