LiveChat config endpoint sends customFields

[wreiske]

The /api/v1/livechat/config endpoint leaks custom fields. These may contain private, identifiable information about an agent.

Please remove the custom fields object from the livechat config endpoint, or make it configurable and OFF by default.

[renatobecker]

@wreiske Here we will do the same action that we did in the CRM integration.
Please, take a look at #16286

[ashwaniYDV]

@wreiske I'm not able to reproduce this issue. Can you please help.
I've added custom fileds here http://localhost:3000/livechat-manager/customfields.
Now when I called the api through postman /api/v1/livechat/config, there was no customFileds property.

[wreiske]

The custom fields are not the livechat custom fields, they are custom fields on normal users in Rocket.Chat. You'll have to add the custom fields from the admin, not the livechat settings.

For example, a normal user may have custom fields such as "Home Phone" or "Personal Email" or something. Those fields are what shows in the livechat config, leaking the agent's information.

[engelgabriel]

@renatobecker any updates on this one?

[renatobecker]

@renatobecker any updates on this one?

@engelgabriel I'll work on this issue and I'll make sure that we'll fix it on the next release: 3.3.
Thanks for bringing it up.