From 710b6a719e8974151b5d035c1872cf51dbedd678 Mon Sep 17 00:00:00 2001
From: CN-JS-HuiBai <huyang@littlediary.cn>
Date: Fri, 10 Apr 2026 22:16:43 +0800
Subject: [PATCH] =?UTF-8?q?=E5=AE=89=E5=85=A8=E6=80=A7=E8=83=BD=E4=BC=98?=
 =?UTF-8?q?=E5=8C=96?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 server/index.js | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/server/index.js b/server/index.js
index e1e3a2c..605a564 100644
--- a/server/index.js
+++ b/server/index.js
@@ -158,6 +158,8 @@ async function getSiteSettingsRow() {
 async function requireServerDetailsAccess(req, res, next) {
   try {
     const settings = await getSiteSettingsRow();
+    req.siteSettings = settings; // Store for later use (e.g. IP stripping)
+    
     const requiresLogin = settings.require_login_for_server_details !== undefined
       ? !!settings.require_login_for_server_details
       : true;
@@ -1216,6 +1218,13 @@ app.get('/api/metrics/server-details', requireServerDetailsAccess, async (req, r
 
     // Fetch detailed metrics
     const details = await prometheusService.getServerDetails(sourceUrl, instance, job);
+
+    // Dynamic field removal based on security settings: PHYSICAL DATA STRIPPING
+    if (!req.siteSettings || !req.siteSettings.show_server_ip) {
+      delete details.ipv4;
+      delete details.ipv6;
+    }
+
     res.json(details);
   } catch (err) {
     console.error(`Error fetching server details for ${instance}:`, err.message);