youngkermit8-coder opened a new issue, #1634: URL: https://github.com/apache/rocketmq-dashboard/issues/1634
## Problem Updating an existing plain-access account with an empty `whiteRemoteAddress` does not clear the stored IP whitelist. `MybatisPlusAclRepository#createAndUpdatePlainAccessConfig` normalizes the empty value to `null` and calls `updateById`, but MyBatis-Plus skips `null` fields by default. The previous `white_remote_address` therefore remains in MySQL even though the UI reports a successful save. This is security-relevant because operators can believe an obsolete network restriction was removed while the stored ACL configuration still contains it. ## Reproduction 1. Create or update a plain-access account with `whiteRemoteAddress = "10.0.0.0/8"`. 2. Edit the same account, clear the IP whitelist field, and save. 3. Re-examine the cluster ACL configuration. 4. The old `10.0.0.0/8` value is still returned. ## Expected An explicitly empty whitelist is persisted as SQL `NULL`, while unrelated user updates continue preserving the existing whitelist. ## Suggested fix Use an explicit MyBatis update assignment for `white_remote_address` in the plain-access upsert path and add a repository regression test that verifies the nullable assignment. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
