Skip to content

[API] PUT /api/settings should validate required fields or support PATCH for partial updates #2892

@imparpaulo01

Description

@imparpaulo01

Problem

When calling PUT /api/settings with a partial payload (e.g., only updating SMTP config), the API accepts the request and replaces ALL settings with the partial payload. This causes:

  1. Required fields like app.lang and upload.provider become empty strings
  2. Listmonk crashes on next restart with panic: invalid value: app.lang=
  3. Server becomes unbootable until database is manually fixed via direct SQL

Steps to Reproduce

  1. Have a working Listmonk instance with configured settings
  2. Call PUT /api/settings with only SMTP configuration:
{
  "smtp": [{...smtp config...}]
}
  1. API returns success
  2. Restart Listmonk container
  3. Result: Server crashes with panic: invalid value: app.lang=

Expected Behavior

Either:

  • Option A: Validate that required fields are present before accepting the update, return 400 error if critical settings would be wiped
  • Option B: Support PATCH /api/settings for partial/merge updates (only modify fields that are sent)
  • Option C: Document clearly that PUT replaces ALL settings and partial payloads will break the instance

Current Workaround

Must fetch ALL settings first via GET /api/settings, modify the specific field in the response, then PUT the entire object back. This is error-prone and not documented.

Environment

  • Listmonk version: v6.0.0
  • Deployment: Docker (via Coolify)
  • Database: PostgreSQL 16

Related Issues

Impact

This issue caused production downtime twice - the server became completely unbootable until we manually restored ~20 settings via direct database access.

Metadata

Metadata

Assignees

Labels

No labels
No labels

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions