Ensure logo & favicon form assets are used as default values

system/rest/settings.go

@@ -99,5 +99,5 @@ func (ctrl *Settings) Set(ctx context.Context, r *request.SettingsSet) (interfac
 //
 // This is available to all authenticated users
 func (ctrl *Settings) Current(ctx context.Context, r *request.SettingsCurrent) (interface{}, error) {
-	return service.CurrentSettings, nil
+	return service.CurrentSettings.WithDefaults(), nil
 }

system/types/app_settings.go

@@ -290,6 +290,19 @@ type (
 	}
 )
 
+// WithDefaults sets defaults on copy (!!) of settings
+// to avoid any unintended corruption or leaks
+func (cs AppSettings) WithDefaults() *AppSettings {
+	if len(strings.TrimSpace(cs.UI.IconLogo)) == 0 {
+		cs.UI.IconLogo = "/assets/favicon32x32.png"
+	}
+	if len(strings.TrimSpace(cs.UI.MainLogo)) == 0 {
+		cs.UI.MainLogo = "/assets/logo.png"
+	}
+
+	return &cs
+}
+
 func (set *ExternalAuthProvider) ValidConfiguration() bool {
 	if !set.Enabled || set.Handle == "" || set.Key == "" || set.Secret == "" {
 		return false