From 8549663ed01ebae76ae6a9caf6ad3255786ed789 Mon Sep 17 00:00:00 2001
From: Girish Ramakrishnan <girish@cloudron.io>
Date: Mon, 13 Oct 2025 09:39:01 +0200
Subject: [PATCH] backupsites: do not mutate caller's config object

---
 src/backupsites.js | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/backupsites.js b/src/backupsites.js
index c511be5b0..fad4999da 100644
--- a/src/backupsites.js
+++ b/src/backupsites.js
@@ -492,6 +492,7 @@ async function setConfig(backupSite, newConfig, auditSource) {
 
     const oldConfig = backupSite.config;
 
+    newConfig = structuredClone(newConfig); // make a copy
     storageApi(backupSite).injectPrivateFields(newConfig, oldConfig);
 
     debug('setConfig: validating new storage configuration');