From 1798214cd217a65212bb98b29744f5c99315e61b Mon Sep 17 00:00:00 2001
From: Matthias <matthias.mair@oewf.org>
Date: Fri, 19 Nov 2021 23:59:57 +0100
Subject: [PATCH 1/4] add protected settings in model

---
 InvenTree/common/models.py | 17 ++++++++++++++++-
 1 file changed, 16 insertions(+), 1 deletion(-)

diff --git a/InvenTree/common/models.py b/InvenTree/common/models.py
index 51b4bfd00d..8ceb16e748 100644
--- a/InvenTree/common/models.py
+++ b/InvenTree/common/models.py
@@ -108,7 +108,9 @@ class BaseInvenTreeSetting(models.Model):
         for key, value in settings.items():
             validator = cls.get_setting_validator(key)
 
-            if cls.validator_is_bool(validator):
+            if cls.is_protected(key):
+                value = '***'
+            elif cls.validator_is_bool(validator):
                 value = InvenTree.helpers.str2bool(value)
             elif cls.validator_is_int(validator):
                 try:
@@ -538,6 +540,19 @@ class BaseInvenTreeSetting(models.Model):
 
         return value
 
+    @classmethod
+    def is_protected(cls, key):
+        """
+        Check if the setting value is protected
+        """
+
+        key = str(key).strip().upper()
+
+        if key in cls.GLOBAL_SETTINGS:
+            return cls.GLOBAL_SETTINGS[key].get('protected', False)
+        else:
+            return False
+
 
 def settings_group_options():
     """build up group tuple for settings based on gour choices"""

From 1a6a26204e3d4f4d4bfae076e988ab393e501124 Mon Sep 17 00:00:00 2001
From: Matthias <matthias.mair@oewf.org>
Date: Sat, 20 Nov 2021 00:24:17 +0100
Subject: [PATCH 2/4] make sure protected values are never exposed

---
 InvenTree/common/serializers.py | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/InvenTree/common/serializers.py b/InvenTree/common/serializers.py
index 4a27e3f30e..60eb609dc1 100644
--- a/InvenTree/common/serializers.py
+++ b/InvenTree/common/serializers.py
@@ -45,6 +45,18 @@ class SettingsSerializer(InvenTreeModelSerializer):
 
         return results
 
+    def get_value(self, obj):
+        """
+        Make sure protected values are not returned
+        """
+        result = obj.value
+
+        # never return protected values
+        if obj.is_protected:
+            result = '***'
+
+        return result
+
 
 class GlobalSettingsSerializer(SettingsSerializer):
     """

From f8aa5514ae716b757e0f8362fd65e7e5038590c6 Mon Sep 17 00:00:00 2001
From: Oliver <oliver.henry.walters@gmail.com>
Date: Sat, 20 Nov 2021 17:44:54 +1100
Subject: [PATCH 3/4] Fix BOM export for multi-level BOMs

---
 InvenTree/part/bom.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/InvenTree/part/bom.py b/InvenTree/part/bom.py
index fd31aba339..1fc747655d 100644
--- a/InvenTree/part/bom.py
+++ b/InvenTree/part/bom.py
@@ -59,7 +59,7 @@ def ExportBom(part, fmt='csv', cascade=False, max_levels=None, parameter_data=Fa
 
     uids = []
 
-    def add_items(items, level, cascade):
+    def add_items(items, level, cascade=True):
         # Add items at a given layer
         for item in items:
 

From 6a6eae7e5435beac35c64c0f4af2a9b23c73104f Mon Sep 17 00:00:00 2001
From: Oliver <oliver.henry.walters@gmail.com>
Date: Sat, 20 Nov 2021 18:07:39 +1100
Subject: [PATCH 4/4] Bug fix for BOM uploading

(cherry picked from commit 2e04b311306259e0ead07de9e08b3ba376caf4e4)
---
 InvenTree/part/models.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/InvenTree/part/models.py b/InvenTree/part/models.py
index cec21becc2..638c956ffa 100644
--- a/InvenTree/part/models.py
+++ b/InvenTree/part/models.py
@@ -1587,7 +1587,7 @@ class Part(MPTTModel):
         # Exclude any parts that this part is used *in* (to prevent recursive BOMs)
         used_in = self.get_used_in().all()
 
-        parts = parts.exclude(id__in=[item.part.id for item in used_in])
+        parts = parts.exclude(id__in=[part.id for part in used_in])
 
         return parts