lib/backup-crypto.js

@@ -27,8 +27,6 @@ function encrypt(config, password) {
   const encrypted = Buffer.concat([cipher.update(plaintext), cipher.final()]);
   const tag = cipher.getAuthTag();
 
-  plaintext.fill(0);
-  key.fill(0);
   return Buffer.concat([MAGIC, salt, iv, tag, encrypted]);
 }
 
@@ -67,9 +65,6 @@ function decrypt(buffer, password) {
     return JSON.parse(decrypted.toString('utf-8'));
   } catch {
     throw new Error('Entschlüsselte Daten sind kein gültiges JSON');
-  } finally {
-    decrypted.fill(0);
-    key.fill(0);
   }
 }
 

main.js

@@ -649,19 +649,17 @@ ipcMain.handle('import-backup', async (_event, password) => {
   });
   if (canceled || !filePaths.length) return { ok: false, canceled: true };
   const buffer = fs.readFileSync(filePaths[0]);
-  const imported = backupCrypto.decrypt(buffer, password);
-  // Safety net: timestamped backup so multiple imports don't overwrite each other
-  const ts = new Date().toISOString().replace(/[:.]/g, '-');
-  const preImportPath = configStore.filePath.replace('.json', `.pre-import-${ts}.json`);
+  const config = backupCrypto.decrypt(buffer, password);
+  // Safety net: save current config before overwriting
+  const preImportPath = configStore.filePath + '.pre-import.json';
   try { fs.copyFileSync(configStore.filePath, preImportPath); } catch {}
-  // Single atomic write — no split state, no TOCTOU race
-  const merged = {
-    hosters: imported.hosters,
-    hosterSettings: imported.hosterSettings,
-    globalSettings: imported.globalSettings,
-    history: imported.history || []
-  };
-  await configStore._atomicWrite(JSON.stringify(merged, null, 2));
+  await configStore.save(config);
+  if (config.history) {
+    // Overwrite history too (save() doesn't touch history)
+    const full = configStore.load();
+    full.history = config.history;
+    await configStore._atomicWrite(JSON.stringify(full, null, 2));
+  }
   return { ok: true, config: configStore.load() };
 });
 

package.json

@@ -1,6 +1,6 @@
 {
   "name": "multi-hoster-uploader",
-  "version": "1.7.1",
+  "version": "1.7.0",
   "description": "Upload files to doodstream, voe, vidmoly, byse simultaneously",
   "main": "main.js",
   "scripts": {

renderer/app.js

@@ -857,14 +857,9 @@ async function confirmBackupAction() {
       if (result.ok) {
         config = result.config;
         hosterSettings = config.hosterSettings || {};
-        // Refresh global settings state (always-on-top, etc.)
-        alwaysOnTopState = !!(config.globalSettings && config.globalSettings.alwaysOnTop);
-        window.api.setAlwaysOnTop(alwaysOnTopState);
         closeBackupModal();
-        renderSettings();
-        renderAccounts();
-        renderHosterSummary();
-        renderHosterModal();
+        renderSettingsPanel();
+        renderAccountsList();
         loadHistory();
         showCopyToast('Backup importiert');
       }