Merge pull request #2977 from thelounge/xpaw/setting-new

Add an extra check for setting names

src/server.js

@@ -494,6 +494,10 @@ function initializeClient(socket, client, token, lastMessage) {
 				return;
 			}
 
+			if (typeof newSetting.value === "object" || typeof newSetting.name !== "string" || newSetting.name[0] === "_") {
+				return;
+			}
+
 			// Older user configs will not have the clientSettings property.
 			if (!client.config.hasOwnProperty("clientSettings")) {
 				client.config.clientSettings = {};