FIX: hide dangerous dev only site settings in production

(port/force hostname/queue jobs)

config/site_settings.yml

@@ -589,12 +589,22 @@ rate_limits:
   max_replies_in_first_day: 10
 
 developer:
-  force_hostname: ''
+  force_hostname:
+    hidden:
+      development: false
+      default: true
+    default: ''
   port:
+    hidden:
+      development: false
+      default: true
     default:
       development: 3000
       default: ''
   queue_jobs:
+    hidden:
+      development: false
+      default: true
     default:
       test: false
       default: true

lib/site_settings/yaml_loader.rb

@@ -6,17 +6,24 @@ class SiteSettings::YamlLoader
     @file = file
   end
 
+  def env_val(value)
+    if value.is_a?(Hash)
+      value.has_key?(Rails.env) ? value[Rails.env] : value['default']
+    else
+      value
+    end
+  end
+
   def load
     yaml = YAML.load_file(@file)
     yaml.keys.each do |category|
       yaml[category].each do |setting_name, hash|
         if hash.is_a?(Hash)
           # Get default value for the site setting:
-          value = hash.delete('default')
+          value = env_val(hash.delete('default'))
 
-          # If there's a different default value for each environment, choose the right one:
+          if hash.key?('hidden')
-          if value.is_a?(Hash)
+            hash['hidden'] = env_val(hash.delete('hidden'))
-            value = value.has_key?(Rails.env) ? value[Rails.env] : value['default']
           end
 
           yield category, setting_name, value, hash.symbolize_keys!