prehistoric-systems/keepassxc-browser
1
0
Fork 0
mirror of https://github.com/keepassxreboot/keepassxc-browser.git synced 2026-03-11 08:54:43 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Fix plain text password fill prevention (#2259)

Browse source 
Fix plain text password fill prevention
This commit is contained in:
Sami Vänttinen 2024-07-04 07:56:33 +03:00 committed by GitHub
parent ebde8ef4b7
commit 83d536698d
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 9 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

16
keepassxc-browser/content/fill.js
View file

@ -24,10 +24,6 @@ kpxcFill.fillAttributeToActiveElementWith = async function(attr) {
// Fill requested from the context menu. Active element is used for combination detection
kpxcFill.fillInFromActiveElement = async function(passOnly = false) {
const elem = document.activeElement;
if (passOnly && !passwordFillIsAllowed(elem)) {
kpxcUI.createNotification('warning', tr('fieldsPasswordFillNotAccepted'));
return;
}
await kpxc.receiveCredentialsIfNecessary();
if (kpxc.credentials.length === 0) {
@ -150,7 +146,7 @@ kpxcFill.fillTOTPFromUuid = async function(el, uuid) {
if (user.totp?.length > 0) {
// Retrieve a new TOTP value
const totp = await sendMessage('get_totp', [ user.uuid, user.totp ]);
const totp = await sendMessage('get_totp', [user.uuid, user.totp]);
if (!totp) {
kpxcUI.createNotification('warning', tr('credentialsNoTOTPFound'));
return;
@ -250,12 +246,18 @@ kpxcFill.fillInCredentials = async function(combination, predefinedUsername, uui
}
// Fill password
if (combination.password) {
if (combination.password && combination.password.nodeName === 'INPUT') {
// Show a notification if password length exceeds the length defined in input
if (combination.password.maxLength
&& combination.password.maxLength > 0
&& selectedCredentials.password.length > combination.password.maxLength) {
kpxcUI.createNotification('error', tr('errorMessagePaswordLengthExceeded'));
kpxcUI.createNotification('warning', tr('errorMessagePaswordLengthExceeded'));
}
// Prevent filling password to plain text input field
if (passOnly && !passwordFillIsAllowed(combination.password)) {
kpxcUI.createNotification('error', tr('fieldsPasswordFillNotAccepted'));
return;
}
kpxc.setValueWithChange(combination.password, selectedCredentials.password);