Zaki/Password-Manager
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(prefs): stop pulling secret prefs into the renderer just to render the UI

Browse Source 
A renderer dump taken after a quick-unlock, with nothing opened, contained the auto-backup password in cleartext - inside an ExecuteJavaScript string and in the DevTools protocol buffers - and it survived the auto-lock that wipes the vault key.

New prefs/has answers set-or-not without moving the value. The settings panel uses that; only the paths that encrypt a backup, test the WebDAV connection or run a sync fetch the secrets themselves.
This commit is contained in:
r-zakarya
2026-08-02 23:21:03 +01:00
parent 3c14836b15
commit 5ce18e7ab5
4 changed files with 75 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
js/app.sync.js
+23 -8
View File
@@ -106,10 +106,16 @@ function refreshSyncUI(cfg) {
const pre = document.getElementById('syncPreBackup');
if (url) url.value = cfg.url || '';
if (user) user.value = cfg.user || '';
if (pwd) pwd.value = cfg.pwd || '';
if (pwd) {
// Left EMPTY on purpose — the settings panel no longer pulls the stored
// password across. The field only saves on `change`, so an untouched
// empty field never overwrites anything; the placeholder says so.
pwd.value = cfg.pwd || '';
pwd.placeholder = cfg.hasPwd ? 'Saved — type to replace' : '';
}
if (pre) pre.checked = !!cfg.preBackup;
const pwdStatus = document.getElementById('syncPwdStatus');
if (pwdStatus) pwdStatus.textContent = cfg.encPwd ? 'Set.' : 'Not set.';
if (pwdStatus) pwdStatus.textContent = cfg.hasEncPwd ? 'Set.' : 'Not set.';
const last = document.getElementById('syncLast');
if (last) last.textContent = cfg.last
? ' · Last: ' + cfg.last.replace('T', ' ').slice(0, 16)
@@ -146,16 +152,23 @@ async function syncSetEncPwdFlow() {
}
}
async function loadSyncConfig() {
// withSecrets defaults to FALSE: the settings panel only needs to know whether
// the two passwords are set. Fetching them plants the values in the renderer
// for the life of the process — seen in a memory dump, still present after the
// vault had auto-locked. Only the paths that actually talk to the server or
// encrypt a snapshot ask for them.
async function loadSyncConfig(withSecrets) {
if (!Bridge.active) return null;
const [enabled, url, user, pwd, encPwd, pre, last] = await Promise.all([
const [enabled, url, user, pwd, encPwd, pre, last, hasPwd, hasEnc] = await Promise.all([
Bridge.getPref(SYNC_PREFS.enabled),
Bridge.getPref(SYNC_PREFS.url),
Bridge.getPref(SYNC_PREFS.user),
Bridge.getPref(SYNC_PREFS.pwd),
Bridge.getPref(SYNC_PREFS.encPwd),
withSecrets ? Bridge.getPref(SYNC_PREFS.pwd) : Promise.resolve(''),
withSecrets ? Bridge.getPref(SYNC_PREFS.encPwd) : Promise.resolve(''),
Bridge.getPref(SYNC_PREFS.preBackup),
Bridge.getPref(SYNC_PREFS.last),
Bridge.hasPref(SYNC_PREFS.pwd),
Bridge.hasPref(SYNC_PREFS.encPwd),
]);
return {
enabled: enabled === '1',
@@ -163,13 +176,15 @@ async function loadSyncConfig() {
user: user || '',
pwd: pwd || '',
encPwd: encPwd || '',
hasPwd: !!hasPwd,
hasEncPwd: !!hasEnc,
preBackup: pre === '1',
last: last || '',
};
}
async function syncTestConnection() {
const cfg = await loadSyncConfig();
const cfg = await loadSyncConfig(true); // needs the WebDAV credentials
if (!cfg || !cfg.url) return toast('Set the WebDAV URL first', 'warning');
toast('Testing connection…');
const r = await _webdavCall('test', cfg.url, cfg.user, cfg.pwd);
@@ -464,7 +479,7 @@ function syncStatus(text) {
async function runSyncNow(_attempt) {
_attempt = _attempt || 0;
const cfg = await loadSyncConfig();
const cfg = await loadSyncConfig(true); // talks to the server + encrypts
if (!cfg) return toast('Bridge not available', 'error');
if (!cfg.url) return toast('Sync not configured', 'warning');
if (!cfg.encPwd) return toast('Set the sync password first', 'warning');