bitwarden/browser
1
0
Fork 0
mirror of https://github.com/bitwarden/browser synced 2025-12-21 02:33:46 +00:00
Code Issues Releases Wiki Activity

Remove password hint responses from API (#10523)

Browse Source 
* Log reloading behavior

* Remove hints from responses.

changing password implies updating the hint, but no longer displays the old one. This is a security risk for shoulder surfing and breaks the escrow model we have where it is only shared via email when requested.

* Update change password hint label
This commit is contained in:
Matt Gibson
2024-08-23 10:51:42 -07:00
committed by GitHub
parent aa7c9685b6
commit c2829cd71b
7 changed files with 12 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
apps/web/src/app/auth/settings/change-password.component.ts
View File

@@ -83,7 +83,6 @@ export class ChangePasswordComponent
this.router.navigate(["/settings/security/two-factor"]);
}
this.masterPasswordHint = (await this.apiService.getProfile()).masterPasswordHint;
await super.ngOnInit();
this.characterMinimumMessage = this.i18nService.t("characterMinimum", this.minimumLength);
@@ -138,7 +137,10 @@ export class ChangePasswordComponent
}
async submit() {
if (this.masterPasswordHint != null && this.masterPasswordHint == this.masterPassword) {
if (
this.masterPasswordHint != null &&
this.masterPasswordHint.toLowerCase() === this.masterPassword.toLowerCase()
) {
this.platformUtilsService.showToast(
"error",
this.i18nService.t("errorOccurred"),