pleroma/pleroma-fe
0
0
Fork 0
Code Issues 343 Pull requests 27 Projects Releases Packages Wiki Activity

Do not trust v-model in login input, for password manager's autofill #2972

Open
xnuk wants to merge 1 commit from gitlab-mr-iid-1705 into develop
pull from: gitlab-mr-iid-1705
merge into: pleroma:develop
Conversation 5 Commits 1 Files changed 2 +6 -5
xnuk commented 2022-12-21 07:56:36 +00:00
Member
Copy link

Changes

  • Make login successful after password manager (specifically Keepass Tusk) autofills.
    • Previously it sent {username: undefined, password: undefined} to the backend, even if it's filled.

The v-model is not updated after the autofill somehow. Instead of adding more listener like onchange, this tries to don't rely on v-model and get username and password from $refs.

# Changes * Make login successful after password manager (specifically [Keepass Tusk]) autofills. * Previously it sent `{username: undefined, password: undefined}` to the backend, even if it's filled. The `v-model` is not updated after the autofill somehow. Instead of adding more listener like `onchange`, this tries to don't rely on `v-model` and get `username` and `password` from `$refs`. [Keepass Tusk]: https://github.com/subdavis/tusk
lambadalambda commented 2022-12-21 13:40:26 +00:00
Owner
Copy link

I wonder if this is related to the issue in #2806/diffs

I wonder if this is related to the issue in https://git.pleroma.social/pleroma/pleroma-fe/pulls/2806/diffs
hj commented 2022-12-21 18:21:23 +00:00
Owner
Copy link

I can say that it doesn't affect me with KeePassXC-Browser at least, not sure if this necessary since Keepass Tusk seems to be obsolete/deprecated.

I can say that it doesn't affect me with KeePassXC-Browser at least, not sure if this necessary since Keepass Tusk seems to be obsolete/deprecated.
hj commented 2022-12-21 18:22:10 +00:00
Owner
Copy link

in general i would prefer if extensions fixed their issues themselves, as we can't possibly keep up with whatever hacks they are coming up with.

in general i would prefer if extensions fixed their issues themselves, as we can't possibly keep up with whatever hacks they are coming up with.
xnuk commented 2022-12-29 13:51:20 +00:00
Author
Member
Copy link

Doing this in the console:

document.getElementById('username').value = 'username here'
document.getElementById('password').value = 'password here'
document.querySelector('form.login-form button[type=submit]').click()

makes send this request, both "username" and "password" are undefined:

POST /oauth/token
-----------------------------15028169781311006156611277227
Content-Disposition: form-data; name="client_id"

[REDACTED]
-----------------------------15028169781311006156611277227
Content-Disposition: form-data; name="client_secret"

[REDACTED]
-----------------------------15028169781311006156611277227
Content-Disposition: form-data; name="grant_type"

password
-----------------------------15028169781311006156611277227
Content-Disposition: form-data; name="username"

undefined
-----------------------------15028169781311006156611277227
Content-Disposition: form-data; name="password"

undefined
-----------------------------15028169781311006156611277227--

I don't think Keepass Tusk has a problem, it looks okay to me: https://github.com/subdavis/Tusk/blob/develop/background/inject.js#L168-L191

Doing this in the console: ```js document.getElementById('username').value = 'username here' document.getElementById('password').value = 'password here' document.querySelector('form.login-form button[type=submit]').click() ``` makes send this request, both "username" and "password" are undefined: ``` POST /oauth/token -----------------------------15028169781311006156611277227 Content-Disposition: form-data; name="client_id" [REDACTED] -----------------------------15028169781311006156611277227 Content-Disposition: form-data; name="client_secret" [REDACTED] -----------------------------15028169781311006156611277227 Content-Disposition: form-data; name="grant_type" password -----------------------------15028169781311006156611277227 Content-Disposition: form-data; name="username" undefined -----------------------------15028169781311006156611277227 Content-Disposition: form-data; name="password" undefined -----------------------------15028169781311006156611277227-- ``` I don't think Keepass Tusk has a problem, it looks okay to me: https://github.com/subdavis/Tusk/blob/develop/background/inject.js#L168-L191
xnuk commented 2022-12-29 13:54:19 +00:00
Author
Member
Copy link

Maybe off-topic: Although Keepass Tusk is deprecated, I'm still using Tusk because I have a problem to connecting between Keepass client and browser extension like KeepassXC-Browser, every time I tried.

Maybe off-topic: Although Keepass Tusk is deprecated, I'm still using Tusk because I have a problem to connecting between Keepass client and browser extension like KeepassXC-Browser, every time I tried.
This pull request has changes conflicting with the target branch.
  • src/components/login_form/login_form.js
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin gitlab-mr-iid-1705:gitlab-mr-iid-1705
git switch gitlab-mr-iid-1705

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch develop
git merge --no-ff gitlab-mr-iid-1705
git switch gitlab-mr-iid-1705
git rebase develop
git switch develop
git merge --ff-only gitlab-mr-iid-1705
git switch gitlab-mr-iid-1705
git rebase develop
git switch develop
git merge --no-ff gitlab-mr-iid-1705
git switch develop
git merge --squash gitlab-mr-iid-1705
git switch develop
git merge --ff-only gitlab-mr-iid-1705
git switch develop
git merge gitlab-mr-iid-1705
git push origin develop
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
BE Request

   
Backlog

   
Better behavior

   
Blocked by deps

   
Bug

   
Code Review

   
Discussion

   
Doing

   
Feature Request / Enhancement

   
In the shining bright future maybe

   
It's complicated

   
MS Edge

   
Mememoon (or other niche browsers)

   
Missing API

   
Missing feature

   
Missing l10n/i18n

   
NL1

Instance Admin Dashboard

  
NL2

Improved Mobile Experience

  
NL4

Improved instance customization and QoL options

  
Need to verify on develop

   
RELEASE BLOCKER

   
Reassign or Close

   
Refactor

   
Regression

   
Safari

   
To Do

   
User story

   
Waiting on godot

   
accessibility

https://git.pleroma.social/pleroma/pleroma-fe/-/snippets/7746

  
better documentation

   
chore

   
confirmed

   
easy ticket

   
incident

Denotes a disruption to IT services and the associated issues require immediate attention

  
l10n update

   
mastoapi

   
mobile

   
needs design

   
needs-info

   
needs-review

   
stupid
No labels
BE Request
Backlog
Better behavior
Blocked by deps
Bug
Code Review
Discussion
Doing
Feature Request / Enhancement
In the shining bright future maybe
It's complicated
MS Edge
Mememoon (or other niche browsers)
Missing API
Missing feature
Missing l10n/i18n
NL1
NL2
NL4
Need to verify on develop
RELEASE BLOCKER
Reassign or Close
Refactor
Regression
Safari
To Do
User story
Waiting on godot
accessibility
better documentation
chore
confirmed
easy ticket
incident
l10n update
mastoapi
mobile
needs design
needs-info
needs-review
stupid
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
3 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
pleroma/pleroma-fe!2972
No description provided.