Skip to content

[IMPROVE] Adding input type=password to AWS secrets fields#28159

Merged
kodiakhq[bot] merged 6 commits into
developfrom
fix/security-issue-password-input-text
Mar 10, 2023
Merged

[IMPROVE] Adding input type=password to AWS secrets fields#28159
kodiakhq[bot] merged 6 commits into
developfrom
fix/security-issue-password-input-text

Conversation

@hugocostadev

@hugocostadev hugocostadev commented Feb 24, 2023

Copy link
Copy Markdown
Contributor

Proposed changes (including videos or screenshots)

Some fields that store secrets for AWS were exposing sensitive data because they didn't have the input type as password.

The change includes adding the password type and also changing the autocomplete value from <PasswordInput /> component to add the value new-password to avoid the browser autocompleting with the existing password. (This does not prevent the browser to show the hint to add the password)

Issue(s)

Steps to test or reproduce

GO to admin panel > settings > file upload > amazon S3

  • Access Key: Your Amazon Access Key ID (optional)
  • Secret Key: Your Amazon Secret Access Key (optional)

Further comments

TC-498

@hugocostadev hugocostadev requested a review from a team as a code owner February 24, 2023 18:30
@codecov

codecov Bot commented Feb 24, 2023

Copy link
Copy Markdown

Codecov Report

Merging #28159 (ca1505b) into develop (5444bf5) will increase coverage by 12.60%.
The diff coverage is n/a.

Impacted file tree graph

@@             Coverage Diff              @@
##           develop   #28159       +/-   ##
============================================
+ Coverage    32.61%   45.22%   +12.60%     
============================================
  Files          621      759      +138     
  Lines        12367    14784     +2417     
  Branches      1862     2085      +223     
============================================
+ Hits          4034     6686     +2652     
+ Misses        8135     7804      -331     
- Partials       198      294       +96     
Flag Coverage Δ
e2e 45.18% <ø> (+12.56%) ⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

@gabriellsh gabriellsh added this to the 6.1.0 milestone Feb 24, 2023
@dionisio-bot dionisio-bot Bot added the stat: ready to merge PR tested and approved waiting for merge label Feb 28, 2023
@sampaiodiego sampaiodiego removed the stat: ready to merge PR tested and approved waiting for merge label Feb 28, 2023
@hugocostadev hugocostadev added the stat: ready to merge PR tested and approved waiting for merge label Mar 10, 2023
@dionisio-bot dionisio-bot Bot added stat: ready to merge PR tested and approved waiting for merge and removed stat: ready to merge PR tested and approved waiting for merge labels Mar 10, 2023
@dionisio-bot dionisio-bot Bot added stat: ready to merge PR tested and approved waiting for merge and removed stat: ready to merge PR tested and approved waiting for merge labels Mar 10, 2023
@kodiakhq kodiakhq Bot merged commit 3bdb5ce into develop Mar 10, 2023
@kodiakhq kodiakhq Bot deleted the fix/security-issue-password-input-text branch March 10, 2023 16:12
gabriellsh added a commit that referenced this pull request Mar 13, 2023
…ketChat/Rocket.Chat into matrixSearchTestBranch

* 'feat/federation-public-room-search-2' of github.com:RocketChat/Rocket.Chat: (42 commits)
  refactor: Replace `_.isObject` with `isObject` (#28376)
  fix: small tweaks
  chore: Remove old css (#28140)
  fix: Thread list not scrolling to bottom when sending a message. (#28346)
  refactor: Federation refactor towards services + file names improvement + E2E tests fixes (#28326)
  i18n: Language update from LingoHub 🤖 on 2023-03-10Z (#28365)
  refactor: Improve sidebar search list hook (#28328)
  Chore: Change the PR title check to use conventional commits (#28358)
  [IMPROVE] Galician onboarding translation (#27908)
  [IMPROVE] Adding input type=password to AWS secrets fields (#28159)
  [FIX] Normal and multiline messages adding extra spaces upon copying/pasting (#28187)
  Chore: remove unused prop in register workspace modal (#28317)
  [FIX] App crashing when switching to Hindi (hi-In) language (#28285)
  [NEW] Registered Loom oEmbed (#28339)
  fix: create dm users before join the room
  tests: add unit tests + small tweaks
  fix: fix invite links button logic
  chore: fix lint
  Chore: Remove/replace some Meteor packages (#28189)
  Chore: Unused/dead code removal (#28155)
  ...
@casalsgh casalsgh modified the milestones: 6.1.0, 6.1.0 special Mar 27, 2023
@sampaiodiego sampaiodiego mentioned this pull request May 16, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

stat: ready to merge PR tested and approved waiting for merge

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants