creating2morrow/neveko
1
0
Fork 0
mirror of https://github.com/creating2morrow/neveko.git synced 2025-01-03 09:29:39 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

patch wallet password from gui

Browse source
This commit is contained in:
creating2morrow 2023-06-10 05:23:56 -04:00
parent 543f2befde
commit f01449c8bf
3 changed files with 17 additions and 16 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
neveko-gui/src/apps/lock_screen.rs
View file

@ -45,6 +45,8 @@ impl LockScreenApp {
self.is_locked self.is_locked
} }
pub fn set_lock(&mut self) { pub fn set_lock(&mut self) {
// clear wallet password from user environment on screen lock
std::env::set_var(neveko_core::MONERO_WALLET_PASSWORD, "");
self.is_locked = true self.is_locked = true
} }
} }
@ -58,6 +60,7 @@ impl eframe::App for LockScreenApp {
ui.add(egui::TextEdit::singleline(&mut self.lock_screen.credential).password(true)); ui.add(egui::TextEdit::singleline(&mut self.lock_screen.credential).password(true));
}); });
if ui.button("Login").clicked() { if ui.button("Login").clicked() {
std::env::set_var(neveko_core::MONERO_WALLET_PASSWORD, self.lock_screen.credential.clone());
// Get the credential hash from lmdb // Get the credential hash from lmdb
let s = db::Interface::open(); let s = db::Interface::open();
let r = db::Interface::read(&s.env, &s.handle, CREDENTIAL_KEY); let r = db::Interface::read(&s.env, &s.handle, CREDENTIAL_KEY);

16
neveko-gui/src/login.rs
View file

@ -9,15 +9,18 @@ use sha2::{
pub struct LoginApp { pub struct LoginApp {
pub credential: String, pub credential: String,
pub is_cred_generated: bool, pub is_cred_generated: bool,
pub is_not_showing_password: bool,
} }
impl Default for LoginApp { impl Default for LoginApp {
fn default() -> Self { fn default() -> Self {
let credential = utils::empty_string(); let credential = utils::empty_string();
let is_cred_generated = false; let is_cred_generated = false;
let is_not_showing_password = true;
LoginApp { LoginApp {
credential, credential,
is_cred_generated, is_cred_generated,
is_not_showing_password,
} }
} }
} }
@ -33,12 +36,17 @@ impl eframe::App for LoginApp {
ui.label("it will not be displayed again after logging in"); ui.label("it will not be displayed again after logging in");
ui.label("use this or set your own secure password."); ui.label("use this or set your own secure password.");
ui.horizontal(|ui| { ui.horizontal(|ui| {
let cred_label = ui.label("credential: \t"); ui.label("credential: \t");
ui.text_edit_singleline(&mut self.credential) let mut show_password = self.is_not_showing_password;
.labelled_by(cred_label.id); ui.add(egui::TextEdit::singleline(&mut self.credential).password(self.is_not_showing_password));
if ui.checkbox(&mut show_password, "show password").changed() {
self.is_not_showing_password = !self.is_not_showing_password;
}
}); });
if ui.button("Login").clicked() { if ui.button("Login").clicked() {
// TODO(c2m): security / encryption, for now only the hash of auth put in lmdb // temporarily set the password to user environment and clear with screenlock
// we set it here for the initial launch of neveko
std::env::set_var(neveko_core::MONERO_WALLET_PASSWORD, self.credential.clone());
let k = CREDENTIAL_KEY; let k = CREDENTIAL_KEY;
let mut hasher = Sha512::new(); let mut hasher = Sha512::new();
hasher.update(self.credential.clone()); hasher.update(self.credential.clone());

14
neveko-gui/src/wrap_app.rs
View file

@ -222,6 +222,8 @@ impl eframe::App for WrapApp {
#[cfg(feature = "glow")] #[cfg(feature = "glow")]
fn on_exit(&mut self, _gl: Option<&glow::Context>) { fn on_exit(&mut self, _gl: Option<&glow::Context>) {
// sanity check that wallet password is no longer in user environment
std::env::set_var(neveko_core::MONERO_WALLET_PASSWORD, "");
utils::kill_child_processes(false); utils::kill_child_processes(false);
} }
} }
@ -297,18 +299,6 @@ impl WrapApp {
ctx.request_repaint(); ctx.request_repaint();
}); });
} }
/*
TODO(c2m): SECURITY!:
Ok, so this here is by far the greatest security loophole.
An attacker could reset the credential in the db to any value,
besides setting the wallet password on initial load, better change
the key for storing the random 32 byte credential to be some strong
user entry and then reset wallet password with that. But anyways if
someone has access to the machine it sucks because neveko gpg key
doesn't have a passphrase.
*/
/// Validate that a credential was set by the user; /// Validate that a credential was set by the user;
fn check_credential_key(&mut self, tx: Sender<bool>, ctx: egui::Context) { fn check_credential_key(&mut self, tx: Sender<bool>, ctx: egui::Context) {
tokio::spawn(async move { tokio::spawn(async move {