Hide api key in xhr-responses if key is configured in config.php #454
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Codecov Report
@@ Coverage Diff @@
## master #454 +/- ##
============================================
+ Coverage 53.17% 56.12% +2.95%
- Complexity 268 269 +1
============================================
Files 17 17
Lines 961 930 -31
============================================
+ Hits 511 522 +11
+ Misses 450 408 -42
Continue to review full report at Codecov.
|
IljaN
force-pushed
the
dont_leak_apikey
branch
from
1ced22c
to
a8eec47
Compare
IljaN
changed the title
|
@IljaN no UI changes needed ? would be good to add a bit more context when writing PRs, make sure to think about who will review it and what questions they'll have |
|
@PVince81 No, the existing frontend code seems to handle it pretty well. User is shown as Logged-In and change-api-key button is hidden. |
|
Updated PR description |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
If the api-key is configured via config.php the api-key is still leaked via XHR-Responses. This PR hides the API-Key in this case. Contrary to assumptions made in #453 the frontend does not need any changes as it seems to be able to handle the missing apiKey-field without errors.
Fixes #453