search

psi-4ward / psitransfer

Simple open source self-hosted file sharing solution.
BSD 2-Clause "Simplified" License
1.5k stars 217 forks source link

Induce Bitwarden to autofill a password as an extraction code in the PsiTransfer web page. #238

Open YamatoRyou opened 2 years ago

YamatoRyou commented 2 years ago

I deployed a PsiTransfer instance in Docker, the web address is http://192.168.0.x:21xxx. At the same time, http://192.168.0.x:5xxx is the address of Synology's web desktop. The browser uses Bitwarden is used to automatically fill in the password when logging in. But this caused a problem: Bitwarden found the text box with the element ID password in the PsiTransfer web page, and automatically filled the password here. The password here is used to log in http://192.168.0.x:5xxx, my password will be leaked a little accidentally.

Under the premise of refusing to give up the autofill password, the current temporary solution is: use Tampermonky to inject code into the PsiTransfer web page, the purpose is to modify the element ID of the extraction code text box to other, to avoid Bitwarden autofill.

{9E17C55F-D225-D5BE-474D-0D44661E4F9F}

YamatoRyou commented 2 years ago

I switched to another method: modify upload.js and mount it inside the container /app/public/app/ Replace the file with the same name.