Fix security bug which autofilled passwords without passcode/faceid auth

The autofill extension currently calls the success callback even if a
passcode/FaceID is not successfully verified.

In the case that the PGP key passphrase is stored, this results in
password decryption without further user interaction.

The fix is to only decrypt passwords upon successful passcode / FaceID
verification.
This commit is contained in:
Allan Feldman 2023-02-27 22:53:06 -05:00 committed by Mingshen Sun
parent 6cf6ef1d45
commit 83c6ae33dc

View file

@ -22,9 +22,7 @@ class PasscodeExtensionDisplay {
before?()
passcodeLockVC.successCallback = after
passcodeLockVC.modalPresentationStyle = .fullScreen
sender.parent?.present(passcodeLockVC, animated: false) {
after?()
}
sender.parent?.present(passcodeLockVC, animated: false)
} else {
after?()
}