Skip to content

Commit b122b3e

Browse files
engcom-Foxtrotengcom-Foxtrot
committed
security-package/issues/234:
Auto-fill browser functionality can override API keys for reCAPCTH and block Admin Panel access
1 parent b1fbd95 commit b122b3e

File tree

6 files changed

+18
-6
lines changed

6 files changed

+18
-6
lines changed

‎ReCaptchaVersion2Checkbox/etc/adminhtml/system.xml‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,9 +6,10 @@
66
showInStore="0">
77
<label>reCAPTCHA v2 ("I am not a robot")</label>
88

9-
<field id="public_key" translate="label" type="text" sortOrder="10" showInDefault="1" showInWebsite="0"
9+
<field id="public_key" translate="label" type="obscure" sortOrder="10" showInDefault="1" showInWebsite="0"
1010
showInStore="0" canRestore="0">
1111
<label>Google API Website Key</label>
12+
<backend_model>Magento\Config\Model\Config\Backend\Encrypted</backend_model>
1213
</field>
1314

1415
<field id="private_key" translate="label" type="obscure" sortOrder="20" showInDefault="1" showInWebsite="0"
@@ -49,9 +50,10 @@
4950
showInStore="1">
5051
<label>reCAPTCHA v2 ("I am not a robot")</label>
5152

52-
<field id="public_key" translate="label" type="text" sortOrder="10" showInDefault="1" showInWebsite="1"
53+
<field id="public_key" translate="label" type="obscure" sortOrder="10" showInDefault="1" showInWebsite="1"
5354
showInStore="0" canRestore="0">
5455
<label>Google API Website Key</label>
56+
<backend_model>Magento\Config\Model\Config\Backend\Encrypted</backend_model>
5557
</field>
5658

5759
<field id="private_key" translate="label" type="obscure" sortOrder="20" showInDefault="1" showInWebsite="1"

‎ReCaptchaVersion2Checkbox/etc/config.xml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@
1010
<default>
1111
<recaptcha_backend>
1212
<type_recaptcha>
13+
<public_key backend_model="Magento\Config\Model\Config\Backend\Encrypted"/>
1314
<private_key backend_model="Magento\Config\Model\Config\Backend\Encrypted"/>
1415
<size>normal</size>
1516
<theme>light</theme>
@@ -19,6 +20,7 @@
1920
</recaptcha_backend>
2021
<recaptcha_frontend>
2122
<type_recaptcha>
23+
<public_key backend_model="Magento\Config\Model\Config\Backend\Encrypted"/>
2224
<private_key backend_model="Magento\Config\Model\Config\Backend\Encrypted"/>
2325
<size>normal</size>
2426
<theme>light</theme>

‎ReCaptchaVersion2Invisible/etc/adminhtml/system.xml‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,9 +6,10 @@
66
showInStore="0">
77
<label>reCAPTCHA v2 Invisible</label>
88

9-
<field id="public_key" translate="label" type="text" sortOrder="10" showInDefault="1" showInWebsite="0"
9+
<field id="public_key" translate="label" type="obscure" sortOrder="10" showInDefault="1" showInWebsite="0"
1010
showInStore="0" canRestore="0">
1111
<label>Google API Website Key</label>
12+
<backend_model>Magento\Config\Model\Config\Backend\Encrypted</backend_model>
1213
</field>
1314

1415
<field id="private_key" translate="label" type="obscure" sortOrder="20" showInDefault="1" showInWebsite="0"
@@ -49,9 +50,10 @@
4950
showInStore="1">
5051
<label>reCAPTCHA v2 Invisible</label>
5152

52-
<field id="public_key" translate="label" type="text" sortOrder="10" showInDefault="1" showInWebsite="1"
53+
<field id="public_key" translate="label" type="obscure" sortOrder="10" showInDefault="1" showInWebsite="1"
5354
showInStore="0" canRestore="0">
5455
<label>Google API Website Key</label>
56+
<backend_model>Magento\Config\Model\Config\Backend\Encrypted</backend_model>
5557
</field>
5658

5759
<field id="private_key" translate="label" type="obscure" sortOrder="20" showInDefault="1" showInWebsite="1"

‎ReCaptchaVersion2Invisible/etc/config.xml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@
1010
<default>
1111
<recaptcha_backend>
1212
<type_invisible>
13+
<public_key backend_model="Magento\Config\Model\Config\Backend\Encrypted"/>
1314
<private_key backend_model="Magento\Config\Model\Config\Backend\Encrypted"/>
1415
<position>inline</position>
1516
<theme>light</theme>
@@ -19,6 +20,7 @@
1920
</recaptcha_backend>
2021
<recaptcha_frontend>
2122
<type_invisible>
23+
<public_key backend_model="Magento\Config\Model\Config\Backend\Encrypted"/>
2224
<private_key backend_model="Magento\Config\Model\Config\Backend\Encrypted"/>
2325
<position>inline</position>
2426
<theme>light</theme>

‎ReCaptchaVersion3Invisible/etc/adminhtml/system.xml‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,9 +6,10 @@
66
showInStore="0">
77
<label>reCAPTCHA v3 Invisible</label>
88

9-
<field id="public_key" translate="label" type="text" sortOrder="10" showInDefault="1" showInWebsite="0"
9+
<field id="public_key" translate="label" type="obscure" sortOrder="10" showInDefault="1" showInWebsite="0"
1010
showInStore="0" canRestore="0">
1111
<label>Google API Website Key</label>
12+
<backend_model>Magento\Config\Model\Config\Backend\Encrypted</backend_model>
1213
</field>
1314

1415
<field id="private_key" translate="label" type="obscure" sortOrder="20" showInDefault="1" showInWebsite="0"
@@ -59,9 +60,10 @@
5960
showInStore="1">
6061
<label>reCAPTCHA v3 Invisible</label>
6162

62-
<field id="public_key" translate="label" type="text" sortOrder="10" showInDefault="1" showInWebsite="1"
63+
<field id="public_key" translate="label" type="obscure" sortOrder="10" showInDefault="1" showInWebsite="1"
6364
showInStore="0" canRestore="0">
6465
<label>Google API Website Key</label>
66+
<backend_model>Magento\Config\Model\Config\Backend\Encrypted</backend_model>
6567
</field>
6668

6769
<field id="private_key" translate="label" type="obscure" sortOrder="20" showInDefault="1" showInWebsite="1"

‎ReCaptchaVersion3Invisible/etc/config.xml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@
1010
<default>
1111
<recaptcha_backend>
1212
<type_recaptcha_v3>
13+
<public_key backend_model="Magento\Config\Model\Config\Backend\Encrypted"/>
1314
<private_key backend_model="Magento\Config\Model\Config\Backend\Encrypted"/>
1415
<score_threshold>0.5</score_threshold>
1516
<position>inline</position>
@@ -20,6 +21,7 @@
2021
</recaptcha_backend>
2122
<recaptcha_frontend>
2223
<type_recaptcha_v3>
24+
<public_key backend_model="Magento\Config\Model\Config\Backend\Encrypted"/>
2325
<private_key backend_model="Magento\Config\Model\Config\Backend\Encrypted"/>
2426
<score_threshold>0.5</score_threshold>
2527
<position>inline</position>

0 commit comments

Comments
 (0)