Mirrors/Hauk
1
0
Fork 0
mirror of https://github.com/bilde2910/Hauk.git synced 2026-07-22 07:29:23 +00:00
Code Issues Projects Releases Wiki Activity

Make admin responsible for password security

Browse source 
Removing informative dialog from the app and adding the relevant commentary to the server-side config file instead. Fixes #8.
This commit is contained in:
Marius Lindvall 2019-09-03 15:42:48 +02:00
parent c6982271a1
commit 9335f232d1
3 changed files with 9 additions and 19 deletions
Download patch file Download diff file Expand all files Collapse all files

19
android/app/src/main/java/info/varden/hauk/MainActivity.java
View file

@ -70,26 +70,13 @@ public class MainActivity extends AppCompatActivity {
setClassVariables();
loadPreferences();
// Add an on checked handler to the password remember checkbox asking the user if they
// really want to store their passwords. Passwords can only be saved in plain text, so this
// could be a security risk. It's therefore a good idea to inform the user about this.
// Add an on checked handler to the password remember checkbox to save their password
// immediately.
chkRemember.setOnCheckedChangeListener(new CompoundButton.OnCheckedChangeListener() {
@Override
public void onCheckedChanged(CompoundButton button, boolean checked) {
if (checked) {
diagSvc.showDialog(R.string.passwd_title, R.string.passwd_body, new Runnable() {
@Override
public void run() {
// If OK: Save the password right away.
setPassword(true, txtPassword.getText().toString());
}
}, new Runnable() {
@Override
public void run() {
// If cancel: Undo the change.
chkRemember.setChecked(false);
}
});
setPassword(true, txtPassword.getText().toString());
} else {
setPassword(false, "");
}

3
android/app/src/main/res/values/strings.xml
View file

@ -14,9 +14,6 @@
<string name="btn_stop">Stop sharing [%s]</string>
<string name="btn_link">Share tracking link</string>
<string name="passwd_title">Remember password?</string>
<string name="passwd_body">If you save your password, it will be saved to the device in plain text. You are advised to use a password that you do not use elsewhere, such as a randomly generated password, if you choose this option.</string>
<string name="label_status_none">Location sharing inactive</string>
<string name="label_status_wait">Waiting for initial GNSS fix...</string>
<string name="label_status_ok">Location sharing active!</string>

6
backend/include/config.php
View file

@ -16,6 +16,12 @@
// Default value above is empty string (no password) and is VERY INSECURE.
// Trust me, you really should change this unless you intentionally want a
// public instance that anyone in the world can use freely.
//
// Also note that users have the option to save the server password locally on
// their devices using a "Remember password" checkbox. If they choose to do so,
// the password will be stored in plain text (unhashed) on their devices. You
// are encouraged to generate a random password to prevent risks associated with
// credential reuse, should the password somehow be leaked from their devices.
// Leaflet tile URI template for the map frontend. Here are some examples:
//