-
Notifications
You must be signed in to change notification settings - Fork 82
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
backend/lightning: don't expose mnemonic words for lightning #2741
backend/lightning: don't expose mnemonic words for lightning #2741
Conversation
80c038f
to
dc8913a
Compare
backend/config/lightning.go
Outdated
@@ -23,7 +23,7 @@ import ( | |||
// LightningAccountConfig is the configuration of a single Lightning account. | |||
type LightningAccountConfig struct { | |||
// Mnemonic is the wallet node generated from the device entropy. | |||
Mnemonic string `json:"mnemonic"` | |||
Mnemonic string `json:"-"` |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
With this you delete the mnemonic also from the config, and the user can't spend anymore 😰 You even changed the test above to reflect this 😅
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
hmm, I'll look into it, thanks.
0e2deee
to
97a77d6
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Plase, also remove the mnemonic from the frontend object :)
97a77d6
to
480aa66
Compare
Removed. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
utACK
backend/handlers/handlers.go
Outdated
return handlers.backend.Config().LightningConfig() | ||
lightningConfig := handlers.backend.Config().LightningConfig() | ||
for _, account := range lightningConfig.Accounts { | ||
account.Mnemonic = "" |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Why set to empty string? Is there a way to remove the mnemonic field?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
It's now removed by adding omitempty
to the json descriptor (thanks @Beerosagos)
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This still removes the mnemonic from the actual lightning account object in the config, so it will be gone afterwards, and also persisted on the next config save() I think.
To do this properly, you'd have to change the handler that returns the data to the frontend, probably recreating a structure with the relevant data for the frontend without the mnemonic.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
78694e3
to
ed76102
Compare
@Beerosagos @benma |
ed76102
to
13da20e
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
utACK
This commit ensures the mnemonic words created for lightning wallet are not exposed to frontend.
13da20e
to
04c56d0
Compare
This commit ensures the mnemonic words created
for lightning wallet are not exposed to frontend.