don't allow 'except password' permissions to view or copy hidden fiel…

…ds (#12899)
bitwarden · Jan 17, 2025 · 43a6a93 · 43a6a93
1 parent a803e5b
commit 43a6a93
Show file tree

Hide file tree

Showing 3 changed files with 10 additions and 0 deletions.
diff --git a/libs/vault/src/cipher-form/components/custom-fields/custom-fields.component.ts b/libs/vault/src/cipher-form/components/custom-fields/custom-fields.component.ts
@@ -167,6 +167,10 @@ export class CustomFieldsComponent implements OnInit, AfterViewInit {
       );
     });
 
+    if (!this.cipherFormContainer.originalCipherView?.viewPassword) {
+      this.customFieldsForm.disable();
+    }
+
     // Disable the form if in partial-edit mode
     // Must happen after the initial fields are populated
     if (this.cipherFormContainer.config.mode === "partial-edit") {

diff --git a/libs/vault/src/cipher-view/custom-fields/custom-fields-v2.component.html b/libs/vault/src/cipher-view/custom-fields/custom-fields-v2.component.html
@@ -38,6 +38,7 @@ <h2 bitTypography="h6">{{ "customFields" | i18n }}</h2>
           type="button"
           bitIconButton
           bitPasswordInputToggle
+          *ngIf="canViewPassword"
           (toggledChange)="logHiddenEvent($event)"
         ></button>
         <button
@@ -47,6 +48,7 @@ <h2 bitTypography="h6">{{ "customFields" | i18n }}</h2>
           [appCopyClick]="field.value"
           showToast
           [valueLabel]="field.name"
+          *ngIf="canViewPassword"
           [appA11yTitle]="'copyCustomField' | i18n: field.name"
           (click)="logCopyEvent()"
         ></button>

diff --git a/libs/vault/src/cipher-view/custom-fields/custom-fields-v2.component.ts b/libs/vault/src/cipher-view/custom-fields/custom-fields-v2.component.ts
@@ -59,6 +59,10 @@ export class CustomFieldV2Component implements OnInit {
     return this.i18nService.t(linkedType.i18nKey);
   }
 
+  get canViewPassword() {
+    return this.cipher.viewPassword;
+  }
+
   async logHiddenEvent(hiddenFieldVisible: boolean) {
     if (hiddenFieldVisible) {
       await this.eventCollectionService.collect(