From e33f4ba9c0e8c29cf074f566cbb69c27007f6c57 Mon Sep 17 00:00:00 2001
From: Resynth <resynth1943@tutanota.com>
Date: Sun, 25 Oct 2020 22:04:39 +0000
Subject: [PATCH] Warn on Access Token reveal

Signed-off-by: Resynth <resynth1943@tutanota.com>
---
 .../views/dialogs/AccessTokenDialog.tsx       | 39 +++++++++++++++++++
 .../settings/tabs/user/HelpUserSettingsTab.js | 14 ++++++-
 2 files changed, 52 insertions(+), 1 deletion(-)
 create mode 100644 src/components/views/dialogs/AccessTokenDialog.tsx

diff --git a/src/components/views/dialogs/AccessTokenDialog.tsx b/src/components/views/dialogs/AccessTokenDialog.tsx
new file mode 100644
index 0000000000..81c48f219a
--- /dev/null
+++ b/src/components/views/dialogs/AccessTokenDialog.tsx
@@ -0,0 +1,39 @@
+    /*
+Copyright 2017 Vector Creations Ltd
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+import React from 'react';
+import { _t } from '../../../languageHandler';
+import QuestionDialog from './QuestionDialog';
+
+type IProps = Exclude<
+    React.ComponentProps<QuestionDialog>,
+    "title" | "danger" | "description"
+    >;
+
+export default function AccessTokenDialog (props: IProps) {
+    return (
+        <QuestionDialog
+            {...props}
+            title="Reveal Access Token"
+            danger={true}
+            description={_t(
+                "Do not reveal your Access Token to anyone, under any circumstances. " +
+                "Sharing your Access Token with someone would allow them to login to " +
+                "your account, and access your private information."
+            )}
+        ></QuestionDialog>
+    );
+}
diff --git a/src/components/views/settings/tabs/user/HelpUserSettingsTab.js b/src/components/views/settings/tabs/user/HelpUserSettingsTab.js
index 85ba22a353..585a54ff86 100644
--- a/src/components/views/settings/tabs/user/HelpUserSettingsTab.js
+++ b/src/components/views/settings/tabs/user/HelpUserSettingsTab.js
@@ -27,6 +27,7 @@ import * as sdk from "../../../../../";
 import PlatformPeg from "../../../../../PlatformPeg";
 import * as KeyboardShortcuts from "../../../../../accessibility/KeyboardShortcuts";
 import UpdateCheckButton from "../../UpdateCheckButton";
+import AccessTokenDialog from '../../../dialogs/AccessTokenDialog';
 
 export default class HelpUserSettingsTab extends React.Component {
     static propTypes = {
@@ -148,6 +149,17 @@ export default class HelpUserSettingsTab extends React.Component {
         );
     }
 
+    onAccessTokenSpoilerClick = async (event) => {
+        // React throws away the event before we can use it (we are async, after all).
+        event.persist();
+
+        // We make the user accept a scary popup to combat Social Engineering. No peeking!
+        await Modal.createTrackedDialog('Reveal Access Token', '', AccessTokenDialog).finished;
+
+        // Pass it onto the handler.
+        this._showSpoiler(event);
+    }
+
     render() {
         const brand = SdkConfig.get().brand;
 
@@ -266,7 +278,7 @@ export default class HelpUserSettingsTab extends React.Component {
                         {_t("Homeserver is")} <code>{MatrixClientPeg.get().getHomeserverUrl()}</code><br />
                         {_t("Identity Server is")} <code>{MatrixClientPeg.get().getIdentityServerUrl()}</code><br />
                         {_t("Access Token:") + ' '}
-                        <AccessibleButton element="span" onClick={this._showSpoiler}
+                        <AccessibleButton element="span" onClick={this.onAccessTokenSpoilerClick}
                                           data-spoiler={MatrixClientPeg.get().getAccessToken()}>
                             &lt;{ _t("click to reveal") }&gt;
                         </AccessibleButton>