mirror of
https://github.com/LCE-Hub/LCE-Emerald-Launcher.git
synced 2026-07-20 09:17:14 +00:00
8f6aea866f
the access token used to live in localStorage under lceonline_session.
localStorage is readable by any JS in the webview origin (XSS exposure).
added three new IPC commands:
- lceonline_token_store(token, username): writes session.json under
app_data_dir with 0600 perms (POSIX).
- lceonline_token_load(): reads session.json and returns {token, username}.
- lceonline_token_clear(): removes session.json.
the frontend now uses invoke() to call these instead of localStorage.
the token never enters the webview's storage surface.
|
||
|---|---|---|
| .. | ||
| capabilities | ||
| gen/schemas | ||
| icons | ||
| resources/DLC/Emerald Skin Pack | ||
| scripts | ||
| src | ||
| .gitignore | ||
| build.rs | ||
| Cargo.lock | ||
| Cargo.toml | ||
| tauri.conf.json | ||
| tauri.nightly.conf.json | ||