fix(plugins): prevent a privileged plugin to get PRF secret of another privileged plugin

2026-07-29 11:30:12 +02:00
parent a16478ffad
commit 7969fd09eb
2 changed files with 16 additions and 17 deletions
@@ -167,7 +167,7 @@ function buildPluginApi(manifest: PluginManifest) {
      settings: { ...manifest.settings },
    },
    webauthn: {
-      getOrCreate: (masterCredentialIdBytes?: number[], name?: string, displayName?: string) => callApi('webauthn.getOrCreate', [masterCredentialIdBytes, name, displayName], 0)
+      getOrCreate: (masterCredentialIdBytes?: number[], name?: string, displayName?: string) => callApi('webauthn.getOrCreate', [masterCredentialIdBytes, manifest.id, name, displayName], 0)
    },
    storage: {
      get: (key: string) => callApi('storage.get', [key]),