From aa2e09bbeb79bbb564eb5d9a1613d450b6cc812a Mon Sep 17 00:00:00 2001
From: Ben Arc <ben@arc.wales>
Date: Tue, 13 Apr 2021 11:10:21 +0100
Subject: [PATCH] Hidden api keys to prevent over shoulder attacks

---
 lnbits/core/templates/core/_api_docs.html |  5 +++++
 lnbits/core/templates/core/wallet.html    | 14 ++++++++------
 2 files changed, 13 insertions(+), 6 deletions(-)

diff --git a/lnbits/core/templates/core/_api_docs.html b/lnbits/core/templates/core/_api_docs.html
index 43a2cc9d..4bb38fad 100644
--- a/lnbits/core/templates/core/_api_docs.html
+++ b/lnbits/core/templates/core/_api_docs.html
@@ -4,6 +4,11 @@
   label="API info"
   :content-inset-level="0.5"
 >
+  <q-card-section>
+    <strong>Wallet ID: </strong><em>{{ wallet.id }}</em><br />
+    <strong>Admin key: </strong><em>{{ wallet.adminkey }}</em><br />
+    <strong>Invoice/read key: </strong><em>{{ wallet.inkey }}</em>
+  </q-card-section>
   <q-expansion-item
     group="api"
     dense
diff --git a/lnbits/core/templates/core/wallet.html b/lnbits/core/templates/core/wallet.html
index 192e3a40..e4bf1c1d 100644
--- a/lnbits/core/templates/core/wallet.html
+++ b/lnbits/core/templates/core/wallet.html
@@ -220,14 +220,13 @@
   <div class="col-12 col-md-5 q-gutter-y-md">
     <q-card>
       <q-card-section>
-        <h6 class="text-subtitle1 q-mt-none q-mb-sm">LNbits wallet</h6>
-        <strong>Wallet name: </strong><em>{{ wallet.name }}</em><br />
-        <strong>Wallet ID: </strong><em>{{ wallet.id }}</em><br />
-        <strong>Admin key: </strong><em>{{ wallet.adminkey }}</em><br />
-        <strong>Invoice/read key: </strong><em>{{ wallet.inkey }}</em>
+        <h6 class="text-subtitle1 q-mt-none q-mb-sm">
+          LNbits wallet: <strong><em>{{ wallet.name }}</em></strong>
+        </h6>
       </q-card-section>
       <q-card-section class="q-pa-none">
         <q-separator></q-separator>
+
         <q-list>
           {% include "core/_api_docs.html" %}
           <q-separator></q-separator>
@@ -238,7 +237,10 @@
           >
             <q-card>
               <q-card-section>
-                <p>This QR code contains your wallet URL with full access. You can scan it from your phone to open your wallet from there.</p>
+                <p>
+                  This QR code contains your wallet URL with full access. You
+                  can scan it from your phone to open your wallet from there.
+                </p>
                 <qrcode
                   :value="'{{request.url_root}}'+'wallet?usr={{user.id}}&wal={{wallet.id}}'"
                   :options="{width:240}"