From 17e7c06b591cb5ffa8a0ed04a8fa759e900e8ec9 Mon Sep 17 00:00:00 2001
From: Jarian Cottingham <jarianc@proton.me>
Date: Tue, 30 Jun 2026 15:06:49 +0000
Subject: [PATCH] prevent paste in recovery code input

---
 static/app.js | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/static/app.js b/static/app.js
index 658231c..78bc5bb 100644
--- a/static/app.js
+++ b/static/app.js
@@ -143,16 +143,20 @@ function accessPin(id) {
     </p>
     <form id="access-form">
       <div class="form-group">
-        <textarea id="bypass-input" placeholder="Paste 64-character recovery code here..." rows="2" required></textarea>
+        <textarea id="bypass-input" placeholder="Type 64-character recovery code here..." rows="2" required onpaste="return false"></textarea>
       </div>
       <div id="access-error" class="error-msg" style="margin-bottom:0.5rem"></div>
       <button type="submit" class="btn btn-primary" style="width:100%">Unlock PIN</button>
     </form>`;
   document.getElementById("modal-overlay").classList.remove("hidden");
 
+  const bypassInput = document.getElementById("bypass-input");
+  bypassInput.addEventListener("paste", (e) => { e.preventDefault(); });
+  bypassInput.addEventListener("drop", (e) => { e.preventDefault(); });
+
   document.getElementById("access-form").addEventListener("submit", async (e) => {
     e.preventDefault();
-    const code = document.getElementById("bypass-input").value.trim();
+    const code = bypassInput.value.trim();
     const errEl = document.getElementById("access-error");
     errEl.textContent = "";