Skip to content

New entries can be discarded if user only presses Apply #2191

@wgreenberg

Description

@wgreenberg

(using KeepassXC 2.3.3)

Clicking Apply (but not Ok) on a new entry can lead to data loss in some circumstances. For example, if a user is creating a new entry and only presses Apply, they can exit keepass without a modal asking them to save. When the user relaunches keepass, the entry will be gone.

Similarly, if a user creates a new entry and only Applys it, the inactivity lock can come up without a warning modal and cause the entry to be lost.

Expected Behavior

The modals for preventing loss of unsaved data should come up when an entry has only been Applyd.

Current Behavior

A new entry which has been Applyd will not prompt the warning modals when exiting keepass or when the database is locked.

Steps to Reproduce (for bugs)

  1. Create new entry w/ some contents
  2. Press Apply (but not Ok)
  3. Exit keepass (note that no warning modal appears)
  4. Re-open keepass, note that the entry is gone

OR

  1. Set an inactivity timeout
  2. Create new entry w/ some contents
  3. Press Apply (but not Ok)
  4. Wait for timeout to lock the database
  5. Unlock database, note that the entry is gone

Context

I've lost irrecoverable credentials due to an inactivity lock screen. Clicking Apply displays a nice green alert saying "Entry successfully updated", which gave me a false sense of security about my data.

Debug Info

KeePassXC - Version 2.3.3
Revision: 0a155d8

Libraries:
- Qt 5.9.1
- libgcrypt 1.7.8

Operating system: Ubuntu 17.10
CPU architecture: x86_64
Kernel: linux 4.13.0-46-generic

Enabled extensions:
- Auto-Type
- Browser Integration
- Legacy Browser Integration (KeePassHTTP)
- SSH Agent
- YubiKey

Metadata

Metadata

Assignees

Type

No type

Projects

No projects

Milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions