-
-
Notifications
You must be signed in to change notification settings - Fork 1.7k
New entries can be discarded if user only presses Apply #2191
Description
(using KeepassXC 2.3.3)
Clicking Apply (but not Ok) on a new entry can lead to data loss in some circumstances. For example, if a user is creating a new entry and only presses Apply, they can exit keepass without a modal asking them to save. When the user relaunches keepass, the entry will be gone.
Similarly, if a user creates a new entry and only Applys it, the inactivity lock can come up without a warning modal and cause the entry to be lost.
Expected Behavior
The modals for preventing loss of unsaved data should come up when an entry has only been Applyd.
Current Behavior
A new entry which has been Applyd will not prompt the warning modals when exiting keepass or when the database is locked.
Steps to Reproduce (for bugs)
- Create new entry w/ some contents
- Press
Apply(but notOk) - Exit keepass (note that no warning modal appears)
- Re-open keepass, note that the entry is gone
OR
- Set an inactivity timeout
- Create new entry w/ some contents
- Press
Apply(but notOk) - Wait for timeout to lock the database
- Unlock database, note that the entry is gone
Context
I've lost irrecoverable credentials due to an inactivity lock screen. Clicking Apply displays a nice green alert saying "Entry successfully updated", which gave me a false sense of security about my data.
Debug Info
KeePassXC - Version 2.3.3
Revision: 0a155d8
Libraries:
- Qt 5.9.1
- libgcrypt 1.7.8
Operating system: Ubuntu 17.10
CPU architecture: x86_64
Kernel: linux 4.13.0-46-generic
Enabled extensions:
- Auto-Type
- Browser Integration
- Legacy Browser Integration (KeePassHTTP)
- SSH Agent
- YubiKey