Introduce a password health check to the application that evaluates every entry in a database. Entries that fail various tests are listed for user review and action. Also moves the statistics panel to the new Database -> Reports widget. Recycled entries are excluded from the results.
We now have two classes, PasswordHealth to deal with a single password and HealthChecker to deal with all passwords of a database.
Tests include passwords that are expired, re-used, and weak.
* Closes#551
* Move zxcvbn usage to a centralized class (PasswordHealth) and replace its usages across the application to ensure standardized interpretation of entropy calculations.
* Add new icons for the database reports view
* Updated the demo database to show off the reports
* Fix#4093 - The first entry in the list is selected after deleting an entry
* Prevents crashes due to dangling pointers held by the Entry Preview Widget when entries were deleted.
* Improve GUI tests to ensure this new behavior occurs.
* Fix#3933 and fix#3857. Interaction with entries and groups is disabled while the database is being reloaded or saved to prevent changes from occurring. Prevent the database from being reloading if an entry or group is currently being edited.
* Fix#3941 - Only notify components when the database file actually changes (determined by checksum). This prevents spurious merge requests when the file is merely touched by another service (e.g., DropBox).
* Fix code format of ElidedLabel.cpp
* Mark the database as clean after fully completing the file save operation INSTEAD of when merely writing the database to a file.
* Stop the modified timer when marking the database as clean, this prevents latent erroneous modified signals from being emitted.
* Do not restart the modified timer after a new change is detected while it is still running.
When we lock a database, we reset the database pointer to
free its resources. Since various other widgets besides the
DatabaseWidget hold references to the shared pointer object,
however, it cannot be guaranteed that the actual database
object will be freed right away. This patch adds a releaseData()
method which is called upon database lock to ensure all
residual data is cleared without having to rely on the actual
database object being cleaned up.
* Fix#3334 - AutoOpen is now processed after the database widget is put into view mode to prevent infinite recursion of unlock attempts if two databases auto open each other.
* Fix#3651
* Correct data loss when the database reloads due to a file change while creating a new entry. The issue occurred due to the "new parent group" pointer being invalid after the database is reloaded following merge.
* Also fix re-selecting entries following database file reload. If the entry was moved out of the current group it would result in an assert hit. This fix prevents recursively looking for the entry.
* Fixes#2118
Enables select entry actions when editing an entry. This allows users to copy the password of the entry, for example.
Note: unsaved changes to the entry will not be copied to the clipboard.
* Fix#3506
* Fix#2389
* Fix#2536
* Fix#2230
Every database that has been opened now watch's it's own file. This allows the database class to manage file changes and detect fail conditions during saving. Additionally, all stakeholders of the database can listen for the database file changed notification and respond accordingly.
Performed significant cleanup of the autoreload code within DatabaseWidget. Fixed several issues with handling changes due to merging, not merging, and other scenarios while reloading.
Prevent database saves to the same file if there are changes on disk that have not been merged with the open database.
* QFileDialog returns UNIX paths, even on Windows. This patch converts what QFileDialog returns to the native path format.
* Improve const correctness
* Avoid imposing file extension on Linux
* This patch improves things like unneeded passes by values, missing const qualifiers, ugly copies because of variable reuse and consistency in variable names.
* Fix#3407
* Read-only files now disable auto-save and show as modified correctly. This allows the GUI to prompt to "save-as" instead of silently discarding changes when the read-only database is locked or closed.
* Selecting one or more entries to download icons always forces the download (ie, if a new URL exists the new icon will be downloaded and set)
* Instead of downloading for each entry, the web url's are scraped from the provided entries and only those urls are downloaded. The icon is set for all entries that share a URL. This is useful if a group contains many entries that point to the same url, only 1 download call will occur.
* The icon download dialog displays whether you are doing one entry, many entries, or an entire group. It is also modal so you have to dismiss it to use KeePassXC again.
* Moved DuckDuckGo fallback notice into the download dialog.
* Replace placeholders in URLs copied from popup menu on the entry preview widget.
* Replace placeholders in URLs opened by double-clicking URL field in the entry table.
* Add combo menu button to apply an icon to children
- allow more options to apply icons (child groups, child entries)
- extend tests in TestGroup (applying icons for groups/entries only)
- prevent blue folder icon being set for entries (on entry creation only)
* Do not show the combo menu button for entries
* Support importing 1Password vaults (.opvault folders) into KDBX database
* Entry attributes are filled based on section and field name
* Expiration dates are set for entries
* Entry URL's are set from a wider array of fields
* Fix#2427
* Changed the openUrl() function to use a QUrl object, which has the appropriate scheme set.
* Preview widget now passes url handling back to DatabaseWidget
* DatabaseTabWidget::newDatabase returns the created DatabaseWidget
* Emit DatabaseTabWidget::databaseOpened signal before a new tab is added
* EntrySearcher can now search attribute values including custom ones
* Add Group::applyGroupIconTo to set the group icon on the supplied entry
* Implement desktop notifications through the system tray icon
* Add DatabaseWidget::deleteEntries to delete a list of entries
* Add Aes128 in SymmetricCipher::algorithmIvSize
* Add DatabaseWidget::databaseReplaced signal
* Add a helper class to override the message box's parent (prevent bugs)
This bug impacted unsafe saves. When auto save after every change was enabled, an
unsafe save to a location that has become unavailable (eg, dismounted veracrypt drive),
the database modified signal would continually activate a save action that failed.
This caused an infinite loop.
When auto-save on exit was enabled, the database tab and the application itself refused to
close if saving failed for whatever reason.
The fixes in this commit prevent both of these scenarios from occurring.
* Don't show apply button when creating new entries or groups (Fix#2191)
* Don't mark entry/group as dirty when first creating a new one (prevents unnecessary discard dialog on cancel)
* Properly enable/disable apply button when changes are made to entries and groups
* Don't show discard change warning when locking database unless their are actual changes made
NOTE: Extra pages in the group edit widget are not watched for changes yet. Requires a major refactor.
* Mark database dirty if saving fails
* Restore database file from backup if unsafe save fails between deleting database file and copying temporary file into place
* Improve error message display for opening and saving database files
* Do not automatically retry saving after failure. This prevents deletion of the backup database file and improves user awareness of issues.
/var/tmp/portage/app-admin/keepassxc-2.4.0/work/keepassxc-2.4.0/src/gui/DatabaseWidget.cpp: In member function ‘void DatabaseWidget::search(const QString&)’:
/var/tmp/portage/app-admin/keepassxc-2.4.0/work/keepassxc-2.4.0/src/gui/DatabaseWidget.cpp:1115:5: error: ‘m_shareLabel’ was not declared in this scope
m_shareLabel->setVisible(false);
^~~~~~~~~~~~
/var/tmp/portage/app-admin/keepassxc-2.4.0/work/keepassxc-2.4.0/src/gui/DatabaseWidget.cpp:1115:5: note: suggested alternative: ‘m_searchingLabel’
m_shareLabel->setVisible(false);
^~~~~~~~~~~~
m_searchingLabel
* Fix problem with export from newly saved database
Newly created/saved databases (or used with DatabaseWidget::saveAs)
were not exported/imported correctly.
Fixed the problem by reinitializing the ShareObserver on
DatabaseWidget::saveAs.
* Introduce warnings and prevent conflicting shares
Introduced several warnings and errors to indicate improper settings.
Prevent export when a path is used multiple times (only the file path is
checked - may ignore multiple similar ways to reference a share).
* Improve KeeShare integration in DatabaseWidget
Moved initial KeeShare association to constructor.
Introduced Q_UNUSED to indicate need for assignment statement.
* When viewing a shared group, the sharing state is indicated by a label
similar to the search label.
* Banner shows on children of shared groups
* When searching, share banner is hidden
* Fixed issue where group/entry information was not updated after change
* Fix crash when canceling save of new database
* Standardize use of DatabaseWidget::save() function
* Close new database tabs that are "discarded"
* Fixes#2604. autoSaveOnExit setting
* Re-implement autosave functionality
* Add confirmation prompt before moving groups to the recycling bin
Spawn a yes/no QMessage box when "Delete Group" is selected on a group
that is not already in the recycle bin (note: the prompt for deletion
from the recycle bin was already implemented). This follows the same
pattern and language as entry deletion.
Fixes#2125
* Make prompts for destructive operations use action words on buttons
Replace yes/no, yes/cancel (and other such buttons on prompts that cause
data to be destroyed) use language that indicates the action that it is
going to take. This makes destructive/unsafe and/or irreversible operations
more clear to the user.
Address feedback on PR #2376
* Refactor MessageBox class to allow for custom buttons
Replaces arguments and return values of type QMessageBox::StandardButton(s)
with MessageBox::Button(s), which reimplements the entire set of
QMessageBox::StandardButton and allows for custom KeePassXC buttons,
such as "Skip". Modifies all calls to MessageBox functions to use
MessageBox::Button(s).
Addresses feedback on #2376
* Remove MessageBox::addButton in favor of map lookup
Replaced the switch statement mechanism in MessageBox::addButton with
a map lookup to address CodeFactor Complex Method issue. This has a
side-effect of a small performance/cleanliness increase, as an
extra QPushButton is no longer created/destroyed (to obtain it's label
text) everytime a MessageBox button based on QMessageBox::StandardButton
is created; now the text is obtained once, at application start up.
Many lines were not conformant with the project's formatting rules.
This patch should fix all formatting and whitespace issues in the code
base.
A clang-format directive was put around the connect() calls containing
SIGNALs and SLOTs whose signatures would be denormalized because of the
formatting rules.
This patch removes redundant lock widget members of the DatabaseWidget
and consolidates all unlocking functionality into a single
DatabaseOpenWidget (with the exception of KeePass1OpenWidget).
Distinction between different unlock actions is now done via a dedicated
Intent enum class instead of using individual widgets.
Further, the DatabaseUnlockDialog has been generalized so that it is
usable for unlock intents other than just Auto-Type and is now also
used for merging databases which is less confusing to the user.
The KeePassXC main window is no longer a parent of the
DatabaseUnlockDialog and has the Qt::ForeignWindow flag set, which
should cause fewer issues with Auto-Type trying to type into KeePassXC
after unlock instead of the intended target window.
In addition, its instance has been moved into the DatabaseTabWidget
class so that it is no longer bound to individual DatabaseWidgets,
potentially allowing for database selection during Auto-Type. The actual
selection has not yet been implemented, but Auto-Type has been adjusted
to use the currently selected tab instead of the first one as an
intermediary improvement.
* Fix SSHAgent identity removal on database lock
* Refactor storage and manipulation of SSHAgent keys to streamline process with multiple db's
* Clear password field when widget is hidden, resolves#2502
The Database, DatabaseWidget, and DatabaseTabWidget classes share many responsibilities in inconsistent ways resulting in impenetrable and unmaintainable code and a diverse set of bugs and architecture restrictions. This patch reworks the architecture, responsibilities of, and dependencies between these classes.
The core changes are:
* Move loading and saving logic from widgets into the Database class
* Get rid of the DatabaseManagerStruct and move all the information contained in it into the Database
* Let database objects keep track of modifications and dirty/clean state instead of handing this to external widgets
* Move GUI interactions for loading and saving from the DatabaseTabWidget into the DatabaseWidget (resolves#2494 as a side-effect)
* Heavily clean up DatabaseTabWidget and degrade it to a slightly glorified QTabWidget
* Use QSharedPointers for all Database objects
* Remove the modifiedImmediate signal and replace it with a markAsModified() method
* Implement proper tabName() method instead of reading back titles from GUI widgets (resolves#1389 and its duplicates #2146#855)
* Fix unwanted AES-KDF downgrade if database uses Argon2 and has CustomData
* Improve code
This patch is also the first major step towards solving issues #476 and #2322.
* Search clears if the search box does not have focus for 5 minutes (fixes#2178)
* Goto group from search results after double clicking the group name (fixes#2043)
* Cleanup entry change notification with entryview focus in/out
* Change Open URL shortcut to CTRL+SHIFT+U to conform with an "action"
including SHIFT
* Change Copy URL shortcut to CTRL+U to conform with "copy" without SHIFT
* Entry specific toolbar and menu items are disabled unless the entry
row has focus (prevents unintended actions)
* Reword security setting for password visibility in entry edit view
* Add shortcut to hide/unhide usernames (CTRL+SHIFT+B)
* Organize entry menu
* Fix#1588 - show keyboard shortcuts in context menu
* Fix#2403 - Change auto-type shortcut to CTRL + SHIFT + V
* Fix#2096 - Add (CTRL+F) to search bar background
* Fix#2031 & Fix#2266 - add shortcut to hide/unhide passwords (CTRL+SHIFT+C)
* Fix#2166 - Add reveal password button to entry preview
Performing a dev build against the latest version of Qt failed
because of some deprecated members. They have been replaced
according to the Qt documentation.
Further, Q_OS_MACOS is now the only macro available to identify a
machine running macOS, the others are now deprecated.
See https://doc.qt.io/qt-5/qtglobal.html#Q_OS_OSX and
https://doc.qt.io/qt-5/qtglobal.html#Q_OS_MAC.
* Fix MainWindow startup when minimize to tray was enabled
* Reduce duplicate code in DatabaseWidget.cpp
* Fix snapcraft build dependencies
* Add support for CTRL+TAB, CTRL+PGUP, CTRL+SHIFT+TAB, CTRL+PGDN to control database tabs from any focus location
* Add CTRL+SHIFT+M shortcut to minimize to tray
* Allow minimize instead of app exit without tray icon
* Resolves#764
* Add libqrencode and qtsvg dependencies
* Ensure QR code remains square
* Auto-close QR code dialog when database is locked
* Add databaseLocked() Signal to databaseWidget
* Correct otpauth URI output in Totp::writeSettings(...)
Rename UI elements involved with the bottom preview panel to use the
terminology "entry preview panel" instead of "details view" or "preview
panel". Change all associated variables, widgets, and classes to
reference EntryPreviewPanel. Create Config::upgrade() function and
deprecation mapping to help rename/remove previous config settings in a
clean manner.
Fixes#2327
* Add source folder keeshare for sharing with corresponding define WITH_XC_KEESHARE
* Move common crypto parts to src/crypto/ssh
* Extended OpenSSHKey
* Move filewatching to own file (currently in two related classes DelayedFileWatcher and BulkFileWatcher)
* Small improvements for style and code in several classes
* Sharing is secured using RSA-Keys which are generated on demand
* Publisher signs the container using their private key
* Client can verify the signed container and choose to decline an import,
import only once or trust the publisher and automatically import all
data of this source henceforth
* Integration of settings into Group-Settings, Database-Settings and Application-Settings
* Introduced dependency QuaZip as dependency to allow combined export of
key container and the (custom format) certificate
* Create history-based merging that keeps older data in history instead of discarding or deleting it
* Extract merge logic into the Merger class
* Allows special merge behavior
* Improve handling of deletion and changes on groups
* Enable basic change tracking while merging
* Prevent unintended timestamp changes while merging
* Handle differences in timestamp precision
* Introduce comparison operators to allow for more sophisticated comparisons (ignore special properties, ...)
* Introduce Clock class to handle datetime across the app
Merge Strategies:
* Default (use inherited/fallback method)
* Duplicate (duplicate conflicting nodes, apply all deletions)
* KeepLocal (use local values, but apply all deletions)
* KeepRemote (use remote values, but apply all deletions)
* KeepNewer (merge history only)
* Synchronize (merge history, newest value stays on top, apply all deletions)
This patch implements a new database wizard to guide users through the process
of setting up a new database and choosing sane encryption settings.
It also reimplements the master key settings to be more
user-friendly. Users can now add, change, or remove individual composite
key components instead of having to set all components at once. This
avoids confusion about a password being reset if the user only wants to
add a key file.
With these changes comes a major refactor of how database composite keys and key
components are handled. Copying of keys is prohibited and each key
exists only once in memory and is referenced via shared pointers. GUI
components for changing individual keys are encapsulated into separate
classes to be more reusable. The password edit and generator widgets
have also been refactored to be more reusable.
* Eliminate TOTP logic from GUI elements
* Consolidate TOTP functionality under the Totp namespace
* Eliminate guessing about state and encoders
* Increased test cases
* Add entry view column for TOTP [#2132]
* General code cleanup, reduction of unnecessary steps, separation of concerns
* Rename SetupTotpDialog to TotpSetupDialog for consistency
The 'text' property of the QAction gets mangled by KDE when it adds its
own accelerator shortcuts. But the data property is ours. Use that for
keying instead.
Signed-off-by: Steven Noonan <steven@uplinklabs.net>
* Rename saveEntry to commitEntry to accurately capture its purpose
* Add message to user when commit is successful
* Made all inline messages in edit entry view 2 sec visibility
Update state syncer (class DatabaseWidgetStateSync) to account for new
features:
- properly sync view state when switching tabs
- properly read/write view state from/to config
Update classes EntryModel and EntryView to consistenly name list/search
modes. Before, both classes defined list mode as 'group mode' and search
mode as 'entry list mode', which differed from naming in other classes
such as DatabaseWidget.
Add 'copy-on-doubleclick' feature to entry view table by extending
already existing DatabaseWidget::entryActivationSignalReceived().
Currently, username, password and notes are copyied on doubleclick,
while doubleclicking URL still opens browser as before.
Can easily be extended to account for other/additional columns
(switch-case).
* Adds KDBX4 reader/writer interfaces
* Adds KDBX4 XML reader/write interfaces
* Implements test cases for KDBX4
* Fully compatible with KeePass2
* Corrects minor issues with Argon2 KDF
* Add the concept of custom TOTP encoders, each with potential for custom
code alphabet, length, step interval and code direction (i.e. reversed)
* Select custom encoder via overload of the digits field of a loaded entry
* Allow selection of custom encoders via the "TOTP Settings" field's
size, as currently done by KeeTrayTOTP for Steam. Use "S" for the
short name of the Steam custom encoder
* Allow selection of custom encoders via the "otp" field by appending
a "&encoder=<name>" field to the URL query. For example,
"&encoder=steam"
* Update TOTP set-up dialog to permit selection between (default,
steam, custom) settings.
Chnage to one method to set MessageWidget text passing type as
parameter.
Only messages with questions requiring user input reamin using
MessageBox dialog.
Use signal/slots to set message in MessageWidget and hide message,
signal/slots only used when required.Maybe need to change all calls to
signals/slots in the future.
* Search Group details in addition to entry details; feature parity with KeePass
* Remove assertions to prevent crashes in Debug mode when search result is empty
