* Special thanks to @HexF and @smlu for their contributions towards this feature.
* Add MVP support for Windows Hello as a Quick Unlock solution using the WinRT API. This works by signing a random challenge vector with the Windows Hello protected key store (typically from TPM). The signed challenge is hashed using SHA-256 and then used as the encryption key to encrypt the database credentials. Credentials are encrypted using AES-256/GCM. This ensures the database password can only be decrypted following a successful authentication with Windows Hello in the future.
* Unify Touch ID and Windows Hello behavior under the Quick Unlock branding. Remove all timeout features of Touch ID as they are unnecessary and complicate the feature for no security gain.
* Quick Unlock is automatically reset only when the database key is changed vice whenever database settings are modified.
* Don't set database unlock dialog as always on top. This allows Touch ID and Windows Hello prompts to appear above the dialog properly.
* Prevent quick unlock when using AutoOpen or opening from the command line.
If relock after performing Auto-Type is enabled it will wait until
specified timeout before doing so.
Retype time is now configurable and is decreased from the old
hardcoded 30 seconds down to 15 seconds to keep the default a bit
more secure while still allowing the user to set it higher for
their liking.
To restore old behavior the user can set retype time to 0 which
will make the database relock instantly.
Auto-Type relock setting relocated to Auto-Type tab to group it
better with the other Auto-Type settings.
* Fix error in regex that prevented use of modifier keys in general.
* Added '#' modifier to press the "Meta" button. This correlates to the Windows key on Windows and Command key on macOS.
* Fix#6695 - send proper modifier keys based on documentation
Previously empty associations matched any window but since you can
use a wildcard (*) if you specifically want that this change makes
it possible to define multiple sequences for the global search
if you need to.
Additionally show empty associations in the list as "(empty)" to
better differentiate between rows if no title is set.
* Show banner message about expired entries
* Add config option and expiration offset
* Only show expiry warning on first DB unlock
* Default to on with 3-day offset from expiration
* show the tags in the entry preview
* allow searching by tag
* add a sidebar listing the tags in the database
* filter entries by tag on click
* Introduce a new TagsEdit widget that provides pill aesthetics, fast removal functionality and autocompletion
* add tests for the tags feature
* introduce the "is" tag for searching. Support for weak passwords and expired added.
* Remove QuaZip dependency in favor of minizip
* Remove signature checks, but maintain signatures for backwards compatibility
* Remove UI components related to certificates except for personal certificate for backwards compatibility
* Default to unsigned containers (*.kdbx)
* Fix syntax to prevent compilation issue
Fix build failure with AppleClang 7 & 8.
Error was:
src/core/CustomData.cpp:30:41: error: default initialization of an object of const type 'const CustomData::CustomDataItem' without a user-provided default constructor
static const CustomData::CustomDataItem NULL_ITEM;
^
{}
src/core/Metadata.cpp:32:39: error: default initialization of an object of const type 'const Metadata::CustomIconData' without a user-provided default constructor
static const Metadata::CustomIconData NULL_ICON;
^
src/core/Metadata.cpp:32:48: note: add an explicit initializer to initialize 'NULL_ICON'
static const Metadata::CustomIconData NULL_ICON;
^
{}
* Add missing QUuid header
Fixes this compilation issue with LLVM clang 9, possibly also due to an old QT5
tests/TestTools.cpp:96:39: error: incomplete type 'QUuid' named in nested name specifier
auto validUuid = Tools::uuidToHex(QUuid::createUuid());
^~~~~~~
/opt/local/libexec/qt5/lib/QtCore.framework/Headers/qmetatype.h:1887:1: note: forward declaration of 'QUuid'
QT_FOR_EACH_STATIC_CORE_CLASS(QT_FORWARD_DECLARE_STATIC_TYPES_ITER)
^
/opt/local/libexec/qt5/lib/QtCore.framework/Headers/qmetatype.h:108:18: note: expanded from macro 'QT_FOR_EACH_STATIC_CORE_CLASS'
F(QUuid, 30, QUuid) \
^
tests/TestTools.cpp:101:40: error: incomplete type 'QUuid' named in nested name specifier
auto nonHexUuid = Tools::uuidToHex(QUuid::createUuid()).replace(0, 1, 'p');
^~~~~~~
/opt/local/libexec/qt5/lib/QtCore.framework/Headers/qmetatype.h:1887:1: note: forward declaration of 'QUuid'
QT_FOR_EACH_STATIC_CORE_CLASS(QT_FORWARD_DECLARE_STATIC_TYPES_ITER)
^
/opt/local/libexec/qt5/lib/QtCore.framework/Headers/qmetatype.h:108:18: note: expanded from macro 'QT_FOR_EACH_STATIC_CORE_CLASS'
F(QUuid, 30, QUuid) \
^
* fix compilation on Qt not having QOperatingSystemVersion::MacOSBigSur
The code uses 'QOperatingSystemVersion::MacOSBigSur' which doesn't exist
in all Qt versions (it has been backported to Qt 5.12.10+ & 5.15.1+ only).
On older macos systems like El Capitan the last supported
version of Qt is 5.11
This will fix compilation issue on such older systems and on systems
running with Qt not supporting QOperatingSystemVersion::MacOSBigSur
Compilation error was:
error: no member named 'MacOSBigSur' in 'QOperatingSystemVersion'
* Fix compilation when osx <= 10.9
* AppKitImpl.mm: button property is new in 10.10. It is used for a feature of
KeePassXC that is only available from 10.17 onwards. So we don't need it when
compiling on <= 10.9
error: property 'button' not found on object of type 'NSStatusItem *'
NSString* appearance = [dummy.button.effectiveAppearance.name lowercaseString];
^
* The code uses @available syntax which is supported by
AppleClang >= 9 or LLVM >= 5.
We check __clang_major__ to allow compilation on older versions
of macOS that don't have a recent clang. For example on El Capitan.
* Fix compilation when osx <= 10.8
* AppKitImpl.mm: AXIsProcessTrustedWithOptions exists from 10.9 onwards
error: use of undeclared identifier 'kAXTrustedCheckOptionPrompt'
error: use of undeclared identifier 'AXIsProcessTrustedWithOptions'
* Fix compilation when osx <= 10.7
* MacUtils.cpp: CoreGraphics exists from 10.8 onwards only, capslock detection
feature would have to be implemented on OSX <= 10.7
* AppKitImpl.mm: CGDisplayStreamRef exists from 10.8 onwards only. It is used for a
feature of KeePassXC that is only available from 10.15 onwards. So we don't need it
when compiling on <= 10.7
error: unknown type name 'CGDisplayStreamRef'
* AppKitImpl.mm: Syntax is not understood by 10.7, update it to be understandable
by <= 10.7
error: expected method to read dictionary element not found on object of type 'NSDictionary *'
NSRunningApplication* app = userInfo[NSWorkspaceApplicationKey];
^
* The code uses @available syntax which is supported by
AppleClang >= 9 or LLVM >= 5.
We check __clang_major__ to allow compilation on older versions
of macOS that don't have a recent clang.
* Fix compilation error on OS X 10.11
src/core/Alloc.cpp:44:10: error: no type named 'free' in namespace 'std'
std::free(ptr);
~~~~~^
This is a regression, since it was fixed in [1]
Per [2], std::free() needs #include <cstdlib>. That file is included
indirectly on newer systems.
[1] 7c6c027d33
[2] https://en.cppreference.com/w/cpp/memory/c/free
* fix compilation when macos SDK <= 10.14
These methods are only available from macOS 10.15
- kSecAccessControlWatch
- LAPolicy.deviceOwnerAuthenticationWithBiometricsOrWatch
The code uses @available syntax which is supported by
AppleClang >= 9 or LLVM >= 5.
We check __clang_major__ to allow compilation on older versions
of macOS that don't have a recent clang.
Shows a warning when trying to open with a newer minor version than what is currently supported.
We always try to save with the lowest KDBX version possible for maximum compatibility.
- Default backupFilePath is '{DB_FILENAME}.old.kdbx' to conform to existing standards
- Implement backupPathPattern tests.
- Show tooltip on how to format database backup location text field.
* Add commands to manipulate entry attachments from the CLI
* Closes#4462
* Add the following commands:
attachment-export: Exports the content of an attachment to a specified file.
attachment-import: Imports the attachment into an entry. An existing attachment with the same name may be overwritten if the -f option is specified.
attachment-rm: Removes the named attachment from an entry.
* Add --show-attachments to the show command
This commit allows users to put alternative wordlists in a `wordlists` subdirectory below their KeePassXC directory (e.g., under Linux, `~/.config/keepassxc/wordlists`). These wordlists will then appear in the dropdown menu in the *Password Generator* widget.
In order to differentiate between lists shipped with KeePassXC and user-provided lists, the former appears with a (SYSTEM) prefix.
* Fix Regression since 4d07507
* Auto-Type: Workaround X server default keymap bug
If there's a system wide configuration through xorg.conf for a default keyboard layout and it's not updated by the WM/DE at startup the Xkb extension seems to be somewhat confused with XTEST and the layout somehow defaults to US ANSI.
Reading the keyboard description and writing it back without changes works around this.
* FdoSecrets: add TOTP as a readonly attribute
* FdoSecrets: reject setting fields containing refs, fixes#6802
It is still possible to set refs using KPXC UI.
Fixes#6942 and fixes#4443
- Return number of deleted entries
- Fix minor memory leak
- FdoSecrets: make all prompt truly async per spec and update tests
* the waited signal may already be emitted before calling spy.wait(),
causing the test to fail. This commit checks the count before waiting.
* check unlock result after waiting for signal
- FdoSecrets: implement unlockBeforeSearch option
- FdoSecrets: make search always work regardless of entry group searching settings, fixes#6942
- FdoSecrets: cleanup gracefully even if some test failed
- FdoSecrets: make it safe to call prompts concurrently
- FdoSecrets: make sure in unit test we click on the correct dialog
Note on the unit tests: objects are not deleted (due to deleteLater event not handled).
So there may be multiple AccessControlDialog. But only one of
it is visible and is the correctly one to click on.
Before this change, a random one may be clicked on, causing the
completed signal never be sent.
* Closes#6335
* Modify application settings presentation to allow for alternative saving strategies
* Transition Database::save calls to using flags to control saving behavior. Reduces boolean flags on function call.
* Made direct write save option a local setting to prevent unintentional carry over between platforms.
* Introduced in #6438, modified signal is not blocked at the Database level when emitting is blocked. This causes infinite saving to occur when Always Save After Every Change is enabled.
This allows one to directly use Diceware-compatible wordlists without having to convert the file to the plain wordlist format.
The accepted formats are described in the Diceware documentation:
https://diceware.readthedocs.io/en/stable/wordlists.html
* Fixes#6459
Improves the overall handling of FdoSecrets showing client executable paths to the user. It does the following:
* Check executable file existence as described in [RFC] fdosecrets: add optional confirmation to secret access (#4733)
* Show application PID and dbus address in the client list
* When the executable file is inaccessible, depending on where the client name is shown:
* when shown inline, e.g. in notification text, where space is limited, clearly say that the path is invalid
* when shown in auth dialog, show warning and print detailed info about the client
* when shown in the client list, draw a warning icon
Co-authored-by: Jonathan White <support@dmapps.us>
* Support NFC readers for hardware tokens using PC/SC
This requires a new library dependency: PCSC.
The PCSC library provides methods to access smartcards. On Linux, the third-party pcsc-lite package is used. On Windows, the native Windows API (Winscard.dll) is used. On Mac OSX, the native OSX API (framework-PCSC) is used.
* Split hardware key access into multiple classes to handle different methods of communicating with the keys.
* Since the Yubikey can now be a wireless token as well, the verb "plug in" was replaced with a more
generic "interface with". This shall indicate that the user has to present their token to the reader, or plug it in via USB.
* Add PC/SC interface for YubiKey challenge-response
This new interface uses the PC/SC protocol and API
instead of the USB protocol via ykpers. Many YubiKeys expose their functionality as a CCID device, which can be interfaced with using PC/SC. This is especially useful for NFC-only or NFC-capable Yubikeys, when they are used together with a PC/SC compliant NFC reader device.
Although many (not all) Yubikeys expose their CCID functionality over their own USB connection as well, the HMAC-SHA1 functionality is often locked in this mode, as it requires eg. a touch on the gold button. When accessing the CCID functionality wirelessly via NFC (like this code can do using a reader), then the user interaction is to present the key to the reader.
This implementation has been tested on Linux using pcsc-lite, Windows using the native Winscard.dll library, and Mac OSX using the native PCSC-framework library.
* Remove PC/SC ATR whitelist, instead scan for AIDs
Before, a whitelist of ATR codes (answer to reset, hardware-specific)
was used to scan for compatible (Yubi)Keys.
Now, every connected smartcard is scanned for AIDs (applet identifier),
which are known to implement the HMAC-SHA1 protocol.
This enables the support of currently unknown or unreleased hardware.
Co-authored-by: Jonathan White <support@dmapps.us>
This works:
```
$ keepassxc test1.kdbx test2.kdbx --pw-stdin
Database password: <manual input 1234>
Database password: <manual input 4321>
```
But this doesn't (only `test1.kdbx` is unlocked):
```
$ printf '%s\n' 1234 4321 | keepassxc test1.kdbx test2.kdbx --pw-stdin
Database password:
Database password:
```
The problem is that `Utils::setDefaultTextStreams()` is called multiple times
when unlocking multiple databases with `--pw-stdin`, which appears to break the
pipe. Simply call it once to avoid the problem.
Fixes: #5012 (as far as I can tell by simulating the script in Linux)
Signed-off-by: Joan Bruguera <joanbrugueram@gmail.com>
The HEX button automatically unselects `selectBoxLower` therefore there is no need to also add `ghijklmnopqrstuvwxyz` in the excluded characters text field.
* Allow for multiple vendor ID's to be checked at once. This allows for the use of one tracking index, streamlining KPXC code.
* Remove support for libusb 0.x on Linux
* Better handling of USB errors during initial key query. Output warnings to console.
* The main window doesn't hide properly during unlock sequence if it is in the background (ie, not minimized and not hidden to tray). This change makes sure the window hides after interaction on all platforms.
* Closes#2322
* Show locked databases in tabbed interface in unlock dialog for browser and auto-type workflows.
* Make the DatabaseOpenDialog window Application-Modal so that it blocks input to the main UI when the dialog is open. This reduces corner cases by avoiding the possibility of databases getting closed or unlocked
behind the open dialog.
* Introduce search CLI command to replace locate command. Search can provide the same functionality but in a more fine-grained fashion
* Replace use of Group::locate in code: Use EntrySearcher in clip cli command best-match option. This removes the matching against group hierarchy of an entry which is kind of nonsense as clip expects exactly one match. Matching against groups can be done using search command.
* Remove obsolete Group::locate method
Externally opened attachments are now lifecycle-managed properly.
The temporary files are created with stricter permissions and entirely
random names (except for the file extension) to prevent meta data leakage.
When the database is closed, the files are overwritten with random
data and are also more reliably deleted than before.
Changes to the temporary files are monitored and the user is asked
if they want to save the changes back to the database (fixes#3130).
KeePassXC does not keep a lock on any of the temporary files, resolving
long-standing issues with applications such as Adobe Acrobat on Windows
(fixes#5950, fixes#5839).
Internally, attachments are copied less. The EntryAttachmentsWidget
now only references EntryAttachments instead of owning a separate copy
(which used to not be cleared properly under certain circumstances).
* Use hash based storage for last used directories instead of a key/value for each type
* Explicitly declare certain operations as sensitive and follow the "Remember Last Database" setting for those.
* Introduce database backup directory location (close#6619)
unset, wl-copy will try to guess the MIME-Type based on the data.
For some reason this did not work on my machine and i was unable
to paste passwords in Firefox.
* Closes#4986 - Allow deleting entries from the reports view
* Closes#4533 - Exclude & delete multiple entries in a report
* Also allow deleting selected entries using the delete key
* Introduce GuiTools namespace to collect shared GUI prompts and actions
* Add functionality to HIBP report to mirror health check report
Co-authored-by: Jonathan White <support@dmapps.us>
The MinimizeAfterUnlock setting added in #3439 closes the main window
after unlock. However, when the unlock is triggered through
KeePassXC-Browser, a password dialog is shown on top of the main window
and the main window remains open after the unlock. This is fixed
in this commit.
* Fix#505 - always show the search bar when the search keyboard shortcut is pressed. If the toolbar is in overflow, the toolbar will be expanded automatically and search focused. If the toolbar is hidden it will be shown and expanded if necessary. When searching is canceled or the down arrow is pressed (to select the first entry) the toolbar will be set back to it's previous configuration.
* Fix#6001 - only use `--notes` in Add/Edit commands to prevent clash with password generator option `-n`.
* Fix#6119 - Send Unicode to clip command; Windows only understands UTF-16 encoding.
* Fix#6128 - `clip` command will default to clearing the clipboard after 10 seconds. To disable clearing set timeout to 0.
Selected the [Botan crypto library](https://github.com/randombit/botan) due to its feature list, maintainer support, availability across all deployment platforms, and ease of use. Also evaluated Crypto++ as a viable candidate, but the additional features of Botan (PKCS#11, TPM, etc) won out.
The random number generator received a backend upgrade. Botan prefers hardware-based RNG's and will provide one if available. This is transparent to KeePassXC and a significant improvement over gcrypt.
Replaced Argon2 library with built-in Botan implementation that supports i, d, and id. This requires Botan 2.11.0 or higher. Also simplified the parameter test across KDF's.
Aligned SymmetricCipher parameters with available modes. All encrypt and decrypt operations are done in-place instead of returning new objects. This allows use of secure vectors in the future with no additional overhead.
Took this opportunity to decouple KeeShare from SSH Agent. Removed leftover code from OpenSSHKey and consolidated the SSH Agent code into the same directory. Removed bcrypt and blowfish inserts since they are provided by Botan.
Additionally simplified KeeShare settings interface by removing raw certificate byte data from the user interface. KeeShare will be further refactored in a future PR.
NOTE: This PR breaks backwards compatibility with KeeShare certificates due to different RSA key storage with Botan. As a result, new "own" certificates will need to be generated and trust re-established.
Removed YKChallengeResponseKeyCLI in favor of just using the original implementation with signal/slots.
Removed TestRandom stub since it was just faking random numbers and not actually using the backend. TestRandomGenerator now uses the actual RNG.
Greatly simplified Secret Service plugin's use of crypto functions with Botan.
* Fix#6303 - the text attribute in 1Password contains the actual text seen in 1Password whereas the name attribute may contain a ref pointer and not a name.
Releasing lock modifiers during Auto Type does not work reliably
on X11 and can cause some modifiers to get stuck and more precisely
layout switching can get stuck.
Instead of trying to find out what modifiers to release we can just
abort when the user is holding modifiers that may affect the typing
sequence.
Fixes#6350
* Shortcut to toggle search all entries
* Select first match only when we have a window match
When we default to full database search it's possible the user would select the first match without by accident.
In this case when our query is empty we don't select anything and you need to either type something or press down to select the first item.
* Added username, password, and TOTP keyboard shortcuts and a help tip
* Closes#6176
Co-authored-by: Jonathan White <support@dmapps.us>
AutoTypeActions are required to return a result object with
information if they can be retried or not. An error string is
also provided to show a user friendly message why said action did
not succeed if even after retries it keeps failing.
This is a prerequisite for waiting for modifier keys to be released
on X11.
Completely rewritten XCB Auto-Type keymap system.
- supports multiple simultaneous layouts
- prefers current layout if it has all keysyms available
- removed hardcoded KeySymMap
- removed clunky custom KeySym emulation
Biggest breaking change is removing KeySym emulation for keys that
do not exist in any of the layouts currently in use. It would be
possible to make it work but if you are trying to type syms that
are not available in any of your layouts you are abusing it. It
also adds unnecessary complexity and opens up timing issues when
the keymap is modified on-the-fly. Now we are just reading it.
This also workarounds a Qt related issue where QX11Info::display()
returns a connection to X server that fails to receive updated
keymap data when client settings change. We use our own connection
now to get it working.
