IJHack / QtPass

QtPass is a multi-platform GUI for pass, the standard unix password manager.
https://qtpass.org/
GNU General Public License v3.0
1.03k stars 162 forks source link

Deleting a directory sometimes deletes the entire password store including git repositories #556

Closed FSMaxB closed 1 year ago

FSMaxB commented 3 years ago

Describe the bug Sometimes when trying to delete a subdirectory, the entire password store get's deleted.

To Reproduce I am not sure on how to actually reproduce this, but it happened to me several times. Thank god for backups! If I find the time, I can start experimenting. It might be related to the search functionality in some way.

Expected behavior Only the subdirectory should be deleted, not the entire password store.

Screenshots QtPass-deletes-everything

Desktop (please complete the following information):

Additional context I use multiple profiles

FSMaxB commented 1 year ago

It just happened again. I was deleting an empty directory that I had just created and that's when it happened. Still not able to reliably reproduce it though.

FSMaxB commented 1 year ago

I just found out how to reproduce it!

  1. Add a new password store for testing in the settings.
  2. Make sure to select it (you don't want to accidentally delete your passwords)
  3. Run PASSWORD_STORE_DIR=. pass init <gpg-id> to initialize the new password store.
  4. Create a new victim password to be deleted.
  5. Create a new directory called empty
  6. Search for empty in the search bar
  7. Klick on empty in the search results. (Note: It is not highlighted as selected when clicking on it)
  8. Press the delete key. A dialog box will appear: grafik
  9. It tells you that it will delete /. If you then click yes, it will delete your entire password store, including the main directory itself
FSMaxB commented 1 year ago

Did some further digging. It's actually much easier to trigger. It happens when the list of passwords is selected but no item in the tree of passwords and directories.

You can achieve this by one of the following:

FSMaxB commented 1 year ago

Note that in those cases, the ui->actionDelete button is disabled, but you can still trigger the delete action with the delete key.

FSMaxB commented 1 year ago

PR incoming!