search

walterpg / google-drive-sync

A KeePass Password Safe v2 plugin for synchronizing passwords to Google Drive files.
GNU General Public License v3.0
198 stars 10 forks source link

Major Security Problem: Database A syncs in wrong Google Account B #80

Open feelnrg opened 4 months ago

feelnrg commented 4 months ago

Describe the bug When working with multiple Keepass databases across different Google accounts, the plugin doesn't seem to adhere to the configured settings. I was surprised to find that Database B on Google A Drive. It's possible that the plugin is using the incorrect token. I'm uncertain why this issue occurs, but I've observed multiple instances where different databases are linked to the wrong accounts. These databases are utilized by various individuals and across different computers to sync with their respective accounts. Each database has a unique Google account configured and the first time Sync was made for this uniuque Account with the correct credentials. Despite Database B being configured for Google Account B, it appears to sync with Account A. I would recommend implementing a check before syncing the database to ensure that the account configured in the settings matches the token being used.

To Reproduce Not possible to reproduce because I can not define, what is triggering the problem. But I have seen more then 3 different Databases in my own Google Account, which are not configured in the Sync settings. I can say that these Databases was opened at the same time (parallel) in Keepass Application.

Expected behavior Sync Database A to Google Account A Sync Database B to Google Account B Check Accountname before Sync!

Screenshots grafik

Please provide the following information:

rhwright-RPI commented 1 month ago

I am seeing this issue as well. It seems to preference the "first" database opened and syncs using that configuration. In our case, Google Account A is an individual database and Google Account B is a shared database.