466675 - "Use master password" is still checked after clicking "OK" for popup window without typing any password

Status: RESOLVED WORKSFORME

(Thunderbird :: Security, defect)

Description

[Matěj Cepl]

User-Agent:       Mozilla/5.0 (X11; U; Linux x86_64; cs-CZ; rv:1.9.0.4) Gecko/2008111217 Fedora/3.0.4-1.fc10 Firefox/3.0.4
Build Identifier: thunderbird-2.0.0.18-1.el5 - x86_64 (zh_TW)

(originally filed as https://bugzilla.redhat.com/show_bug.cgi?id=472159)

Go to Preferences->Pravacy->Passwords,check option "Use a master password to
encrypt stored passwords", in the popup window,just click "OK" without typing
any password. And then you will be warned something like "haven't set master
password..." but the option is checked still.And if set a master password by
clicking the button, and then remove it,you will find the option "Use a master
password to encrypt stored passwords" could be checked/unchecked arbitrarily
and won't popup any window for setting master password.



Reproducible: Always

Steps to Reproduce:
1. Go to Preferences->Pravacy->Passwords,check option "Use a master password to
encrypt stored passwords", in the popup window,just click "OK" without typing
any password.
2. set a password by click the button, and then remove the password
Actual Results:  
If don't type any password for the popup window and click "OK",the option "Use
a master password to encrypt stored passwords" could be checked/unchecked
arbitrarily and won't popup any window for setting master password soon later.

Expected Results:  
If user click "OK" without typing any password, the option should change back
to unchecked status.

I am not exactly sure whether this is actually a bug, but I think given this is a security issue I would prefer somebody see this.

Comment 1

[Ludovic Hirlimann [:Usul]]

This Works For Me in Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.1b3pre) Gecko/20090217 Shredder/3.0b2pre. Reporter could you try to use a recent build of thunderbird ( a recent nightly ) as many things dealing with passwords have changed in the recent past - and tell us if you still experience this issue ?

Comment 2

[Mark Banner (:standard8)]

Since the switch to password manager and the change of preferences in bug 239131 (if not before) the preferences has changed - you can now not click ok unless you've entered a password, and if you click cancel, then the "Use Master Password" option is unchecked.

As I can't be 100% positive that bug 239131 and not something else fixed this, marking as works for me.