106939 - Change Master Password Dialog come up with wrong device selected when prompting for new password.

Status: VERIFIED FIXED

(Core Graveyard :: Security: UI, defect, P1)

Description

[Stephane Saux]

Change Master Password Dialog come up with wrong device selected when prompting
for new password:

To reproduce you must not have your Software Security Device Password set and
you must have a hardware device installed.

One way to do that (how I ran into this bug) is to have a hardware device
installed, then blow you key and cert dbs but keep your secmod.db.
I suspect that if you reset your master password you would have the same problem.

Once this setup is complete follow these steps:
Start the browser in a way that it will not prompt you for a software security
device pwd.
import a p12 file.
You're prompted for the device you want to store the token into.
choose the software security device.
The set password dialog comes up, but the device selected is the Hardware Token
(which already has a password).
You must manually change the drop down to the Software Security Device.

Expected:
Since the reason the set password dialog comes up is that you don't have a
Software Security Password, the set Master password should come up with that
device selected.

Comment 1

[Kai Engert (:KaiE:)]

My opinion: If you have previously decided which token you want to use, the
change password dialog should not allow you to select a different token.

You obviously have already decided that you want to store it on the software
security device. The change password dialog should only allow to change the
password for this token.

When I look at changepassword.xul and password.js, I think the dialog is already
designed to behave that way. If it doesn't, something is broken.

I see code that tests, whether the dialog has been passed a token or not. In you
case, a token name should have been passed to the dialog. If it had been passed,
the token selection would not have been visible.

The solution to this bug is: We need to find out, why the token name does not
arrive in the dialog, or maybe why the dialog behaves wrong.

Comment 2

[Kai Engert (:KaiE:)]

I found the cause for this bug, as well as the yet unexplained error message in
bug 110454. The function name is written incorrectly.

I will attach a patch that corrects the problem. The dialog is now able to
obtain the requested token name, and does show this name in the dialog, but does
no longer show a list to select from.

Comment 3

[Kai Engert (:KaiE:)]

Attachment: Suggested Fix

Comment 4

[Kai Engert (:KaiE:)]

Javi, can you please review?

Comment 5

[Javier Delgadillo]

Comment on attachment 59150 [details] [diff] [review]
Suggested Fix

r=javi

Comment 6

[Mike Shaver (:shaver -- probably not reading bugmail closely)]

Comment on attachment 59150 [details] [diff] [review]
Suggested Fix

That sucks; that method should be interCaps, not InterCaps.  Can you fix the
IDL and callers?

sr=shaver on this coping mechanism, though.

Comment 7

[Kai Engert (:KaiE:)]

checked in, fixed

Comment 8

[John Unruh]

Verified with the 1/7/02 Win98 trunk build.