184485 - Inserting attributes in DOM Inspector brings up dialog for "the master password for the software security device"

Status: VERIFIED DUPLICATE of bug 184436

(SeaMonkey :: Passwords & Permissions, defect)

Description

[Sander]

Open any page in the DOM-Inspector with ctrl-shift-i and right-click in the
right pane while viewing any element, choose insert. You get a dialog "Please
enter the master password for the Software Security Device." (Presumably only if
you actually let Mozilla remember your passwords and have not yet given the
master password this session, or have it expired again already.)
Canceling the dialog brings it up a second time.
Only then do you get the actual insert dialog. (After which the excercise is
repeated for the attribute to insert.)

2002120708 - win98

The same goes for editing attributes.
Worse, if you actually fill in the master password the values you want to edit
suddenly get an underlying password as the value...

Not sure if this is a DOM Inspector issue or belongs to the Password Manager.
Assigning to the latter for now, as it makes most sense that some code there
changed to cause this issue rather than with the DOM Inspector.

Comment 1

[Stephen P. Morse]

It's not password manager, but it could be PSM. Reassigning.

Comment 2

[Kai Engert [:KaiE:]]

I can not reproduce using a 2-3 days old build on Linux.

the sequence
- open mozilla
- load mozilla.org homepage
- open dom inspector
- inspect a window, choose the mozilla homepage window
- right click in the attributes window
- click insert

Results not in the master password dialog showing up. Instead, it asks me for an
attribute name.

I'm certain I have a master password set.

After having done the above, when I try to do mail over SSL, I'm prompted to
enter my master password.


John, can you reproduce it?

Comment 3

[Sander]

One additional piece of the puzzle - the dialog asking for a master password
only occurs when "use encryption when storing sensitive data" is checked.

Comment 4

[Sander]

Did some more testing - 2002121008 - clean profile. This indeed depends on the
encryption of passwords, with the master password asked every time it is needed,
or after it hasn't been used for x minutes. Also, there needs to be at least one
password in the password manager. It does not matter how you open the
DOM-Inspector or where you try to insert or edit a value.

Comment 5

[John Unruh]

I agree with comment #4 on Win32 only. I cannot get the DOM inspector to work on
OSX, or appear at all in the 12/10 Linux nightly build.

Comment 6

[John Unruh]

Moving to Password Manager. I verified comment #3 - the dialog asking for a
master password only occurs when "use encryption when storing sensitive data" is
checked.

Comment 7

[Sander]

This broke between 2002120508 and 2002120604 - suspecting darin's fix for bug
182490 from 12/05/2002 22:36

Comment 8

[Sander]

In this mozillazine thread: http://www.mozillazine.org/forums/viewtopic.php?t=3073
someone describes a form on a website showing one of their passwords - I tried
the steps outlined

1. You must have at least one account saved in "Password Manager"
2. Visit: http://demo.v-webmail.co.uk/login.php
3. Choose "Preferences"
4. Choose "Mail account polling"
5. Click "New Account" 

and get the dialog asking for a master password popping up twice. If I fill in
said master password, one of my passwords shows. I haven't yet investigated
fully, but I want to bet it's exactly the same problem as happens with the DOM
Inspector.
If this becomes known, and people figure out how to create forms that trigger
this problem... (everyone who has recently used their master password can have
their passwords exposed).

Comment 9

[Heikki Toivonen (remove -bugzilla when emailing directly)]

Is this dupe of bug 184436? Please try a recent build.

Comment 10

[Sander]

Ah. Quite probably... *starts download*
*wishes he could unsend his email to [e-mail]*

Comment 11

[Sander]

This does indeed appear to be fixed now; I should have made the connection to
the prompt and searched on that. Sowwry.

*** This bug has been marked as a duplicate of 184436 ***

Comment 12

[Terri Preston]

v