32882 - prefs->pw manager->view stored password only prompts first time

Status: VERIFIED FIXED

(SeaMonkey :: Passwords & Permissions, defect, P3)

Description

[Nathan Wallwork]

When editing the preferances, the password manager has a 'view stored password'
option, which prompts for the master password.
If you enter that password, then close out all the edit preferance windows and
go back, you are NOT prompted for that password.

It would seem that you SHOULD BE PROMPTED, even if you have entered it before,
because it might have been some time ago, and you may have left mozilla running
for quite a while since you entered the password.

Only checking the first time seems to defeat the whole point of having the password.

Comment 1

[sairuh (rarely reading bugmail)]

afaik, you need enter the master passwd only once per session... you'll be
prompted again if you quit then restart mozilla.

although you bring up a good point: steve, is there a time-out period during the
session after which the master passwd is forgotten?

Comment 2

[Stephen P. Morse]

There is a time-out, namely 30 minutes.  So you will get reprompted for your 
master password if it's been more than 30 minutes since the last time that you 
performed a function that required it.

Comment 3

[Nathan Wallwork]

I came back from lunch and it is still failing to prompt me.  This mozilla
session set idle for well over an hour, and it doesn't seem to have timed out yet.

Comment 4

[Stephen P. Morse]

I'm reopening it and will try to see if I can reproduce the behavior.

Comment 5

[Nathan Wallwork]

Thanks.  I've just downloaded 2000032208, I've opened up 'view stored
passwords', and I'm going to leave mozilla idle for a while since I have to
leave anyway.

Comment 6

[Nathan Wallwork]

I just returned to my desk, where I had left my machine alone running xlock, and
tried it again.  about 48 minutes ealier I had selected 'view stored passwords',
entered the password, and closed all the child windows, leaving the browser
running.  Now I've done 'view stored passwords' without being prompted, after
leaving mozilla build 2000032208 sitting untouched on an xlocked machine for
over a half hour.

If there is a timeout it it either more than 30 minutes, or it isn't working.

Comment 7

[Stephen P. Morse]

It isn't working.  Turns out the timing check is being bypassed when accessing a 
single-signon function but is working correctly when doing a wallet function.  I 
see the problem and will have a fix checked in very shortly.

Comment 8

[Stephen P. Morse]

Fix checked in.  Change was in extensions/wallet/src/singsign.cpp

Comment 9

[sairuh (rarely reading bugmail)]

unable to verify till bug 33516 is fixed.

Comment 10

[sairuh (rarely reading bugmail)]

removing dependency on bug 33516, since i can test with a new[er] profile on the
mac.

Comment 11

[sairuh (rarely reading bugmail)]

timing works fine now. verified using opt comm bits:

linux 2000.03.30.09
macOS 2000.03.30.10
winNT 2000.03.30.09