434899 - Passwords stored on User Profile B are viewed by User Profile A

Status: RESOLVED INCOMPLETE

(Toolkit :: Password Manager, defect)

Description

[Marilyn St-Louis]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.8.1.14) Gecko/20080404 Firefox/2.0.0.14
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.8.1.14) Gecko/20080404 Firefox/2.0.0.14

User Profile A is the first Administrator account created on computer.
User Profile B is the second Admin account created on computer.

Passwords stored by User Profile A do not appear on list of saved passwords for User B.

Passwords stored by User Profile B appear on the list of saved passwords for User A.

I have deleted User B's saved password from User A's list. I came back to User A at the end of the day, and it still has passwords for User B.


Reproducible: Always

Steps to Reproduce:
1. in Vista, setup an Admin user --> User A 
2. login as User A and setup a profile for User B, the log off
3. login as User B
4. browse the web on User B, save passwords
5. log off as User B and login as User A
6. review list of saved passwords on User A's profile
Actual Results:  
User B's saved passwords appear on User A's list of saved passwords.

Expected Results:  
User B saved passwords should not appear on User A's list of saved passwords regardless of them being both Admin users.

NOTES:

- Master password was not set following this scenario.
- There is a possibility that User A's passwords may also appear on User B's list.  (reversed scenario not verified)

Comment 1

[Justin Dolske [:Dolske]]

Rob, can you comment here? We've had similar INVALID bugs with Windows accounts vs. FF profile folders, but not sure what's happening/expected in this case.

Comment 2

[Robert Strong (they/them - no direct email)]

Matilyn, what exact steps were performed when you "setup a profile for User B"?

Comment 3

[Marilyn St-Louis]

Rob - here are the steps you requested.

From User A account: 
1. Click Start button >> Control Panel
2. Click "Add or remove user accounts
3. Click "Create New User"
4. Name the user, then select Administrator as user type
5. Click "Create Account" button

Comment 4

[Robert Strong (they/them - no direct email)]

When I have a chance I'll check out if the profile directory is copied from the existing admin accounts directory when using this method which I suspect it is.

Comment 5

[Marilyn St-Louis]

Rob - FYI only

I had a similar issue with Digsby app. 

p7515 ::Info from Account A appears on Account B
http://forum.digsby.com/viewtopic.php?pid=7515#p7515

I've provided the issue summary below for your convenience. The developer didn't provide feedback on the solution.
___________________________
OS: Vista Business
Digsby: Build 14938

I have 2 user profiles setup on one computer.

Each user has a Digsby account.

Scenario
User A is logged in to Digsby Account A and then logs off Vista session.

User B logs on Vista session on the same computer and is auto-signed on to Digsby as Digsby Account B.

User B sees Email and Social Network settings of Digsby Account A.
User B doesn't see her expected Email and Social Networks.
Some IM accounts for Digsby Account B are missing.
However User B does not see Digsby Account A's IM accounts.

I am User B and I have had to manually reset my IM, Email and Social Network preferences every time I login to Digsby Account B.

Comment 6

[Justin Dolske [:Dolske]]

Can you check the logging output from http://wiki.mozilla.org/Firefox:Password_Manager_Debugging? [Requires Firefox 3]

Enable it, and visit a page with a login form (to trigger initialization of the pwmgr). You should see a line out output with signons3.txt

PwMgr Storage: Reading passwords from /Users/dolske/Library/Application Support/Firefox/Profiles/123abcxy.Minefield/signons3.txt

This would confirm that the two users are sharing the same profile. [Not sure if there's an easier way]