483455 - Unnecessary master password prompt opening additional main mail window

Status: RESOLVED DUPLICATE of bug 534462

(Thunderbird :: Security, defect)

Description

[Kurt Albershardt]

User-Agent:       Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.0.7) Gecko/2009021906 Firefox/3.0.7
Build Identifier: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.1b3pre) Gecko/20090223 Thunderbird/3.0b2

New on 3.0b3 - restoring main window after closing brings up master password dialog, apparently not due to locking of password DB.  

Reproducible: Always

Steps to Reproduce:
1. Close main window with <command> + <w> leaving app running.
2. Reopen main window with <command> + <1> or by clicking on dock icon

Actual Results:  
Master password prompt appears (I initially thought this was a security enhancement.
<esc> or Cancel restores main window with full permissions, indicating that password DB was not closed, so why was the master PW requested?

Expected Results:  
Either

a) there should be no master password prompt after <command> + <1>
or
b) <esc> or Cancel at that prompt should deny access to the running app (or close it.)

Comment 1

[Kurt Albershardt]

After testing the behavior of the <esc> action several times, I was asked for the SSD Master Password once - on one IMAP account out of five - on perhaps one <esc> restore out of eight.

Comment 2

[Wayne Mery (:wsmwk)]

so you don't see this with 3.0b2?

Comment 3

[Matt Richard]

I have seen this behavior on 3.0b2 and earlier builds of the 3.0 trunk.  I have not seen it with any releases in the 2.0 branch.

Comment 4

[Matt Richard]

This behavior still exists today in 3.0b3 [Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.1pre) Gecko/20090619 Shredder/3.0b3pre].  It's my opinion that the bug has a non-trivial user experience effect (à la b3ux).

What is the procedure to get this bug some eyeball time and marked as a blocker for 3.0b3 or 3.0?

Comment 6

[Daniel Holbert [:dholbert]]

Note that as described in Bug 507543, this causes a master-password prompt on viewing "Your Rights" and "Credits", via Help|AboutShredder's "About" button.

Comment 7

[Mark Banner (:standard8)]

I'm going to take a look at this.

Comment 8

[Wayne Mery (:wsmwk)]

(In reply to comment #5)
> *** Bug 507543 has been marked as a duplicate of this bug. ***

note: help>about>about ... issue of Bug 507543 doesn't appear until later than the Mac report, i.e. when the "about" button appears.

And if I understand the original report, clicking "Cancel" from master password prompt after click of About does not avoid the additional new window. but the about tab does open without supplying the password.

Comment 9

[juergen.edner]

I've just installed TB3b4 and exactly the same problem appears when starting the program. It looks like TB requests the master password for each access to the password db. Pressing the cancel button causes e.g. that a webdav calendar is not loaded.

Comment 10

[Matt Richard]

Any thoughts on why this regression bug is not blocking 3.0 releases?  It still exists in the 3.0rc1 builds, as of 3.0RC1 build 2.  

Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.1.5) Gecko/20091117 Thunderbird/3.0

Comment 11

[Mark Banner (:standard8)]

The drivers feel that we won't block getting Thunderbird 3 out on this, as we feel it won't affect a significant number of users and it is easy to get around.

Comment 12

[Mark Banner (:standard8)]

This has been fixed by bug 534462. Whilst we'll still prompt if your master password has not been logged in, that is due to other issues and we'll most likely be able to take care of these in bug 338549.