Copy password to clipboard button (toolbar) copies URL

[Sikey]

Overview

When copying a password using the toolbar button ("Copy password to clipboard"), the URL of the entry is copied instead of the password.

The right-click context menu entry and Ctrl+C work fine.

Steps to Reproduce

1. Select a database entry that includes a URL
2. In the "General" tab below the list of entries, click on URL to open it in default browser
3. Click toolbar button to copy password to clipboard
4. Paste clipboard text <--- URL
5. Copy password using context menu or Ctrl+C
6. Paste clipboard text <--- password
7. Click toolbar button to copy password to clipboard
8. Paste clipboard text < --- password

Expected Behavior

The toolbar button should copy the password instead of the URL. Clicking the URL in "General" tab should not have an effect on the toolbar button's functionality.

Actual Behavior

The toolbar button to copy the password of an entry copies its URL instead under certain circumstances. After using another method (context menu, Ctrl+C), the toolbar button works fine.

Context

KeePassXC - 2.7.1
Revision: 5916a8f

Operating System: Windows 10 Version 2009

[HusseinKabbout]

I think the problematic code is here.

With

auto label = qobject_cast<QLabel*>(focusWidget());
if (label) {
    clipboard()->setText(label->selectedText(), clearClipboard);
    return;
}

we are copying a label text to the clipboard, which seems kind of weird. What is the purpose of this code?

Also you don't need to do the steps from above to reproduce this bug. Just select the Experiration value or the Notes value in the EntryPreviewWidget and the selected text will be copied to the clipboard instead of the password.

[HusseinKabbout]

Just found this PR that introduced this code. The purpose of the code is clear now. But it is still problematic for the reason described above.

[droidmonkey]

Hmmm true, that code should only apply in the keyboard shortcut case, not when pressing the toolbar button.

[NicoHood]

Oh man this triggers me so much, glad someone already reported it and found the root cause. Hope you can fix it quick, as it confused my non-tech mum a lot!

[GFTrooper]

Yes this needs to get fixed fast. Having to copy and paste pw "open" isn't the safes way to go.

[NicoHood]

Also it could lead to setting the website as a password string, when creating new accounts. Ooops.

[aaaskew]

I have managed to lock myself out of an account by using the password button 3 times assuming that there could not possibly be a mistake with the copy when it works with other methods. I will rollback to a previous release and wait for the next version as I use this too much for it not to work.

[droidmonkey]

I have fixed this locally. This only occurs when you click the URL link in preview pane and then go back to KeePassXC and try to copy the password. In the meantime, you can overcome this by pressing CTRL+SHIFT+U to open the link instead of clicking it in the preview pane

To beat a dead horse, copy/paste should be a last resort use case. We absolutely recommend using Auto-Type and/or browser extension.

[NicoHood]

I always use copy + paste. It is the most intuitive for me and all my friends do so.

For me this happens (sometimes) when I click multiple times on the copy password icon. At least for me it has nothing to do with clicking on the url icon.

[Kearnlaub]

Reselect the entry then clicking the Password icon will copy the password...would still like to see it fixed.

[NicoHood]

When will we see a hotfix for this issue?

[NicoHood]

Ive checked the 2.7.2 milestone and it still has lots of issues assigned. Will there be a release before all those lots of issues get fixed? I really need a hotfix for this issue, as my clients do not understand why this bug happens and how to work around. It is just magic for them. And for me it is annoying as well and keyboard typing does not always work properly.

Would you mind tagging a bugfix release in between?

[droidmonkey]

We are almost wrapped with 2.7.2. We don't close out all tagged issues for every release, we roll them forward when we are satisfied with the build.

For your users, the simplest work around is to double click the url in the entry view or press Ctrl + Shift + U to open the link.

[NicoHood]

Thanks, that sounds nice! Thanks!

Its not about the url, its about copying the password. When I copy the password, the url is dropped in. Thatswhy it is so critical for us. Copying the url might also be affected, but is not a problem at all. Was the issue then even correctly fixed or did we just missunderstood each other?

[droidmonkey]

The problem is when you click the url in the preview pane it will select the url text. The code that copies the password checks if anything is selected first because the keyboard shortcut is the same as "copy text". The fix is to remove the focus on the url after clicking it, or just don't click it at all.

[NicoHood]

Did this land in 2.7.4?

[droidmonkey]

Yes