* Fixes#10400
- Support TOTP entries with bare secrets instead of otpauth urls for Bitwarden. Vice-versa for 1PUX.
- Support Bitwarden Argon2id encryption scheme
* Fixes#10380 - Support Bitwarden organization collections
* This removes the application setting to require typing the password in again even though it is visible.
* Removed automatic password repeat when the password is made visible on changing.
* Closes#7545 - Support 1Password 1PUX import format based on https://support.1password.com/1pux-format/
* Closes#8367 - Support Bitwarden JSON import format (both unencrypted and encrypted) based on https://bitwarden.com/help/encrypted-export/
* Fixes#9577 - OPVault import when fields have the same name or type
* Introduce the import wizard to handle all import tasks (CSV, KDBX1, OPVault, 1PUX, JSON)
* Clean up CSV parser code to make it much more efficient and easier to read
* Combine all importer tests (except CSV) into one test file
Refactors the Passkey implementation to include more checks and a structure that is more aligned with the official specification.
Notable changes:
- _BrowserService_ no longer does the checks by itself. A new class _BrowserPasskeysClient_ constructs the relevant objects, acting as a client. _BrowserService_ only acts as a bridge between the client and _BrowserPasskeys_ (authenticator) and calls the relevant popups for user interaction.
- A new helper class _PasskeyUtils_ includes the actual checks and parses the objects.
- _BrowserPasskeys_ is pretty much intact, but some functions have been moved to PasskeyUtils.
- Fixes Ed25519 encoding in _BrowserCBOR_.
- Adds new error messages.
- User confirmation for Passkey retrieval is also asked even if `discouraged` is used. This goes against the specification, but currently there's no other way to verify the user.
- `cross-platform` is also accepted for compatibility. This could be removed if there's a potential issue with it.
- Extension data is now handled correctly during Authentication.
- Allowed and excluded credentials are now handled correctly.
- `KPEX_PASSKEY_GENERATED_USER_ID` is renamed to `KPEX_PASSKEY_CREDENTIAL_ID`
- Adds a new option "Allow localhost with Passkeys" to Browser Integration -> Advanced tab. By default it's not allowed to access HTTP sites, but `http://localhost` can be allowed for debugging and testing purposes for local servers.
- Add tag `Passkey` to a Passkey entry, or an entry with an imported Passkey.
Fixes#10287.
Closes#2689
The design of the respective code is loosely based on KDE's KActionCollection. The ActionCollection manages all actions that can be shortcut configured. These actions are then exposed in the config and a user can assign a different shortcut.
Actions inside the MainWindow have been added to the ActionCollection.
---------
Co-authored-by: Jonathan White <support@dmapps.us>
* Set default value of DatabasePasswordMinimumQuality to 3 (do not accept a master password that is less than Good)
* Add custom message box button "Continue with weak password"
Closes#5991Closes#3337 - Support fingerprint readers on Linux
Polkit allows for authentication of many means, including fingerprint scanning. Furthermore, a common interface for Quick Unlocking has been implemented, and has been replaced throughout to make implementing other quick unlock strategies easier.
Refactor QuickUnlock to use UUID stored in headers. This is a new feature using the KDBX 4 standard to store a randomly generated UUID in the public headers of the database. This enables identification of KDBX file without relying on path or filename and will eventually support persistent Quick Unlock.
* Fix#7892 - Pressing escape when the quick unlock prompt is shown will now go back to the main unlock dialog view.
* Fix#9030 - Quick unlock will be automatically invoked in the unlock dialog upon being shown.
* Fix#9554 - Quick unlock application setting will be updated every time the settings widget is shown instead of just on first launch.
* Show warning that quick unlock is not enabled if user cancels Windows Hello prompt. This should limit people thinking there is a security issue. Also improve documentation describing this behavior.
* Disable quick unlock in gui tests
Fixes#6190
Remove the advanced settings checkbox and replace with a dedicated tab widget interface to toggle between basic and advanced encryption settings.
Add a new propery autosaveDelay in Metadata of the db.
The property is saved in customData to not affect database structure as this setting is unique to keepasxc.
The propery sets delay to wait since last modification before saving.
Co-authored-by: jNullj <jNullj@users.noreply.github.com>
Enable buddy fields in group and entry edit pages
* Fixes#9060, you can now press Alt + [letter] to skip between fields on the group and entry edit pages.
* Move the expire checkbox to the right hand column and use the standard eye icon button for notes reveal. Only show notes reveal button if the hide notes setting is enabled.
Fix overflow of text in default auto-type sequence preview
* Fixes#9083
Add copy title shortcut (Ctrl + I)
* Closes#9109
Fix issues with menu actions being enabled incorrectly
Add accessibility description to password widget to explain how to hide/show passwords and open the generator
* Closes#9059
Add F6 shortcut to focus search
* Closes#9163
* Add configuration to hide TOTP in preview widget (shown by default).
* Retain the visibility of TOTP and other fields when the same entry remains selected in the preview panel.
* Fix disconnecting signals when switch entries / groups. This likely is going to fix crashes because we were compounding signals when focusing in on the main window.
* Fix#8952 - move translations for Cipher and KDF strings into evaluated code instead of globally defined code. The strings were being baked prior to the language being set resulting in only english being displayed.
The KeyCredentialManager::RequestCreateAsync call can fail because we can end up in a situation where Windows Hello is initially available but then becomes unavailable, such as during a remote desktop session. This commit prevents a crash by moving the call into the try-catch.
Fixes#7890
Also resets quick unlock if there is an unrecoverable error. This will not occur if the user merely canceled the Windows Hello dialog.
Supported key types are RSA, ECDSA and Ed25519.
Includes tests to compare writing out keys produce the exact same private key if read from OpenSSH format and tests against ssh-agent to ensure all no generated key is rejected.
* Fix detecting AES-256/GCM cipher, fixes#8964
When you generate a ssh key using the aes-256/gcm cipher, the cipher name in the keyfile includes an @openssh.com at the end.
* Use separate iv length for getting iv data, the assumption that the block size and iv size are equal does not hold for every cipher mode (e.g., GCM)
* Disable AES-256/GCM for now in ssh keys
Currently, the granularity for the botan gcm implementation is too large. To fix a problem with another algorithm in the library, they are multiplying
the blocksize, so by default the granularity is 64. This causes issues since the encrypted data in the key is only guaranteed to have a length that is a multiple of the block size (16).
currently, when keepassxc is not running, the command `keepassxc --lock` opens a new keepass window and blocks until the window is closed.
Especially in locking scripts this is rather unexpected and Ican't think of a case where someone explicitly starts keepass with --lock and wants this behaviour.
Rather --lock should always ensure, that there are no unlocked instances and exiting afterwards
* Rename "Database Tags" to "Searches and Tags"
* Separate searching for all entries and resetting the search
* Support selecting multiple tags to search against
* Fix using escaped quotes in search terms
* Make tag searching more precise
* Support `is:expired-#` to search for entries expiring within # days. Exclude recycled entries from expired search.
* Don't list tags from entries that are recycled
* Force hide tag auto-completion menu when tag editing widget is hidden. On rare occasions the focus out signal is not called when the tag view is hidden (entry edit is closed), this resolves that problem.
* Remove spaces from before and after tags to prevent seemingly duplicate tags from being created.
* Also fix some awkward signal/slot dances that were setup over time with the entry view and preview widget.
Allow changing tags for multiple entries through context menu
* Closes#8277 - show context menu with currently available tags in database and checks those that are set on one or more selected entries. When a tag is selected it is either set or unset on all entries depending on its checked state.
* Add ability to save searches and recall them from the "Searches and Tags" view
* Add ability to remove a tag from all entries from the "Searches and Tags" view
* Cleanup tag handling and widgets
* Fix#1090 - delay locking databases after minimize to allow for clipboard use, Auto-Type use, and browser integration use.
* Fix#6757 - prevent setting both minimize on unlock and lock on minimize settings at the same time.
1. Replaces words removed by pull 6914 <23b9e35de9> for possible offense. This restores the total word count.
Add replacement: grope -> . . . -> grouch
Change: hardcopy -> hardcopy -> hardback
Replace: hardcore -> . . . -> hardball
(I couldn't see "hardcopy" as a single word in American dictionaries from the turn of the century. It's too much of a neologism [and if we can't have "hardcore," then there's nothing else I can fit in that gap]. I had to remove another word to allow the addition of two new words here to preserve ordering. It's also an improvement because "hardcopy" is not a single word in dictionaries older than a decade or so.)
Add replacement: swinger -> . . . -> swindle
2. Yo-yo and yoyo are two spelling of the same exact word, and the latter spelling is "non-standard."
Keeping: yo-yo (t-shirt is the one other hyphenated word and I can't find a suitable candidate for either without creating several conflicts on the long wordlist)
Change: yoyo -> young
3. Word repetition: two spellings of same word hankie.
Keeping: hankie (as the "correct" spelling because "hanky" is more common in "hanky-panky").
Change: hanky -> hanoi
(The other option was to insert "hansom" between "hanky" and "haphazard," but "handsome" is a homophone because the "d" became silent many years ago.)
4. Changed proper nouns and brand names to regular nouns:
dropbox -> dropforge
ebay -> eaves
google -> goosey as in "loosey-goosey" (the real word is "googol," anyhow)
This necessitated changing goon -> gooseneck
ipad -> iota
iphone -> ire
ipod -> iridium
This necessitated irate -> iris
kleenex -> knack (the word "tissue" exists)
lego -> legitimate
xbox -> xenon (which sounds like x box or x-box, too)
Keeping: xerox (now genericized like aspirin)
5. Replaced non-standard words around "drop" and the brand name in there
drop-down -> drop-in
ebook -> (genericized like "email")
ecard -> echelon
This necessitated eccentric -> echidna
harddisk -> hardedge (Hardedge is an art style. Hard disk is always two words or else is abbreviated as HDD for hard disk drive)
6. Replaced flirtatious activity
footsie -> footstool
Which necessitated making footsore -> footway
7. Potentially sensitive anatomy
gonad -> golly
siamese -> sial (Siamese = Thai, but "twins" is also on the list and "Siamese" could precede "twins," which is slur for conjoined twins.)
8. Politically sensitive
islamist -> island (An Islamist is someone who wants to enforce political Islam on all with a literal and conservative interpretation of the Qu'ran. It does not mean Muslim.)
marxism -> marzipan (I'm a big old lefty, myself, but I need to be consistent)
********
These necessitated a couple changes to nearby words where a drop-in replacement word did not exist, which required shifting neighboring words slightly.
Alphabetical order preserved and total word count should match EFF's modified and the original Diceware list. No breaking changes.
* Fix#7726 - Ignore BEEP Auto-Type token when it includes spaces and numbers as well
* Close#8103 - Allow specifying specific attribute to use with PICKCHARS. If none specified, it defaults to Password.
* Fix#7811 - Notes height no longer truncated
* Fix#7949 - Improve copying attribute value to clipboard in entry preview
* Fix#7898 - Prevent copying url when copy password selected after clicking url in preview pane
* Fix#7982 - Double clicking hidden attributes in preview pane copies the value instead of ●●●●●●
* Split calls to finding hardware keys into sync and async methods. This has the side effect of simplifying the code.
* Check for keys before performing challenge/response if no keys have been found previously.
* Correct timeout of user interaction message to interact with the hardware key.
* Correct error in TestCli::testYubiKeyOption
Also added a reset decision button in session management tab
Fixes#7464
* Fix distorted button in settings page: the default margin in QToolBar is too large for our use case in a table row.
