Bug 136411

Summary: KWallet loses new passwords when closed since XML file import
Product: [Frameworks and Libraries] kdelibs Reporter: Sebastien Raveau <sebastien.raveau>
Component: kwalletAssignee: kdelibs bugs <kdelibs-bugs>
Status: RESOLVED DUPLICATE    
Severity: normal CC: esigra, giovanni.bobbio, jani-matti.hatinen, lemma, martin.zboril
Priority: NOR    
Version: unspecified   
Target Milestone: ---   
Platform: Ubuntu   
OS: Linux   
Latest Commit: Version Fixed In:
Attachments: sync kwallet changes immediately

Description Sebastien Raveau 2006-10-28 14:10:47 UTC
Version:            (using KDE KDE 3.5.5)
Installed from:    Ubuntu Packages
OS:                Linux

I installed Kubuntu 6.06 on a new harddisk a few days ago and
immediately applied all available upgrades, so it's been running
KDE 3.5.5 from the start.

I could not resist launching Kopete and checking Google Mail while
I completed the install with all the apps that I like under Linux,
so a few passwords were added to KWallet by Kopete and Konqueror
and these passwords are STILL THERE.

Once my install was complete, I started really using it and quickly
came the need to access websites for which I don't remember the
password... so I went back to my old install (Gentoo with KDE 3.4.2),
exported the old KWallet's contents as an XML file via KWalletManager
and imported that XML file in the new KWallet, which worked: all my
passwords were now back in KWallet and automatically filled in
Konqueror, etc... UNTIL I LOGGED OUT and came back the day after.

Indeed, since that day every time I open my KWallet it only contains
the first few passwords that I had entered before importing the XML
file. At first I thought KWalletManager had forgotten to apply the
changes brought by the XML file, but it's way worse: now ANY NEW
PASSWORD that is added to the KWallet (via Konqueror, Kopete, etc)
IS LOST WITHOUT EXCEPTION when I log out and come back.

Thiago Macieira on #kde-devel found a temporary workaround that
forces KWallet to save passwords, which is done by making the
following DCOP call: "dcop kded kwalletd closeAllWallets".

This appears to be a bit similar to bug #97716 (fixed), but if
it really were KDED's fault, why did KWallet work properly the
first few times I used it until I decided to import that XML file?
Comment 1 GB 2006-10-31 11:16:35 UTC
I can't add passwords to my kwallet, either.
I didn't go through a complicated route as the original reporter, kwallet just stopped saving passwords in the wallet file I've been using for some time.
Creating a new, empty, wallet didn't solve the issue.
Comment 2 Altmenorg 2006-11-02 16:52:51 UTC
Confirmed here too.
When new entries are added to my default wallet, they all are lost if I logout/login...
Should be considered critical since most apps use kwallet to store identification infos.
Comment 3 Martijn de Nerd 2006-11-04 13:17:13 UTC
There is a bugreport on this at launchpad as well:
 https://launchpad.net/distros/ubuntu/+source/kdeutils/+bug/67521

simple workaround: save some passwords, at the end of your session rightclick on wallet, select 'close all wallets', logout and all the passwords you saved during the last session will be stored in your wallet. so you'll have to close it everytime you add a password...
Comment 4 GB 2006-11-07 14:29:18 UTC
The workaround works, although it's not really convenient.
Still, there's another anomaly: if a map for a site contains more keys than just a pair of username/password, storing a third key immediately erases from the wallet the username and password just stored. So in this case not even the workaround is any good.
Comment 5 Tommi Tervo 2006-11-08 13:59:52 UTC
*** Bug 136895 has been marked as a duplicate of this bug. ***
Comment 6 Jani-Matti Hätinen 2006-11-28 14:44:13 UTC
I can confirm this on Gentoo with kwalletmanager-3.5.5. Changes to the wallet are only saved when I either close the wallet manually, or when I logout cleanly.

What this means is that in the event of a crash (X11 or kernel), power failure  or something similar I will loose all passwords saved during that session. And because I rarely log out of the system, that could easily mean a month or two's worth of random passwords used once. (which means that my chance of remembering them is zero)

Please, for all that's good and holy, fix kwallet to save the wallet file instantly whenever there's a change and to preferably keep 2-5 backup versions of each wallet automatically in case of a corruption.

This bug is a real showstopper especially since the user only finds out about it after the passwords have been lost. It has already forced me to locally replace all the passwords in one remotely administered server.
Comment 7 Altmenorg 2006-12-05 00:33:14 UTC
Status should probably be changed to "CONFIRMED" no ?
Comment 8 Altmenorg 2006-12-07 01:24:24 UTC
*** This bug has been confirmed by popular vote. ***
Comment 9 Keffin Barnaby 2006-12-11 16:56:11 UTC
Confirmed on Kubuntu Edgy Eft. I have to go to a few sites and go through the "I forgot my password" procedure when I go home :(.

Passwords are saved if I manually close the wallet, but not if I just log out/reboot without manually closing the wallet first. Note that I do not have any of the 3 auto-close wallet options enabled - maybe using the one that closes the wallet when all apps that use it are gone will help (as a work-around). Not tested that yet.
Comment 10 Gehold Bertin 2006-12-21 07:50:16 UTC
I've same problem: http://bugs.kde.org/show_bug.cgi?id=139065

After rebooting KWallet 1.1 (3.5.5) (kubuntu dapper) has only 10 instead of 16 KMail passwords.

Work around seems to work...
Comment 11 Gehold Bertin 2006-12-21 07:53:14 UTC
(I've never tried to import any files)
Comment 12 Josh Metzler 2007-01-18 05:09:40 UTC
Created attachment 19320 [details]
sync kwallet changes immediately

There was a Debian user whose passwords weren't being saved, so I created this
patch to sync all changes to disk immediately after they are made (rather than
waiting for the wallet to close).  This fixed his problem, but he then
reinstalled the previous version, and the problem didn't come back.

Anyway, is there anything wrong with writing the changes to disk right away?
Comment 13 George Staikos 2007-01-18 05:14:56 UTC
Honestly I'm really tired of watching this thread.  The problem is  
that kded is crashing or KDE is not logging out cleanly and therefore  
the passwords are not saving.  If KWallet is set to auto-close, it  
will also save then.  At this point I really don't care anymore  
because I don't see kded ever being fixed.  Therefore the patch is  
fine with me if someone wants to apply it.

--
George Staikos
KDE Developer				http://www.kde.org/
Staikos Computing Services Inc.		http://www.staikos.net/
Comment 14 Henk Spaaij 2007-01-22 02:14:17 UTC
Having a write cache for a store that is rarely modified makes no sense, especially if it contains such valuable data. 

IMHO the usability problem this causes takes first priority. 

I've too have lost passwords because of this 'bug' so I'd really like to see write-through become a permanent solution.
Comment 15 Jani-Matti Hätinen 2007-05-16 00:26:41 UTC
The patch in attachment 19320 [details] works for me.
Comment 16 Martin Rehn 2007-05-27 04:48:44 UTC
I agree with #12-15. Also consider the quite common case of users who *never* log out. Either on a desktop that is always on or on a laptop that is suspended in between uses this is quite normal use. Sessions will then end in only one way: with the occasional crash, that may happen, say, once a month. And so, all passwords be lost.

Hence, no application should count on being able to save its state on exit, because graceful shutdowns may occur rarely if at all.
Comment 17 Michael Leupold 2008-06-14 17:19:23 UTC
Sorry for simply duping this but this is exactly the same problem as reported on kwalletmanager. It's fixed for 4.1 - wallets aren't saved immediately but after a delay of 5 seconds (like this merging/importing wallets doesn't create an overhead).

*** This bug has been marked as a duplicate of 105752 ***
Comment 18 Jani-Matti Hätinen 2008-12-12 00:39:54 UTC
No offense, but calling a critical bug fixed, because it doesn't occur in an API&ABI incompatible version is hardly what I'd describe as the Right Thing To Do(tm).

For Pete's sake, there are hundreds of thousands of people out there depending on this functionality _in_ KDE-3.5, and you shrug them off with "works in 4.1"? This bug includes a patch, which fixes the problem in KDE-3.5 and also is the Right(tm) fix for KDE-4. (I mean, a 5 second delay for saving passwords because of an 'overhead', come on)

Please do something about this in KDE-3.5, or at least have the decency to mark this as WONTFIX.

(And in case you're wondering whether or not this is critical, this bug _eats_ _people's_ _passwords_.)