Bug 492862

Summary: Deleting a sticky note doesn't delete the file containing its text from ~/.local/share/plasma_notes/
Product: [Plasma] kdeplasma-addons Reporter: Nate Graham <nate>
Component: notesAssignee: Plasma Bugs List <plasma-bugs>
Status: RESOLVED FIXED    
Severity: normal    
Priority: NOR    
Version: master   
Target Milestone: ---   
Platform: Other   
OS: Linux   
Latest Commit: https://invent.kde.org/plasma/kdeplasma-addons/-/commit/98b2cb809c3a4bf7ebd3b4a318a1aa88a465f0d5 Version Fixed In: 6.4.0
Sentry Crash Report:

Description Nate Graham 2024-09-09 06:41:29 UTC 
STEPS TO REPRODUCE
1. Create a new sticky note saying "oingo boingo" via any method
2. Delete it by clicking on its trashcan icon and confirming, then dismiss the undo notification
3. In a terminal window, run `grep -r "oingo boingo" ~/.local/share/plasma_notes/`


OBSERVED RESULT
The text file backing the deleted sticky note is still there:

$ grep -r "oingo boingo" ~/.local/share/plasma_notes/
/home/nate/.local/share/plasma_notes/76b23a90-b5c8-4a15-8ea2-3bddb968ab:<p style=" margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; -qt-block-indent:0; text-indent:0px;">oingo boingo</p></body></html>


EXPECTED RESULT
No files found


ADDITIONAL INFORMATION
This could be a serious data leak if you store sensitive information on notes and then delete them.

If this is not a simple bug, it might have been intentional to alleviate Bug 453673. However this is not the optimal way to implement such a safety mechanism as it's 100% invisible to normal users most likely to need it.
Comment 1 Bug Janitor Service 2025-01-27 14:56:38 UTC 
A possibly relevant merge request was started @ https://invent.kde.org/plasma/kdeplasma-addons/-/merge_requests/655
Comment 2 Marco Martin 2025-01-28 16:08:51 UTC 
Git commit 98b2cb809c3a4bf7ebd3b4a318a1aa88a465f0d5 by Marco Martin.
Committed on 28/01/2025 at 08:23.
Pushed by mart into branch 'master'.

applets/notes: delete notes files when notes removed

if the note has been removed (removed the applet then closed the undo
notification) then actually remove the file when the note is removed:
we can know this if a Plasmoid.destroyedChanged(true) has been emitted
before Component.onDestruction, which doesn't happen
during normal shotdown

M  +8    -1    applets/notes/package/contents/ui/main.qml

https://invent.kde.org/plasma/kdeplasma-addons/-/commit/98b2cb809c3a4bf7ebd3b4a318a1aa88a465f0d5