github-starred/android
2
0
Fork 0
mirror of https://github.com/bitwarden/android.git synced 2026-03-16 08:33:59 -05:00
Code Issues 144 Packages Projects Releases 116 Wiki Activity

[PR #2593] [PM-1063] Re-prompt for Master Password Can be Bypassed When Using Gboard Inline Autofill #3667

New Issue
Closed
opened 2025-11-26 23:35:55 -06:00 by GiteaMirror · 0 comments
GiteaMirror commented 2025-11-26 23:35:55 -06:00
Owner
Copy Link

Original Pull Request: https://github.com/bitwarden/android/pull/2593

State: closed
Merged: Yes

Type of change

  • Bug fix
  • New feature development
  • Tech debt (refactoring, code cleanup, dependency upgrades, etc)
  • Build/deploy pipeline (DevOps)
  • Other

Objective

An issue has been identified that allows users to bypass the master password re-prompt on vault items that require a re-prompt within Android. If a user has opted to allow inline autofill, they can use the filter feature to find the item they are attempting to autofill, and select "Autofill" from that list of items to bypass the required re-prompt.

This code change adds a check shortly after selecting "Autofill" or "Autofill and Save", checking if the cipher requires a re-prompt, and forcing the user to enter the password before the autofill occurs.

Code changes

  • src/App/Pages/Vault/CiphersPageViewModel.cs: Added a conditional check within theSelectCipherAsync method that identifies if a master password re-prompt is required. If not, then the autofill occurs as expected. If so, then we prompt the user for the master password before autofilling.

Screenshots

https://github.com/bitwarden/mobile/assets/16629865/58add0b9-22ed-4f78-9ebf-32818bc7361f

**Original Pull Request:** https://github.com/bitwarden/android/pull/2593 **State:** closed **Merged:** Yes --- ## Type of change - [x] Bug fix - [ ] New feature development - [ ] Tech debt (refactoring, code cleanup, dependency upgrades, etc) - [ ] Build/deploy pipeline (DevOps) - [ ] Other ## Objective An issue has been identified that allows users to bypass the master password re-prompt on vault items that require a re-prompt within Android. If a user has opted to allow inline autofill, they can use the filter feature to find the item they are attempting to autofill, and select "Autofill" from that list of items to bypass the required re-prompt. This code change adds a check shortly after selecting "Autofill" or "Autofill and Save", checking if the cipher requires a re-prompt, and forcing the user to enter the password before the autofill occurs. ## Code changes * **src/App/Pages/Vault/CiphersPageViewModel.cs:** Added a conditional check within the`SelectCipherAsync` method that identifies if a master password re-prompt is required. If not, then the autofill occurs as expected. If so, then we prompt the user for the master password before autofilling. ## Screenshots https://github.com/bitwarden/mobile/assets/16629865/58add0b9-22ed-4f78-9ebf-32818bc7361f
GiteaMirror added the pull-request label 2025-11-26 23:35:55 -06:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
app:authenticator
app:password-manager
bug
bug-passkey
customer-support
duplicate
enhancement
good first issue
help wanted
needs-reply
needs-response
pull-request
Mirrored from GitHub Pull Request
 question
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/android#3667
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?