Keepassxc: Database corruption on merging to a locked database

[phanimahesh]

I just lost my database. Fingers were faster than they should've been, attempted a merge while my db was locked. That just opened the db I'm merging. Manually opening the db I merged into shows it's corrupt.

I guess it was because the db was locked, looking at similar corruption issues in the past. This is the second corruption I had resulting in loss of some data.

Expected Behavior

Merging into locked database should not corrupt it.

Steps to Reproduce (for bugs)

1. Open database, set to auto lock after delay. Wait for db to be locked.
2. Select Database -> Merge from KeepassXC database
3. Poof. DB gets corrupt

Debug Info

KeePassXC - Version 2.3.1
Revision: 2fcaeea

Libraries:

• Qt 5.10.1
• libgcrypt 1.8.2

Operating system: Arch Linux
CPU architecture: x86_64
Kernel: linux 4.15.15-1-ARCH

Enabled extensions:

• Auto-Type
• Browser Integration
• Legacy Browser Integration (KeePassHTTP)
• SSH Agent
• YubiKey

[droidmonkey]

I fixed this in #1219. Unless merging is somehow bypassing the standard save functions. You didn't keep any backups? Were you using kdbx4?

[phanimahesh]

My backups were stale, I know, stupid stuff, but shit happens. I lost a small fraction of my changes, but among them are a few important ones.

How do I check if I'm using kdbx4? The file has a .kdbx extension

[droidmonkey]

If you dont know then you are not using it, it is currently opt-in on the database settings. I'm going to look into this and try to replicate.

[droidmonkey]

OK, so I replicated the issue, there is definitely a problem. HOWEVER, the database is NOT CORRUPT. Just uncheck the password checkbox and you will be able to decrypt it. Basically the database gets saved without any password, keyfile, whatever.

This needs to be fixed ASAP.

[phanimahesh]

Whoa!
Turns out both my corrupted databases were saved without encryption. Was able to open them up and merge, but now I have to figure out a way to diff the old versions from the new properly (#1152).

Thanks for investigating the issue. I was able to recover both my "corrupt" databases, since I saved their copies in hopes of cracking the puzzle sometime.

[droidmonkey]

Awesome

[phoerious]

Or scary.