Keepassxc: AutoOpen Feature should allow usage of referenced fields

[pquerner]

Expected Behavior

A Item in the "AutoOpen" folder with password reference to another item from a different folder should be allowed.

Current Behavior

The AutoOpen feature tries the reference string as password, which won't work.

Possible Solution

Allow unserialization of reference strings for fields for items within "AutoOpen" folder.

Steps to Reproduce (for bugs)

1. Create 2 keepass files protected with a password.
2. Open keepass file 1 and create a new entry in the root folder, with URL file://<where keepass file 2 is> and password
3. Clone that entry and check that the cloned item should use references for username and password
4. Create folder "AutoOpen" under root folder
5. Move that cloned entry with the references to that folder
6. Close all open databases
7. Open keepass file 1.
8. The AutoOpen feature will trigger but will be unable to open keepass file 2 for you, since the password (the reference string) will be interpreted as password, which is wrong.

Context

See related issues

1259

maybe

1536

Line in question (possible)
https://github.com/keepassxreboot/keepassxc/blob/0f604aa8c7ce47ce504f5a9d72acd9871802bebd/src/gui/DatabaseTabWidget.cpp#L631
(will use whatever is in the password field, without checking against references)

Debug Info

KeePassXC - Version 2.3.3
Revision: 0a155d8

Libraries:

• Qt 5.9.3
• libgcrypt 1.8.2

Operating system: macOS High Sierra (10.13)
CPU architecture: x86_64
Kernel: darwin 17.6.0

Enabled extensions:

• Auto-Type
• Browser Integration
• Legacy Browser Integration (KeePassHTTP)
• SSH Agent
• YubiKey

[PolyMMA]

yes, this is definitly an issue

[droidmonkey]

I'm not against supporting this fix, but why is this an issue? In what context do you need to have multiple copies of an auto open entry across your database?

[PolyMMA]

I am raising the issue here too https://github.com/PhilippC/keepass2android/issues/1138

This is needed if one wants to be able to unlock a slave.kdbx when unlocking a master.kdbx on both the desktop KeePassXC and KeePass2Android.

"""
Current solution:

Currently, the only solution I find is to have one entry for the slave.kdbx with URL: dropboxKP2A:///slave.kdbx or dropbox:///apps/keepass2android/slave.kdbx
and one clone of the same with URL: slave.kdbx.
NOTE: Currently it is not possible to use AutoType with referenced password "{REF:P@I:UUID-hash}" since the AutoType {PASSWORD} will forward the actual reference tag instead of the content it is referencing to. So, do a static clone for now.
"""

[leo-b]

This is needed if one wants to be able to unlock a slave.kdbx when unlocking a master.kdbx on both the desktop KeePassXC and KeePass2Android.

I have the same use case: A child database located in a nextcloud cloud storage that should be accessed from 3 different desktops (keepassxc on windows and linux) and a mobile using keepass2android. The path to the slave database and the key-file is different on each box, which necessitates different AutoOpen entries for each box.

It would be nice if all of them could reference a password that needs to be stored at one place.

[droidmonkey]

Ok that makes sense.

[droidmonkey]

Related to #2871

[PolyMMA]

Than you for considering this! :)