Privatebin: Unable to paste password from clipboard into password prompt

[tristanbolton]

Steps to reproduce

1. Create a new paste with a password
2. Copy the password to a clipboard and safe it in a text file
3. Open the encryption url and the password dialog will pop up
4. Attempt to copy/paste the password into the password dialog.

What happens

I cannot paste a password into the password dialog of the after loading the decryption URL. This seem to be an issue with 1.3.x as I've tested with 1.2.x and this isn't an issue

What should happen

A user should be able to paste the password into the password prompt of the decryption URL.

Additional information

Basic information

https://email.bsiapp.ca/

Ubuntu 18.04

Apache2

Firefox and Chrome

PrivateBin version: 1.3.3

I can reproduce this issue on https://privatebin.net: No

[elrido]

There is an exception in the browser console that doesn't occur on the demo site. Could you share which configurations you have changed on your site, so that we can replicate this?

[rugk]

Indeed, that is very strange. Wo do nothing knowingly to prevent pasting there.

And indeed I cannot reproduce it on https://privatebin.net/?c6140d08889f7059#HeBdqa2KB16MUAKpG19BVkFvu6gHJjTYErkuNbfkdErZ but on https://zerobin-sqlite.dssr.ch/?98ec685fb23e981a#8nztYmnzayGqbLT63N9nCAAZo4peiAp8HbiDmZm2884A it _is_ reproducible e.g. (password always: 123)

And I could reproduce it without any add-ons (all add-ons disabled) in a Firefox 73.

Also see https://github.com/PrivateBin/PrivateBin/issues/565, where @LizaChernysh reported this and we mistakenly thought it is some local browser extension.
Given what we know now, that does not seem to be the case, so sorry. Anyway I'd like to keep this issue open as it is more detailed.

[rugk]

Debugging the difference (via Firefox event listener breakpoints), I do so one difference:

• pasting at https://zerobin-sqlite.dssr.ch inside the password box triggers jQuery
  
• pasting at https://privatebin.net does _not_ trigger jQuery

[elrido]

Agreed about the deeper investigation of this in here. Since we now can reproduce it and could rule out the browser being responsible, the obvious remaining difference is options set on the server side for our application. The OPs instance has enabled file uploads and changed the title, hence I asked if they could share the full list of changes. That would allow us to fully recreate the issue locally for debugging. Maybe the file upload feature triggers some drag and drop feature that causes this issue in the paste functionality?

[tristanbolton]

Hey - Here are the details of my install:

• AWS Ubuntu 18.04 AMI Template
• Installed apach2 - sudo apt-get install apache2 apache2-doc apache2-utils libexpat1 ssl-cert
• Installed php - sudo apt install php7.2 libapache2-mod-php7.2
• Installed and setup LetsEncrypt
• changed ownership of pastebin web files - chown -Rv www-data.www-data ./
• Modified conf.php file (running .php is attached) Diff of orignal compared to live conf file below:

diff conf.php conf.sample.php
8c8
< name = "PrivateBin - Powered by BoltonSmith Inc."
---
> ; name = "PrivateBin"
11c11
< discussion = false
---
> discussion = true
20c20
< fileupload = true
---
> fileupload = false
33c33
< sizelimit = 1048576000
---
> sizelimit = 10485760
39c39
< ; notice = "Note: This is a best effort service: Data may be deleted anytime."
---
> ; notice = "Note: This is a test service: Data may be deleted anytime. Kittens will die if you abuse this service."
116,117c116,117
< ;1year = 31536000
< ;never = 0
---
> 1year = 31536000
> never = 0
128c128
< limit = 50
---
> limit = 10

If there is anything else you need to help troubleshoot let me know.

Thank you all!

conf.php.txt

[tristanbolton]

I did some more testing on my side and if I change the conf.php to fileupload = false I can paste the password no problem.

For some reason when I have conf.php fileupload = true I cannot paste the password.

Hope that helps.

[jnnngs]

I can confirm its the fileupload = true that causing the issue. When set to false, it works fine.

[rugk]

Okay, found the culprit:
https://github.com/PrivateBin/PrivateBin/blob/879a2a92550b1df3d6b6be62644aea51d4bd30a5/js/privatebin.js#L3119-L3125