bugfix: allow password typing with USB disabled
What the developer wrote
Authored by scgbckbone
bugfix: allow password typing with USB disabled
What changed, and why it matters
This commit fixes a bug in the COLDCARD password-notes feature. Previously, the 'Send Password' menu option was accidentally hidden when USB was disabled, because the code reused a setting meant for something else. The fix removes that wrong condition so the option always appears. This is a usability bugfix, not a security vulnerability: it restores intended access rather than opening an unintended one.
No security action required. Treat as a normal bugfix release. If reviewing for supply-chain assurance, verify the change only affects menu visibility and does not alter the send_pw implementation or USB stack.
Security signals we found
No security-relevant signals in the diff or commit message
Change is framed by the author as a bugfix for intended functionality
No privilege escalation, bypass, or cryptographic change
No references to vulnerabilities, CVEs, or security researchers
Evidence from the diff
In shared/notes.py the _make_menu() method removed a predicate=lambda: not settings.get(‘du’, 0) from the ‘Send Password’ MenuItem. The ‘du’ setting controls whether USB is disabled; the predicate was incorrectly gating visibility of the password-sending menu item on that setting. The test was updated to assert ‘Send Password’ is present regardless of the ‘du’ setting. The change is a 1-line functional fix plus a matching test update.
Changed components
shared/notes.py:_make_menu()COLDCARD password-notes UI menutesting/test_notes.py:test_send_password_menu_itemInspect captured patch +3 / −3
### shared/notes.py
@@ -522,7 +522,7 @@ async def _make_menu(self, readonly=False):
# if self.misc: rv.append(MenuItem('↳ (notes)', f=self.view))
rv += [
MenuItem('View Password', f=self.view_pw),
- MenuItem('Send Password', f=self.send_pw, predicate=lambda: not settings.get('du', 0)),
+ MenuItem('Send Password', f=self.send_pw),
]
if not readonly:
rv += [
### testing/test_notes.py
@@ -1131,7 +1131,7 @@ def test_sign_note_body(msg, addr_fmt, acct, need_some_notes,
def test_send_password_menu_item(need_some_passwords, goto_notes, cap_menu, pick_menu_item,
settings_set, settings_remove, press_cancel):
- # covers regression where "Send Password" menu item was only shown when USB was disabled
+ # temporary keyboard emulation works regardless of the normal USB setting
settings_set("notes", [])
need_some_passwords()
@@ -1140,7 +1140,7 @@ def test_send_password_menu_item(need_some_passwords, goto_notes, cap_menu, pick
pick_menu_item([i for i in cap_menu() if i.endswith(': A')][0])
time.sleep(.2)
m = cap_menu()
- assert 'Send Password' not in m
+ assert 'Send Password' in m
press_cancel()
settings_set('du', 0)Why this scored 28/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.