qml: avoid potential Ok signal by tapping while dialog is closing,
What the developer wrote
Authored by Sander van Grieken
qml: avoid potential Ok signal by tapping while dialog is closing,
which led to a crash from AuthMixin.
ref #9138
What changed, and why it matters
This commit fixes a bug in Electrum's mobile-style QML password dialog. If a user tapped the OK/confirm button while the dialog was already closing, the app could emit an extra 'password entered' signal. That extra signal triggered a crash inside the authentication code (AuthMixin). The fix adds a guard so taps during closing are ignored. It is a reliability/crash fix rather than a clear-cut security vulnerability, though crashes in authentication flows can sometimes have security implications.
Treat as a bug-fix commit with possible minor security benefit (DoS/crash avoidance in authentication UI). Review whether the duplicate passwordEntered signal could have any side effects beyond the reported crash, such as triggering an unintended wallet operation. No immediate emergency response is indicated, but the fix should be included in the next release.
Security signals we found
Crash in authentication-related code path (AuthMixin)
Duplicate signal emission during UI state transition
User-interaction race condition (tap while dialog closing)
Fix is defensive/guard-based rather than a full state-machine redesign
Evidence from the diff
In electrum/gui/qml/components/PasswordDialog.qml, an ElDialog-based password dialog now tracks an internal _closing flag. The flag is set to false in onAboutToShow and true in onAboutToHide. The OK ToolButton’s onClicked handler returns early if _closing is true before emitting passwordEntered(password). This prevents a duplicate passwordEntered signal when the dialog is already animating out, which the commit message says led to a crash from AuthMixin.
Changed components
electrum/gui/qml/components/PasswordDialog.qmlAuthMixin (mentioned as crash site, not modified)Inspect captured patch +8 / −0
### electrum/gui/qml/components/PasswordDialog.qml
@@ -17,8 +17,14 @@ ElDialog {
property string infotext
property string errorMessage
+ // Ignore Ok once closing has started.
+ property bool _closing: false
+
signal passwordEntered(string password)
+ onAboutToShow: _closing = false
+ onAboutToHide: _closing = true
+
anchors.centerIn: parent
width: parent.width * 4/5
padding: 0
@@ -98,6 +104,8 @@ ElDialog {
icon.source: '../../icons/confirmed.png'
enabled: confirmPassword ? pw_1.text.length >= 6 && pw_1.text == pw_2.text : true
onClicked: {
+ if (passworddialog._closing)
+ return
passwordEntered(pw_1.text)
}
}Why this scored 34/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.