qml: enforce single password on password change
What the developer wrote
Authored by f321x
qml: enforce single password on password change
If a qml user with non-uniform wallet passwords tries to change their wallet
password this will force them to change it to a password that is used by
at least one other wallet. This will guide them towards a single wallet
password and prevents the number of different passwords from increasing.
What changed, and why it matters
This commit changes the mobile-style QML wallet settings screen so that when a user tries to change their wallet password, the app encourages (and on Android enforces) using the same password already used by another wallet. It is a user-experience/policy change, not a security fix or vulnerability. There is no evidence of a security bug being patched.
No security action required; review as a normal UX/policy change.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The patch modifies WalletDetails.qml’s password-change dialog. It adds an informational note when single-password mode is enabled and more than one wallet exists, and rejects a new password that is not already used by at least one other wallet. The logic is purely client-side UI enforcement of a single-password policy; it does not alter cryptography, storage, or authentication flows.
Changed components
electrum/gui/qml/components/WalletDetails.qmlInspect captured patch +19 / −4
diff --git a/electrum/gui/qml/components/WalletDetails.qml b/electrum/gui/qml/components/WalletDetails.qml
index 85da196..c0fddd9 100644
--- a/electrum/gui/qml/components/WalletDetails.qml
+++ b/electrum/gui/qml/components/WalletDetails.qml
@@ -525,18 +525,33 @@ Pane {
confirmPassword: true,
title: qsTr('Enter new password'),
infotext: qsTr('If you forget your password, you\'ll need to restore from seed. Please make sure you have your seed stored safely')
+ + (Daemon.availableWallets.rowCount() > 1 && Config.walletShouldUseSinglePassword
+ ? "\n\n" + qsTr('The new password needs to match the password of any other existing wallet.')
+ : "")
})
dialog.accepted.connect(function() {
- var success = Daemon.currentWallet.setPassword(dialog.password)
- if (success && Config.walletShouldUseSinglePassword) {
- Daemon.singlePassword = dialog.password
+ if (Config.walletShouldUseSinglePassword // android
+ && Daemon.availableWallets.rowCount() > 1 // has more than one wallet
+ && Daemon.numWalletsWithPassword(dialog.password) < 1 // no other wallet uses this new password
+ ) {
+ var success = false
+ var error_msg = [
+ qsTr('You need to use the password of any other existing wallet.'),
+ qsTr('Using different wallet passwords is not supported.'),
+ ].join("\n")
+ } else {
+ var success = Daemon.currentWallet.setPassword(dialog.password)
+ if (success && Config.walletShouldUseSinglePassword) {
+ Daemon.singlePassword = dialog.password
+ }
+ var error_msg = qsTr('Password change failed')
}
var done_dialog = app.messageDialog.createObject(app, {
title: success ? qsTr('Success') : qsTr('Error'),
iconSource: success
? Qt.resolvedUrl('../../icons/info.png')
: Qt.resolvedUrl('../../icons/warning.png'),
- text: success ? qsTr('Password changed') : qsTr('Password change failed')
+ text: success ? qsTr('Password changed') : error_msg
})
done_dialog.open()
})
Why this scored 19/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.