apply the fix for the model overlap issue on proverownership page
What the developer wrote
Authored by aaron
apply the fix for the model overlap issue on proverownership page
What changed, and why it matters
This commit fixes a UI bug in the Keystone 3 hardware wallet where a password-entry modal did not fully cover the screen and did not block touch input on empty areas. Because taps could pass through to buttons on the page underneath, a user might accidentally confirm or trigger an action while entering a password. The patch makes the modal cover its parent completely and marks it as clickable so it absorbs touches.
Review other modal creation helpers for the same pattern (fixed dimensions and missing CLICKABLE flag), and verify that all password/passphrase entry modals fully cover and absorb input on their parent containers.
Security signals we found
Click-through modal allowing unintended interaction with underlying page buttons
Fixed-size modal leaving uncovered screen real estate on lv_layer_top
UI-level safety issue in password-entry flow (prove ownership / passphrase screen)
Evidence from the diff
In GuiCreateKeyboardWidgetView(), the modal container was created with a fixed size of 480 x (800 - GUI_STATUS_BAR_HEIGHT). When the parent was lv_layer_top (full screen), this left the bottom strip uncovered, and because GuiCreateContainerWithParent clears LV_OBJ_FLAG_CLICKABLE, taps on blank modal areas fell through to widgets beneath. The patch updates the container to use the parent’s actual width and height and re-adds LV_OBJ_FLAG_CLICKABLE, closing the click-through surface.
Changed components
src/ui/gui_components/gui_keyboard_hintbox.cGuiCreateKeyboardWidgetView()Prove ownership page password-entry modalInspect captured patch +9 / −1
diff --git a/src/ui/gui_components/gui_keyboard_hintbox.c b/src/ui/gui_components/gui_keyboard_hintbox.c
index ca74ead..7b5f78c 100644
--- a/src/ui/gui_components/gui_keyboard_hintbox.c
+++ b/src/ui/gui_components/gui_keyboard_hintbox.c
@@ -241,7 +241,15 @@ static void CloseKeyboardWidgetViewHandler(lv_event_t *e)
KeyboardWidget_t *GuiCreateKeyboardWidgetView(lv_obj_t *parent, lv_event_cb_t buttonCb, uint16_t *signal)
{
KeyboardWidget_t *keyboardWidget = CreateKeyboardWidget();
- lv_obj_t *keyboardHintBox = GuiCreateContainerWithParent(parent, 480, 800 - GUI_STATUS_BAR_HEIGHT);
+ // This is a modal over a live page: it must cover the parent COMPLETELY and absorb touches.
+ // Size to the parent, not a fixed 800-48 — parents differ per caller (page content zone vs
+ // lv_layer_top spanning the full screen), and a fixed height leaves the bottom strip of
+ // lv_layer_top uncovered, exposing the underlying page's buttons. CLICKABLE must be re-added
+ // because GuiCreateContainerWithParent clears it, which lets taps on blank modal areas fall
+ // through to the widgets beneath.
+ lv_obj_update_layout(parent);
+ lv_obj_t *keyboardHintBox = GuiCreateContainerWithParent(parent, lv_obj_get_width(parent), lv_obj_get_height(parent));
+ lv_obj_add_flag(keyboardHintBox, LV_OBJ_FLAG_CLICKABLE);
lv_obj_align(keyboardHintBox, LV_ALIGN_DEFAULT, 0, 0);
lv_obj_t *img = GuiCreateImg(keyboardHintBox, &imgArrowLeft);
Why this scored 59/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.