main: hide update popup during device passphrase prompt
What the developer wrote
Authored by selsta
main: hide update popup during device passphrase prompt
What changed, and why it matters
This tiny change stops a software-update notification window from appearing while the user is entering their hardware wallet passphrase. The most likely real-world effect is avoiding a confusing or annoying overlap of two popups, not a serious security flaw. There is no direct evidence in the commit that this fixes an exploitable vulnerability.
Treat as a minor UI/usability hardening fix. No urgent security action is required based solely on this commit. If a broader security advisory is later published, reassess.
Security signals we found
UI state guard extended to cover hardware-wallet passphrase prompt
Prevents overlapping dialogs during sensitive credential entry
Single-line QML visibility logic change with no cryptographic or network code
Evidence from the diff
In main.qml, the MoneroComponents.UpdateDialog’s ‘allowed’ binding is extended to also require !devicePassphraseDialog.visible. This prevents the update dialog from being shown while a device passphrase prompt is active. The change is defensive UI hardening: it reduces the chance that an update prompt could obscure or interfere with a sensitive hardware-wallet passphrase dialog. The diff alone does not demonstrate a bypass, information leak, or code execution path.
Changed components
monero-gui/main.qmlMoneroComponents.UpdateDialogdevicePassphraseDialogInspect captured patch +1 / −1
diff --git a/main.qml b/main.qml
index 6791957..1db37f4 100644
--- a/main.qml
+++ b/main.qml
@@ -1707,7 +1707,7 @@ ApplicationWindow {
MoneroComponents.UpdateDialog {
id: updateDialog
- allowed: !passwordDialog.visible && !inputDialog.visible && !splash.visible
+ allowed: !passwordDialog.visible && !inputDialog.visible && !splash.visible && !devicePassphraseDialog.visible
x: (parent.width - width) / 2
y: (parent.height - height) / 2
}
Why this scored 18/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.