If one has KeePassXC running and a database open, and then changes happen to one or more entries of the on-disk version of the database, KeePassXC will detect changes to the on-disk version of said database and merge changes into the currently open version of the database. However, if the the on-disk database's master password (or presumably the master key) changes, KeePassXC will not merge in any content changes. It also won't notify the user that the on-disk database has a different master password, and when KeePassXC next saves the in-memory database, it simply overrides the on-disk version entirely. ## Expected Behavior Warn the user, possibly provide them a mechanism to resolve the merge. ## Current Behavior When the on-disk database has a different master password, KeePassXC will: 1. Silently ignores changes from the on-disk version of the database 2. Silently overwrites the on-disk version of the database upon next save of the in-memory database ## Possible Solution Notify the user that the on-disk version of the database has changed and requires a different master password (or key) to merge in changes. Give the end user an option to either enter/provide the new password/key or to ignore the on-disk version. ## Steps to Reproduce data loss scenario 1. While running KeePassXC, create an empty database named db1.kdbx with password 'foo'. Save the database, leave 'db1' open. 2. In a shell type the following to create a copy, add an entry, and open the copy up ```sh $ cp db1.kdbx db2.kdbx $ echo foo | keepassxc-cli add db2.kdbx test-entry $ keepassxc db2.kdbx ``` 3. Type in "foo" as the database password to unlock db2 4. Click 'Database' -> 'Change master key'. In the password fields entry in 'bar' twice, and click 'OK' 5. Click 'Save'. Close db2.kdbx 6. Back in the shell, copy db2 over db1 and then delete db2: ```sh $ cp db2.kdbx db1.kdbx $ rm db2.kdbx ``` 7. Back in KeePassXC, note the lack of any sort of notification or change in the window with db1 open. 8. In db1, make a change and save. Note the lack of notification about overwriting the on-disk version and resultant loss of 'test-entry' from the disk/memory/etc. ## Debug Info KeePassXC - 2.3.3 Revision: 0a155d8 OS: Linux

Change to master password of on-disk database is not picked up by running instance #2176

Company

Community

Support

Connect