bitshares / bitshares/bitshares-ui
Possible security flaw
- Dominant language
- JavaScript
- Stars
- 520
- Forks
- 575
- Avg merge
- 12h 7m
- Merged PRs (30d)
- 5
Description
**Describe the bug**
I just had a long conversation with a Russian who had problems with the app. He had tried many things on three different computers. I noticed right away that the password was too short for a cloud account which was evident that he tried to from a screen shot.
I went on and suggested that it might be the problem and yes, he had a backup of a .bin file.
He went on trying to restore and managed to get in somehow. But vital elements in the GUI was either greyed out or missing. The padlock for example would not show. And all attempts to send to an external addresses failed.
I had also noticed from one of the screenshots that he had renamed his .bin to remember his account name presumably. I suggested this as a possible explanation and gave no guarantees it was right. The guy then went on and renamed the file after the naming convention and restored it. And to my surprise reported everything worked as normal.
**To Reproduce**
I'm uncertain if he renamed the file while saving it or afterwards.
**Expected behavior**
Unconventional naming renders GUI useless
**Screenshots**
Available here: https://t.me/btsWalletHelp
There are a lot of them, not all relevant.
**Desktop (please complete the following information):**
Various OSes from windows 7 to 10 and Mac OS high sierra
Bitshares desktop GUI used. The first one over a year old, which I persuaded him to throw away.
**Additional context**
User was unfamiliar with basic concepts of Mac OS
Contributor guide
Research direction
Start by clarifying whether the .bin file was renamed during saving or afterward, then reproduce restoration with the reported naming convention on the listed Windows and macOS environments. Use the linked screenshots as context. Done means an unconventionally named backup either restores correctly or produces a clear error without disabling GUI elements or external transfers.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript
- Domain
- desktop, security
- Issue type
- Bug
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 15/100