Handle URL port and scheme when requesting credentials

keepassxreboot · May 28, 2018 · 1701bcb · 1701bcb
1 parent b16447b
commit 1701bcb
Show file tree

Hide file tree

Showing 2 changed files with 23 additions and 12 deletions.
diff --git a/src/browser/BrowserService.cpp b/src/browser/BrowserService.cpp
@@ -366,7 +366,7 @@ void BrowserService::updateEntry(const QString& id, const QString& uuid, const Q
     }
 }
 
-QList<Entry*> BrowserService::searchEntries(Database* db, const QString& hostname)
+QList<Entry*> BrowserService::searchEntries(Database* db, const QString& hostname, const QString& url)
 {
     QList<Entry*> entries;
     Group* rootGroup = db->rootGroup();
@@ -375,22 +375,33 @@ QList<Entry*> BrowserService::searchEntries(Database* db, const QString& hostnam
     }
 
     for (Entry* entry : EntrySearcher().search(hostname, rootGroup, Qt::CaseInsensitive)) {
-        QString title = entry->title();
-        QString url = entry->url();
+        QString entryTitle = entry->title();
+        QString entryUrl = entry->url();
+        QUrl entryQUrl(entryUrl);
+        QString entryScheme = entryQUrl.scheme();
+        int entryPort = entryQUrl.port();
+        QUrl qUrl(url);
+        QString scheme = qUrl.scheme();
+        int port = qUrl.port();
+
+        // Ignore entry if port or scheme defined in the URL doesn't match    
+        if ((entryPort > 0 && entryPort != port) || entryScheme.compare(scheme) != 0) {
+            continue;
+        }
 
         // Filter to match hostname in Title and Url fields
-        if ((!title.isEmpty() && hostname.contains(title))
-            || (!url.isEmpty() && hostname.contains(url))
-            || (matchUrlScheme(title) && hostname.endsWith(QUrl(title).host()))
-            || (matchUrlScheme(url) && hostname.endsWith(QUrl(url).host())) ) {
+        if ((!entryTitle.isEmpty() && hostname.contains(entryTitle))
+            || (!entryUrl.isEmpty() && hostname.contains(entryUrl))
+            || (matchUrlScheme(entryTitle) && hostname.endsWith(QUrl(entryTitle).host()))
+            || (matchUrlScheme(entryUrl) && hostname.endsWith(QUrl(entryUrl).host())) ) {
                 entries.append(entry);
         }
     }
 
     return entries;
 }
 
-QList<Entry*> BrowserService::searchEntries(const QString& text, const StringPairList& keyList)
+QList<Entry*> BrowserService::searchEntries(const QString& url, const StringPairList& keyList)
 {
     // Get the list of databases to search
     QList<Database*> databases;
@@ -417,11 +428,11 @@ QList<Entry*> BrowserService::searchEntries(const QString& text, const StringPai
     }
 
     // Search entries matching the hostname
-    QString hostname = QUrl(text).host();
+    QString hostname = QUrl(url).host();
     QList<Entry*> entries;
     do {
         for (Database* db : databases) {
-            entries << searchEntries(db, hostname);
+            entries << searchEntries(db, hostname, url);
         }
     } while (entries.isEmpty() && removeFirstDomain(hostname));
 

diff --git a/src/browser/BrowserService.h b/src/browser/BrowserService.h
@@ -42,8 +42,8 @@ class BrowserService : public QObject
     Entry*          getConfigEntry(bool create = false);
     QString         getKey(const QString& id);
     void            addEntry(const QString& id, const QString& login, const QString& password, const QString& url, const QString& submitUrl, const QString& realm);
-    QList<Entry*>   searchEntries(Database* db, const QString& hostname);
-    QList<Entry*>   searchEntries(const QString& text, const StringPairList& keyList);
+    QList<Entry*>   searchEntries(Database* db, const QString& hostname, const QString& url);
+    QList<Entry*>   searchEntries(const QString& url, const StringPairList& keyList);
     void            removeSharedEncryptionKeys();
     void            removeStoredPermissions();