notifications visible through the screensaver

Bug #339902 reported by Andrea Bravetti
266
This bug affects 2 people
Affects Status Importance Assigned to Milestone
KDE Base
Fix Released
Medium
kde4libs (Ubuntu)
Fix Released
Undecided
Aurélien Gâteau
Jaunty
Fix Released
Undecided
Aurélien Gâteau
kdeartwork (Ubuntu)
Invalid
Undecided
Unassigned
Jaunty
Invalid
Undecided
Unassigned
kdebase (Ubuntu)
Invalid
Undecided
Unassigned
Jaunty
Invalid
Undecided
Unassigned
kdebase-workspace (Ubuntu)
Invalid
High
Unassigned
Jaunty
Invalid
High
Unassigned
notify-osd (Ubuntu)
Invalid
High
Mirco Müller
Jaunty
Invalid
High
Mirco Müller

Bug Description

Binary package hint: kscreensaver

I'm in Kubuntu Jaunty Alpha 5 fully updated at 09 March 2009.

I'm using a simple screensaver, "Blank Screen", to lock my pc when away.

When the screensaver is active sometime I see a notification through the screensaver, for example I can see incoming message in Kopete, and this is a serius bug since anyone can see private informations when I'm away and this should be treated as a security issue.

I don't know if it is a bug in kscreensaver or, may be, in kdm...

It happen with or without Desktop Effects.

It happen on more than one computer.

I don't know how to make a screenshot in screensaver, but I can take a foto...

Revision history for this message
In , Gregor Petrin (gregap) wrote :

Version: KDE: 4.1.87 (KDE 4.1.87 (KDE 4.2 >= 20090101)) "release 3.1", Plasma Workspace: 0.3 (using Devel)
OS: Linux
Installed from: Compiled sources

When the screen is locked & black, notifications still show through. The screen was locked using the Lock/Logout plasmoid. Two examples: kmail and kopete. With kmail it is not so problematic, as it just shows the number (and directories) of new mails received. But with kopete, the received message text is displayed; what is worse, it does not seem to ever go away.. so if you leave your computer locked and go somewhere, other people can very easily read your incoming kopete messages.

I am filing this bug as a plasma bug because maybe the best idea would be to disable notifications showing altogether while the screen is locked, as a lot of notifications may contain private text? Or just specifying that there are one or more notifications waiting, but actually displaying them when the user unlocks the screen?

Revision history for this message
In , aseigo (aseigo) wrote :

this is a bigger issue than just the notifications ... NOTHING should be allowed above the screen saver. hmmm... will talk with the kwin folk about this one.

Revision history for this message
In , Chanika (chanika) wrote :

I wonder if this is related to some composite drawing issues with widgets-on-screensaver...
anyawys, the notifications-showing problem was in kde3 too - it seems like sometimes the lockprocess restacking code works and they go away fast (or at least go grey), but often something goes wrong and the screensaver binary itself appears to be drawing over the notification - as if the thing painted itself into the window the screensaver paints on. not sure what's really going on there but it makes for some odd effects.

Revision history for this message
In , Gregor Petrin (gregap) wrote :

I tested this bug some more, it is possible that this part of my original bug report is wrong: "what is worse, [the notification] does not seem to ever go away". I tried it with two computers today and the notification does go away after a few seconds, also after the first kopete message, the following ones did not appear anymore.

I'm not sure what happened yesterday that the kopete notification was not removed after those few seconds (I came back to work and it was there on my locked screen, after unlocking the computer the kopete timestamp indicated the message was sent 2 hours ago).

Revision history for this message
In , Stormlabs (stormlabs) wrote :

Confirming this issue. OpenSuSE KDE 4.1.96.
Notifications are drawn over screensaver and then when they disappear, a seethrough region is left there where the notification was until the screensaver redraws.

Gfx card: Mobility Radeon 9700 and driver radeon opensource.

Revision history for this message
In , Dario Andres (andresbajotierra) wrote :

*** Bug 183600 has been marked as a duplicate of this bug. ***

Revision history for this message
In , Valerio Pilo (valerio-pilo) wrote :

(In reply to comment #4)
> Notifications are drawn over screensaver and then when they disappear, a
> seethrough region is left there where the notification was until the
> screensaver redraws.
> Gfx card: Mobility Radeon 9700 and driver radeon opensource.

I have the same issue, under KDE 4.2.65 and both Qt 4.4.3 and 4.5. My gfx driver is the intel one, with compositing off (and I remember kde exposing the bug with compositing on, too).

description: updated
description: updated
Revision history for this message
Andrea Bravetti (andreabravetti) wrote :

I changed the bug report to be non private because even if it will be treated as a security issue it is nothing that can be used remotely to cause damage, so hiding it is unuseful.

Revision history for this message
Kees Cook (kees) wrote :

I cannot reproduce this. What notifications are you seeing? If you can, a photo could be helpful. :)

Changed in notify-osd:
status: New → Incomplete
Revision history for this message
Andrea Bravetti (andreabravetti) wrote :

Every type of notification...

Kopete incoming messages, file transfer status, battery status, and so on...

Attached a foto (very bad foto, excuse me and my e51...) that show
what happen when the screen is locked (it is asking for the passsword)
and I remove the power adapter.

Revision history for this message
Andrea Bravetti (andreabravetti) wrote :

This time the notification area appear completely white!

Some time I can see the message, some time not, but
the real problem is: how can an app go through the screensaver?

Isn't it wrong?

Does my hardware conf help?

00:02.0 VGA compatible controller: Intel Corporation Mobile 945GM/GMS, 943/940GML Express Integrated Graphics Controller (rev 03)
00:02.1 Display controller: Intel Corporation Mobile 945GM/GMS/GME, 943/940GML Express Integrated Graphics Controller (rev 03)

My X conf (from X --configure with little customization):

Section "Module"
        Load "glx"
        Load "extmod"
        Load "dri"
        Load "record"
        Load "dbe"
        Load "dri2"
EndSection
Section "Device"
        Option "DRI"
        Option "NoDDC"
        Identifier "Card0"
        Driver "intel"
        VendorName "Intel Corporation"
        BoardName "Mobile 945GM/GMS, 943/940GML Express Integrated Graphics Controller"
        BusID "PCI:0:2:0"
EndSection

With my poor knowhow I can say it may be caused by one or more of:

kscreensaver
kdm
xserver-xorg
xserver-xorg-video-intel

This is a clean Kubuntu 9.04 alpha 5 install on a new hard drive, and not an upgrade of a previus release.

My system is now fully updated at 10 March 2009.

Kees Cook (kees)
Changed in notify-osd:
importance: Undecided → Medium
status: Incomplete → Confirmed
importance: Medium → High
milestone: none → ubuntu-9.04-beta
Revision history for this message
Mirco Müller (macslow) wrote :

The screenshots very clearly show that the notification in the lower right corner are not rendered by notify-osd. They look like knotify notifications. This bug is therefore invalid. Please file it against the correct package, which would be knotify4 or knotification. Since I'm not a KDE-user I don't know the exact package names by heart. It could also be part of kdebase.

Changed in notify-osd:
assignee: nobody → macslow
status: Confirmed → Invalid
Changed in kdeartwork:
status: New → Invalid
Changed in kdebase:
status: New → Invalid
Changed in kdebase-workspace:
importance: Undecided → High
status: New → Confirmed
Changed in kdebase-workspace:
status: Confirmed → Triaged
Changed in kdebase:
status: Unknown → New
Revision history for this message
In , T-artem (t-artem) wrote :

The same applies to RSIBreak application.

Revision history for this message
In , T-artem (t-artem) wrote :

Aaron, it's a security sensitive bug, BTW.

It should be resolved ASAP.

Revision history for this message
Steve Langasek (vorlon) wrote :

Assigning to agateau, per Riddell.

Changed in kdebase-workspace:
assignee: nobody → agateau
Revision history for this message
In , Jonathan Riddell (jr) wrote :

*** Bug 159959 has been marked as a duplicate of this bug. ***

Revision history for this message
Aurélien Gâteau (agateau) wrote :

Taking inspiration from KPassivePopup code, attached patch should fix the problem.

Revision history for this message
In , Aurélien Gâteau (agateau) wrote :

Taking inspiration from KPassivePopup code, attached patch should fix the problem.

Note: patch was written for KDE 4.2.1, but seems to apply fine (with an offset) on current trunk.

Revision history for this message
In , Aurélien Gâteau (agateau) wrote :

Created attachment 32410
Proposed fix

Revision history for this message
In , aseigo (aseigo) wrote :

@Aurelien: looks fine. please commit.

btw, note that with the volume of bug reports we get, it's sometimes (often) faster and more certain to send the patch to plasma-devel@ or post it on reviewboard.kde.org :)

Revision history for this message
In , T-artem (t-artem) wrote :

Has anyone tried to run Skype for Linux after applying this patch? Skype shows its own notification windows and they also appeared above the screen saver window.

As far as I understand the commit changes the way native KDE notifications are shown and not all other possible scenarios.

So, I might be wrong or this bug is not yet resolved.

Revision history for this message
Kieran Hogg (xerosis) wrote :

I also get this when watching a full-screen dragon, will the patch solve this problem too?

Revision history for this message
Jonathan Thomas (echidnaman) wrote :

The bug was actually in kde4libs, and Aurelien got a fix uploaded the other day.

Changed in kde4libs (Ubuntu Jaunty):
assignee: nobody → agateau
status: New → Fix Released
Changed in kdebase-workspace (Ubuntu Jaunty):
assignee: agateau → nobody
status: Triaged → Invalid
Revision history for this message
In , Aurélien Gâteau (agateau) wrote :

@Aaron: ok, about to commit. Will use reviewboard next time :)

@Artem: did you check if Skype popup also appears above xlock screen? If so, then it's up to Skype to fix their code (I would gladly do it, but they won't give me the source code :) )

Revision history for this message
In , Aurélien Gâteau (agateau) wrote :

SVN commit 946749 by gateau:

Use Qt::Tool window flags for popups to avoid having them shown over screensaver.

BUG:179924

I do not have a working copy of kdelibs 4.2 at the moment. Can someone backport
the fix?

 M +5 -2 popupapplet.cpp

WebSVN link: http://websvn.kde.org/?view=rev&revision=946749

Revision history for this message
In , Aurélien Gâteau (agateau) wrote :

SVN commit 946770 by gateau:

Use Qt::Tool window flags for popups to avoid having them shown over screensaver.

CCBUG:179924

 M +5 -2 popupapplet.cpp

WebSVN link: http://websvn.kde.org/?view=rev&revision=946770

Changed in kdebase:
status: New → Fix Released
Revision history for this message
In , aseigo (aseigo) wrote :

SVN commit 951366 by aseigo:

revert commit#946749 as it causes way too many side effects including: widgets not getting focus (kickoff no longer puts focus on the line edit), popups not going away when clicking elsewhere ...
will need another fix for BR#179924
CCMAIL:<email address hidden>
CCBUG:179924

 M +1 -2 popupapplet.cpp

WebSVN link: http://websvn.kde.org/?view=rev&revision=951366

Revision history for this message
In , Jonathan Riddell (jr) wrote :
Changed in kdebase:
status: Fix Released → Confirmed
Revision history for this message
In , Oswald Buddenhagen (ossi-kde) wrote :

hmpf - works for me:
  while :; do kdialog --passivepopup "This is a test" 5; sleep 10; done
then lock the screen.
intel gfx, no compositing (unlikely that it matters).

it's logical that the notification stays on the screen once it gets on top of the screen saver - for performance, many savers redraw only the actually changed contents. and as they don't expect strange things to happen, they don't react to regional repaint requests, either.

somebody who can reproduce the problem please paste the messages from krunner_lock (4.1) / kscreenlocker (4.2) found at/near the end of ~/.xsession-errors (provided kdm is used, otherwise you have to figure out yourself) after unlocking the screen.

Revision history for this message
In , Oswald Buddenhagen (ossi-kde) wrote :

*** Bug 188408 has been marked as a duplicate of this bug. ***

Revision history for this message
In , Aurélien Gâteau (agateau) wrote :

SVN commit 955241 by gateau:

Do not let plasma popup appear over screensaver.

BUG: 179924

 M +13 -17 popupapplet.cpp
 M +1 -0 private/popupapplet_p.h

WebSVN link: http://websvn.kde.org/?view=rev&revision=955241

Revision history for this message
In , Mgraesslin (mgraesslin) wrote :

Sorry, but that's not really fixed. Given the duplicate bug #188408 for example. It's fixed for Plasma popups, now, but the root cause is still not fixed.

Revision history for this message
In , T-artem (t-artem) wrote :

I still believe that patching Plasma is not the right way to go, since this bug may appear hear and there for new Linux applications not written "properly" and given that possibility I'm still sure it's a kwin/screensaver bug (btw, no such issue existed in KDE 3.5.x - what has changed since that time?)

Revision history for this message
In , Dario Andres (andresbajotierra) wrote :

*** Bug 189987 has been marked as a duplicate of this bug. ***

Revision history for this message
In , Aurélien Gâteau (agateau) wrote :

SVN commit 956998 by gateau:

Do not let plasma popup appear over screensaver.

BUG: 179924

CCMAIL:<email address hidden>

 M +13 -17 popupapplet.cpp
 M +1 -0 private/popupapplet_p.h

WebSVN link: http://websvn.kde.org/?view=rev&revision=956998

Revision history for this message
In , Mgraesslin (mgraesslin) wrote :

please use CCBUG in such cases - we do not have to manually reopen the bug again and again ;-)

Revision history for this message
In , Dario Andres (andresbajotierra) wrote :

*** Bug 180651 has been marked as a duplicate of this bug. ***

Revision history for this message
In , L-lunak-5 (l-lunak-5) wrote :

SVN commit 961161 by lunakl:

Simplify the restacking code.
CCBUG: 179924

 M +18 -31 lockprocess.cc

WebSVN link: http://websvn.kde.org/?view=rev&revision=961161

Revision history for this message
In , L-lunak-5 (l-lunak-5) wrote :

SVN commit 961177 by lunakl:

// We actually have to check the current stacking order. When an override-redirect
// window is shown or raised, it can get above the screensaver window and there's not
// much to do to prevent it (only the compositing manager can prevent that). This
// is detected by the screenlocker and handled here, but the contents of the window
// may remain visible, since some screensavers don't react to Expose events and
// don't repaint as necessary. Therefore, if a window is detected above any of the windows
// related to screenlocking, I don't see any better possibility than to completely
// erase the screenlocker window.
BUG: 179924

 M +40 -2 lockprocess.cc

WebSVN link: http://websvn.kde.org/?view=rev&revision=961177

Revision history for this message
In , L-lunak-5 (l-lunak-5) wrote :

Nevermind.

Revision history for this message
In , Dario Andres (andresbajotierra) wrote :

Is the case stated in bug 191278 related to this too ? Thanks

Revision history for this message
In , Allo (allo) wrote :

This is in KDE 4.3 still an issue. Worse, when the notification is hidden, a short time the screen-content under the notification is visible before the screen turns black again.

Revision history for this message
In , T-artem (t-artem) wrote :

In KDE 4.3.1 this issue persists.

I firmly believe that fixing just KDE applications will NOT fix this issue, since I have other applications which show their notifications above screensaver (e.g. audacious xosd).

So, it seems like a KWin bug for me.

Oops, I'm repeating myself :)

Revision history for this message
In , Rolf Eike Beer (kde-opensource) wrote :

Still there in 4.4RC1

-Intel 945
-openSuSE 11.2 x86

Revision history for this message
In , T-artem (t-artem) wrote :

Obviously, because no one on the kscreensaver team can fix this problem - this bug's "Product" is set incorrectly.

Revision history for this message
In , Allo (allo) wrote :

It got even worse: if you shake your mouse after the screensaver is activated, you see the plamoids of the blank screensaver but no black background but the windows below. If you click cancel on the passwort-prompt, the background gets black, as it should.

Revision history for this message
In , Wln2qp5ozl9x-gzvg-xrvasaslqcgv (wln2qp5ozl9x-gzvg-xrvasaslqcgv) wrote :

Another data point for you perhaps:
When watching a video in mplayer at fullscreen, the notifications still come up on top of the video.

This is with desktop effects disabled.
KDE 4.3.4
QT 4.5.3
xorg-server 1.6.3.901-r2

Revision history for this message
In , L-lunak-5 (l-lunak-5) wrote :

SVN commit 1137311 by lunakl:

Try harder not to have any race conditions in the code that tries
to prevent windows showing up above the screensaver window.
I'm however getting rather confident that plasma notifications
showing above screensaver is actually an X bug.
CCBUG: 179924

 M +113 -19 lockprocess.cc
 M +7 -0 lockprocess.h

WebSVN link: http://websvn.kde.org/?view=rev&revision=1137311

Revision history for this message
In , Mgraesslin (mgraesslin) wrote :

*** Bug 244912 has been marked as a duplicate of this bug. ***

Changed in kdebase:
importance: Unknown → Medium
Revision history for this message
In , Benoit-gouhier (benoit-gouhier) wrote :

*** Bug 248667 has been marked as a duplicate of this bug. ***

Revision history for this message
In , Mgraesslin (mgraesslin) wrote :

The last remaining issue in this bug has probably been in the compositor: the notification got stacked *behind* the lock window (not visible) but when the notification closed the window (fade out/slide out) animation stacked the notification above the lock window (visible).

With 4.9 we fixed bug #158262 which means the notification is no longer stacked above the lock window so I am quite confident that finally this very annoying bug has been fixed.

For the record:
Git commit 431aad6d6994695e72697fcc3299ec2cb6f0684e by Martin Gräßlin.
Committed on 09/04/2012 at 11:06.
Pushed by graesslin into branch 'master'.

Keep position in stacking order for deleted windows

Workspace::addDeleted swaps the Client with the Deleted in the stacking order. For Unmanaged windows the Deleted is appended to the stacking order which is the same layer.

When the deleted is closed the window is removed from the stacking order.

The result is that a deleted window is no longer raised above all other clients.

REVIEW: 104519
FIXED-IN: 4.9.0

M +1 -1 kwin/deleted.cpp
M +0 -3 kwin/layers.cpp
M +15 -3 kwin/workspace.cpp
M +1 -1 kwin/workspace.h

http://commits.kde.org/kde-workspace/431aad6d6994695e72697fcc3299ec2cb6f0684e

Changed in kde-baseapps:
status: Confirmed → Fix Released
To post a comment you must log in.
This report contains Public Security information  
Everyone can see this security related information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.