Password typed to unlock the screen is sent to the Chrome window if it had a text selection

[James Hunt]

When my machine comes out of suspend, I am shown the unity lockscreen. However, occasionally I am unable to enter my password since the password box is not given focus. Clicking with the mouse in the password box also doesn't help.

I've found that clicking the settings cog (top right) twice allows me to regain control of the focus and enter my password.

Aside from the inability to enter my password in the password box, it seems that simply typing my password (or in fact any text) results in those keystrokes being passed to the full-screen window *behind* the greeter. This should not be possible and is a security issue: imagine if my full-screen console was connected to a remote shared session, or was running an irc client, etc.).

ProblemType: BugDistroRelease: Ubuntu 14.10
Package: lightdm 1.11.4-0ubuntu1
ProcVersionSignature: Ubuntu 3.16.0-4.9-generic 3.16.0-rc5
Uname: Linux 3.16.0-4-generic x86_64
ApportVersion: 2.14.4-0ubuntu2
Architecture: amd64
CurrentDesktop: Unity
Date: Sun Jul 20 09:08:47 2014
InstallationDate: Installed on 2014-04-11 (99 days ago)
InstallationMedia: Ubuntu 14.04 LTS "Trusty Tahr" - Daily amd64 (20140409)SourcePackage: lightdm
UpgradeStatus: Upgraded to utopic on 2014-05-08 (72 days ago)

[Robert Ancell (robert-ancell)]

It's actually unity showing a lock screen here, reassigning.

[James Hunt (jamesodhunt)]

I've found a way to trigger this without needing to suspend (which hopefully will make it easier to debug :-)...

1) Open a terminal.
2) Run: "sleep 5 && gnome-terminal --maximize"
3) Quickly (before 5 seconds has elapsed), press "CTRL+l" to lock the screen.
4) Don't touch keyboard or mouse for about 10 seconds to give the lock screen time to dim the screen to black.
5) *Before* the cursor disappears (normally happens about 2 seconds after the screen is fully black), tpe random characters or hold down a key continually until the lock screen is displayed again.
6) Either delete the characters in the password box and reenter you actual password, or press return and enter you actual password.
7) Observe that the maximised gnome-terminal that is now revealed shows atleast a subset of the keys you typed when the screen was locked.

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[David Overcash (funnylookinhat)]

This seems to happen most frequently with Google Chrome and Chromium - or at least, they're two easy culprits to identify. :)

Seems related to the following:
https://bugs.launchpad.net/unity/+bug/1305586

I'm not sure if the fix in that bug is what caused this or if another issue arose elsewhere.

[Margarita Manterola (marga-9)]

I'm affected as well, and I've been only able to reproduce with Chrome 35 or later. I tried several other applications and was not able to reproduce. Including Firefox, gnome-terminal and Chrome 34.

Also, it only happens on Unity, other desktop environments are not affected.

I tried 3 different versions of compiz (the latest one, the one before that and the original from trusty) and I could reproduce with all of them, although the behavior is not exactly the same.

The reproduction case that I found most successful is locking the screen with Ctrl-Alt-L while having some text selected on the Chrome window, for example the location bar. So:
1) Open Chrome 35 or later (current stable is 36)
2) Ctrl-L to select the location bar
3) Ctrl-Alt-L to lock the screen

After that, any characters I type while the lockscreen is dimming are sent through to Chrome.

[Margarita Manterola (marga-9)]

I downgraded unity's packages to the previous version (7.2.1+14.04.20140513-0ubuntu2) and with that version I'm no longer able to reproduce the problem.

The changelog of the current version (7.2.2+14.04.20140714-0ubuntu1) includes lots of screensaver changes, including changes related to the clipboard.

Clearly, some of those changes don't interact well, at least with Chrome 35 and above, I haven't been able to reproduce with any other programs.