Skip to content

Drafts not cleared on signout #5163

@kontaxis

Description

@kontaxis

Describe the bug

Drafts are stored in the web browser's local storage. However, they are not cleared when the user signs out. As a result, an unauthenticated user, different from the note's author, with access to the browser but without knowledge of the author's password, may access them. The note's visibility is irrelevant.

This is contrary to user expectations given the concept of access control in Memos.

Steps to reproduce

  1. Start typing a new note but do not click Save.
  2. Click on the profile icon at the bottom left of the screen, select Sign out.
  3. Observe that the browser's local storage contains the note draft from step 1. (See screenshot)

Expected results:
After step 2 there are no drafts saved in local storage.

Actual results:
Drafts persist after signout, allowing anyone with access to the web browser but without knowledge of the author's password to view them.

The version of Memos you're using

v0.25.1

Screenshots or additional context

Image

Changes in #3005 did not address the root cause of these issues which is drafts surviving after the user has signed out. When the user signs out localStorage.clear() should be invoked.

Note that, since a user can edit multiple notes simultaneously, more than one drafts of existing notes can also be found in local storage at any given time. Clearing the local storage in its entirety is probably the safest option.

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions