Create another profile and hide it

Oct 13, 2025 by leolavanderia.com.br 105 views

Introduction

As a user of the application on Linux, specifically on Endeavour OS with version 6.3, I have encountered a critical issue that affects the security and privacy of my profiles. When I attempt to disable the default SMP and XFTP servers to use custom servers, I receive an error message that discloses the existence of hidden profiles. This behavior is unexpected and poses a security risk, as it reveals sensitive information about my profiles to unauthorized individuals.

Is There an Existing Issue for This?

After conducting a thorough search of existing issues, I was unable to find a similar problem reported. This suggests that this issue may be unique and requires attention from the development team.

Platform and OS Version

Platform: Linux
OS Version: Endeavour OS
App Version: 6.3

Current Behavior

When I have multiple profiles, including hidden ones, and attempt to disable the default SMP and XFTP servers, I receive an error message that discloses the existence of hidden profiles. The error message is as follows:

"Profile XXX has no server to send messages"

This message is not only incorrect but also reveals sensitive information about my profiles, including the number and names of hidden profiles.

Expected Behavior

The expected behavior is that no error message should be raised until I log in with my hidden profile. This would ensure that my profiles remain secure and private, and that sensitive information is not disclosed to unauthorized individuals.

Steps to Reproduce

To reproduce this issue, follow these steps:

Create a profile: Create a new profile using the application.
Create another profile and hide it: Create another profile and hide it using the application's settings.
Go back to main profile: Switch back to the main profile.
Add custom servers: Add custom servers to the main profile.
Remove default servers: Remove the default SMP and XFTP servers.
Disclosure message appears: The error message "Profile XXX has no server to send messages" should appear, disclosing the existence of hidden profiles.

Relevant Log Output

# No relevant log output is available at this time.

Conclusion

The hidden profiles disclosure issue is a critical problem that affects the security and privacy of my profiles. The error message that appears when attempting to disable default servers reveals sensitive information about my profiles, including the number and names of hidden profiles. To resolve this issue, the development team should ensure that no error message is raised until I log in with my hidden profile. This would prevent sensitive information from being disclosed to unauthorized individuals and ensure that my profiles remain secure and private.

Recommendations

To resolve this issue, I recommend the following:

Modify the error message: Change the error message to a more generic message that does not disclose sensitive information about hidden profiles.
Implement profile security checks: Add security checks to ensure that hidden profiles are not disclosed until the user logs in with that profile.
Provide a secure way to manage profiles: Provide a secure way for users to manage their profiles, including the ability to hide and unhide profiles without disclosing sensitive information.

Introduction

In our previous article, we discussed the critical issue of hidden profiles disclosure in the application on Linux, specifically on Endeavour OS with version 6.3. This issue affects the security and privacy of user profiles, and we have outlined the current behavior, expected behavior, and steps to reproduce the issue. In this article, we will provide a Q&A section to address common questions and concerns related to this issue.

Q: What is the current behavior of the application when I try to disable default servers?

A: When you try to disable default servers, the application displays an error message that discloses the existence of hidden profiles. The error message is as follows:

"Profile XXX has no server to send messages"

This message is not only incorrect but also reveals sensitive information about your profiles, including the number and names of hidden profiles.

Q: Why is this issue a security risk?

A: This issue is a security risk because it discloses sensitive information about your profiles to unauthorized individuals. By revealing the existence of hidden profiles, an attacker can gain access to sensitive information and potentially compromise your account.

Q: What is the expected behavior of the application when I try to disable default servers?

A: The expected behavior is that no error message should be raised until you log in with your hidden profile. This would ensure that your profiles remain secure and private, and that sensitive information is not disclosed to unauthorized individuals.

Q: How can I reproduce this issue?

A: To reproduce this issue, follow these steps:

Create a profile: Create a new profile using the application.
Create another profile and hide it: Create another profile and hide it using the application's settings.
Go back to main profile: Switch back to the main profile.
Add custom servers: Add custom servers to the main profile.
Remove default servers: Remove the default SMP and XFTP servers.
Disclosure message appears: The error message "Profile XXX has no server to send messages" should appear, disclosing the existence of hidden profiles.

Q: What are the recommended solutions to this issue?

A: To resolve this issue, we recommend the following:

Modify the error message: Change the error message to a more generic message that does not disclose sensitive information about hidden profiles.
Implement profile security checks: Add security checks to ensure that hidden profiles are not disclosed until the user logs in with that profile.
Provide a secure way to manage profiles: Provide a secure way for users to manage their profiles, including the ability to hide and unhide profiles without disclosing sensitive information.

Q: How can I report this issue to the development team?

A: If you have encountered this issue, we encourage you to report it to the development team using the application's bug reporting feature or by contacting their support team directly.

Q: Will this issue be fixed in the next update?

A: We cannot guarantee that this issue will be fixed in the next update, but we will work with the development team to ensure that it is addressed as soon as possible. In the meantime, we recommend that users take precautions to protect their profiles and sensitive information.

Conclusion

The hidden profiles disclosure issue is a critical problem that affects the security and privacy of user profiles. We hope that this Q&A article has provided valuable information and insights into this issue. If you have any further questions or concerns, please do not hesitate to contact us.