bug#1104: pasting a password

bug#1104: pasting a password

[Chong Yidong]

> DW> Login Name: myname
>
> DW> Login Password: {SHA}reallylongsodontaskmetotypeitinbyhandplease
>
> DW> Login URL: http://wiki.debian.org/UserPreferences
>
> The problem is C-y is just read as a raw character there at the
> mini buffer Password: prompt. emacs-w3m-version "1.4.263".
>
> KY> That's what `read-passwd' that is an Emacs function does.  In
> KY> the function definition, the special keys that it handles are
> KY> only C-h, C-u and C-? (see the doc string).

The following patch allows yanking into the password prompt (I haven't
changed the docstring of read-passwd, which needs doing).  What do
people think about the advisability of this?

Note, in particular, that we can detect any key that performs yank or
yank-pop by using `key-binding'---but it works only if the command is a
single-character key sequence.  That's fine for C-y, but fails if the
user has customized `yank' to a two-character sequence.  I don't see any
way around this, though.

Another shortcoming is that the user can no longer enter a literal C-y;
but this may be a negligble problem---currently, the user can't enter
C-u either, since C-u clears the field.


*** trunk/lisp/subr.el.~1.620.~	2008-11-06 01:49:41.000000000 -0500
--- trunk/lisp/subr.el	2008-11-16 00:48:31.000000000 -0500
***************
*** 1818,1838 ****
  		      (setq c (read-char-exclusive nil t))
  		      (and (/= c ?\r) (/= c ?\n) (/= c ?\e)))
  	  (clear-this-command-keys)
! 	  (if (= c ?\C-u)
! 	      (progn
! 		(and (arrayp pass) (clear-string pass))
! 		(setq pass ""))
! 	    (if (and (/= c ?\b) (/= c ?\177))
! 		(let* ((new-char (char-to-string c))
! 		       (new-pass (concat pass new-char)))
! 		  (and (arrayp pass) (clear-string pass))
! 		  (clear-string new-char)
! 		  (setq c ?\0)
! 		  (setq pass new-pass))
! 	      (if (> (length pass) 0)
! 		  (let ((new-pass (substring pass 0 -1)))
! 		    (and (arrayp pass) (clear-string pass))
! 		    (setq pass new-pass))))))
  	(message nil)
  	(or pass default "")))))
  
--- 1818,1845 ----
  		      (setq c (read-char-exclusive nil t))
  		      (and (/= c ?\r) (/= c ?\n) (/= c ?\e)))
  	  (clear-this-command-keys)
! 	  (cond ((= c ?\C-u)
! 		 (and (arrayp pass) (clear-string pass))
! 		 (setq pass ""))
! 		((memq (key-binding (vector c))
! 		       '(yank yank-pop))
! 		 (let ((new-pass (concat pass
! 					 (substring-no-properties
! 					  (current-kill 0)))))
! 		   (and (arrayp pass) (clear-string pass))
! 		   (setq c ?\0)
! 		   (setq pass new-pass)))
! 		((and (/= c ?\b) (/= c ?\177))
! 		 (let* ((new-char (char-to-string c))
! 			(new-pass (concat pass new-char)))
! 		   (and (arrayp pass) (clear-string pass))
! 		   (clear-string new-char)
! 		   (setq c ?\0)
! 		   (setq pass new-pass)))
! 		((> (length pass) 0)
! 		 (let ((new-pass (substring pass 0 -1)))
! 		   (and (arrayp pass) (clear-string pass))
! 		   (setq pass new-pass)))))
  	(message nil)
  	(or pass default "")))))
  

Diff finished.  Sun Nov 16 00:51:53 2008

bug#1104: pasting a password

[Andreas Schwab]

Chong Yidong <cyd@stupidchicken.com> writes:

> --- 1818,1845 ----
>   		      (setq c (read-char-exclusive nil t))
>   		      (and (/= c ?\r) (/= c ?\n) (/= c ?\e)))
>   	  (clear-this-command-keys)
> ! 	  (cond ((= c ?\C-u)
> ! 		 (and (arrayp pass) (clear-string pass))
> ! 		 (setq pass ""))
> ! 		((memq (key-binding (vector c))
> ! 		       '(yank yank-pop))

That does not work for yank-pop since the default binding is not a
single character one.

Andreas.

-- 
Andreas Schwab, SuSE Labs, schwab@suse.de
SuSE Linux Products GmbH, Maxfeldstraße 5, 90409 Nürnberg, Germany
PGP key fingerprint = 58CA 54C7 6D53 942B 1756  01D3 44D5 214B 8276 4ED5
"And now for something completely different."

bug#1104: pasting a password

[Chong Yidong]

Andreas Schwab <schwab@suse.de> writes:

> That does not work for yank-pop since the default binding is not a
> single character one.

Yeah.  Maybe we should just hardwire C-y to yank into the password
prompt, and leave it at that.

bug#1104: pasting a password

[Stefan Monnier]

> That does not work for yank-pop since the default binding is not a
> single character one.

It's bound to a single-event sequence, namely M-y.  Now, it's true that
in several circumstances, M-y will be turned into ESC y, so it will only
work in some cases and not all (typically it'll work in a GUI but not
in a tty).
I think to do it better, we'll need to use an implementation technique
closer to the one used by isearch.


        Stefan

bug#1104: pasting a password

[jidanni]

Regarding those mile long one-time passwords that we are supposed to
paste into our browsers, etc.:

Some people also wish to paste the password into the box with the
mouse too (middle button). Therefore please roll back all that extra
security, and just do the plain echo asterisks, like firefox or
whatever.

Speaking about M-y. I am a old dog who still types ESC instead of
Meta-key for the M- stuff -- never learned new tricks.