--- Begin Message ---
|
Subject: |
27.0.50; Password is not hidden in read-passwd |
|
Date: |
Sat, 20 Jan 2018 23:29:35 +0200 |
|
User-agent: |
Gnus/5.13 (Gnus v5.13) Emacs/27.0.50 (x86_64-pc-linux-gnu) |
This is a regression and a security flaw.
Reading a password with ‘read-passwd’ doesn't hide inserted characters
anymore as it used to do in older versions.
When the user has such customization:
(custom-set-variables
'(yank-excluded-properties t))
evaluating
(read-passwd "Prompt: ")
and yanking a password to the minibuffer with 'C-y' doesn't hide it
as it did in Emacs 25.
This can be traced down to ‘remove-yank-excluded-properties’
where ‘set-text-properties’ used to leave ‘display’ properties
(with ‘.’ over inserted characters) in the minibuffer.
--- End Message ---
--- Begin Message ---
|
Subject: |
Re: bug#30186: 27.0.50; Password is not hidden in read-passwd |
|
Date: |
Sat, 27 Jan 2018 22:10:06 +0000 |
|
User-agent: |
Mutt/1.7.2 (2016-11-26) |
Hello, Eli and Juri.
On Sat, Jan 27, 2018 at 23:43:34 +0200, Juri Linkov wrote:
> >> So let's do that now. I think the problem with read-passwd is a
> >> security issue, so it should go to emacs-26, do you agree?
> > Yes, i think it should go into emacs-26.
> > Juri, do you see any problem with just removing that
> > with-silent-modifications altogether? I.e. this:
> I agree that removing with-silent-modifications would be
> the best fix. Thanks for taking care of this.
Thanks. I've made this change and committed it to the emacs-26 branch.
I'm closing the bug with this post.
--
Alan Mackenzie (Nuremberg, Germany).
--- End Message ---