|
0
|
1 ;;; passwd.el --- Prompting for passwords semi-securely
|
|
|
2
|
|
|
3 ;; Copyright (C) 1994 Free Software Foundation, Inc.
|
|
|
4 ;; Keywords: comm, extensions
|
|
|
5
|
|
|
6 ;; Author: Jamie Zawinski <jwz@netscape.com>
|
|
|
7
|
|
|
8 ;; This file is part of XEmacs.
|
|
|
9
|
|
|
10 ;; XEmacs is free software; you can redistribute it and/or modify it
|
|
|
11 ;; under the terms of the GNU General Public License as published by
|
|
|
12 ;; the Free Software Foundation; either version 2, or (at your option)
|
|
|
13 ;; any later version.
|
|
|
14
|
|
|
15 ;; XEmacs is distributed in the hope that it will be useful, but
|
|
|
16 ;; WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
|
17 ;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
|
|
18 ;; General Public License for more details.
|
|
|
19
|
|
|
20 ;; You should have received a copy of the GNU General Public License
|
|
24
|
21 ;; along with XEmacs; see the file COPYING. If not, write to the Free
|
|
|
22 ;; Software Foundation, 675 Mass Ave, Cambridge, MA 02139, USA.
|
|
0
|
23
|
|
|
24 ;;; Change Log:
|
|
|
25 ;;
|
|
|
26 ;; Sun Jun 12 04:19:30 1994 by sandy on ibm550.sissa.it
|
|
|
27 ;; Added support for password histories and (provide 'passwd)
|
|
|
28 ;; (jwz says: this "history" thing is completely undocumented, you loser!)
|
|
|
29 ;; 2-Jan-95 (mon); 4:13 AM by jwz@netscape.com
|
|
|
30 ;; Fixed Sandy's extreme keymap bogosity. Made it invert the screen when
|
|
|
31 ;; reading securely (this could be better; maybe use red text or something
|
|
|
32 ;; instead...)
|
|
|
33 ;; 9-Jul-95 (fri); 4:55 AM by jwz@netscape.com
|
|
|
34 ;; Made it work with XEmacs 19.12.
|
|
|
35 ;; 7-Jul-95 by cthomp@cs.uiuc.edu
|
|
|
36 ;; Added variable to control inverting frame when keyboard grabbed
|
|
|
37
|
|
|
38 ;;; Code:
|
|
|
39
|
|
|
40 (defvar passwd-invert-frame-when-keyboard-grabbed t
|
|
|
41 "*If non-nil swap the foreground and background colors of all faces.
|
|
|
42 This is done while the keyboard is grabbed in order to give a visual
|
|
|
43 clue that a grab is in effect.")
|
|
|
44
|
|
|
45 (defvar passwd-echo ?.
|
|
|
46 "*The character which should be echoed when typing a password,
|
|
|
47 or nil, meaning echo nothing.")
|
|
|
48
|
|
|
49 (defvar read-passwd-map
|
|
|
50 (let ((i 0)
|
|
|
51 (s (make-string 1 0))
|
|
|
52 map)
|
|
|
53 (cond ((fboundp 'set-keymap-parent)
|
|
|
54 (setq map (make-keymap))
|
|
|
55 (set-keymap-parent map minibuffer-local-map))
|
|
|
56 (t ; v18/FSFmacs compatibility
|
|
|
57 (setq map (copy-keymap minibuffer-local-map))))
|
|
|
58 (if (fboundp 'set-keymap-name)
|
|
|
59 (set-keymap-name map 'read-passwd-map))
|
|
|
60
|
|
|
61 (while (< i 127)
|
|
|
62 (aset s 0 i)
|
|
|
63 (or (and (boundp 'meta-prefix-char) (eq i meta-prefix-char))
|
|
|
64 (define-key map s 'self-insert-command))
|
|
|
65 (setq i (1+ i)))
|
|
|
66
|
|
|
67 (define-key map "\C-g" 'keyboard-quit)
|
|
|
68 (define-key map "\C-h" 'delete-backward-char)
|
|
|
69 (define-key map "\r" 'exit-minibuffer)
|
|
|
70 (define-key map "\n" 'exit-minibuffer)
|
|
|
71 (define-key map "\C-u" 'passwd-erase-buffer)
|
|
|
72 (define-key map "\C-q" 'quoted-insert)
|
|
|
73 (define-key map "\177" 'delete-backward-char)
|
|
|
74 (define-key map "\M-n" 'passwd-next-history-element)
|
|
|
75 (define-key map "\M-p" 'passwd-previous-history-element)
|
|
|
76 map)
|
|
|
77 "Keymap used for reading passwords in the minibuffer.
|
|
|
78 The \"bindings\" in this map are not real commands; only a limited
|
|
|
79 number of commands are understood. The important bindings are:
|
|
|
80 \\<read-passwd-map>
|
|
|
81 \\[passwd-erase-buffer] Erase all input.
|
|
|
82 \\[quoted-insert] Insert the next character literally.
|
|
|
83 \\[delete-backward-char] Delete the previous character.
|
|
|
84 \\[exit-minibuffer] Accept what you have typed.
|
|
|
85 \\[keyboard-quit] Abort the command.
|
|
|
86
|
|
|
87 All other characters insert themselves (but do not echo.)")
|
|
|
88
|
|
|
89 ;;; internal variables
|
|
|
90
|
|
|
91 (defvar passwd-history nil)
|
|
|
92 (defvar passwd-history-posn 0)
|
|
|
93
|
|
|
94 ;;;###autoload
|
|
|
95 (defun read-passwd (prompt &optional confirm default)
|
|
|
96 "Prompts for a password in the minibuffer, and returns it as a string.
|
|
|
97 If PROMPT may be a prompt string or an alist of elements
|
|
|
98 '\(prompt . default\).
|
|
|
99 If optional arg CONFIRM is true, then ask the user to type the password
|
|
|
100 again to confirm that they typed it correctly.
|
|
|
101 If optional arg DEFAULT is provided, then it is a string to insert as
|
|
|
102 the default choice (it is not, of course, displayed.)
|
|
|
103
|
|
|
104 If running under X, the keyboard will be grabbed (with XGrabKeyboard())
|
|
30
|
105 to reduce the possibility that eavesdropping is occuring.
|
|
0
|
106
|
|
|
107 When reading a password, all keys self-insert, except for:
|
|
|
108 \\<read-passwd-map>
|
|
|
109 \\[read-passwd-erase-line] Erase the entire line.
|
|
|
110 \\[quoted-insert] Insert the next character literally.
|
|
|
111 \\[delete-backward-char] Delete the previous character.
|
|
|
112 \\[exit-minibuffer] Accept what you have typed.
|
|
|
113 \\[keyboard-quit] Abort the command.
|
|
|
114
|
|
|
115 The returned value is always a newly-created string. No additional copies
|
|
|
116 of the password remain after this function has returned.
|
|
|
117
|
|
|
118 NOTE: unless great care is taken, the typed password will exist in plaintext
|
|
|
119 form in the running image for an arbitrarily long time. Priveleged users may
|
|
|
120 be able to extract it from memory. If emacs crashes, it may appear in the
|
|
|
121 resultant core file.
|
|
|
122
|
|
|
123 Some steps you can take to prevent the password from being copied around:
|
|
|
124
|
|
|
125 - as soon as you are done with the returned string, destroy it with
|
|
|
126 (fillarray string 0). The same goes for any default passwords
|
|
|
127 or password histories.
|
|
|
128
|
|
|
129 - do not copy the string, as with concat or substring - if you do, be
|
|
|
130 sure to keep track of and destroy all copies.
|
|
|
131
|
|
|
132 - do not insert the password into a buffer - if you do, be sure to
|
|
|
133 overwrite the buffer text before killing it, as with the functions
|
|
|
134 `passwd-erase-buffer' or `passwd-kill-buffer'. Note that deleting
|
|
|
135 the text from the buffer does NOT necessarily remove the text from
|
|
|
136 memory.
|
|
|
137
|
|
|
138 - be careful of the undo history - if you insert the password into a
|
|
|
139 buffer which has undo recording turned on, the password will be
|
|
|
140 copied onto the undo list, and thus recoverable.
|
|
|
141
|
|
|
142 - do not pass it as an argument to a shell command - anyone will be
|
|
|
143 able to see it if they run `ps' at the right time.
|
|
|
144
|
|
|
145 Note that the password will be temporarily recoverable with the `view-lossage'
|
|
|
146 command. This data will not be overwritten until another hundred or so
|
|
|
147 characters are typed. There's not currently a way around this."
|
|
|
148
|
|
|
149 (save-excursion
|
|
|
150 (let ((input (get-buffer-create " *password*"))
|
|
|
151 (passwd-history-posn 0)
|
|
|
152 passwd-history)
|
|
|
153 (if (listp prompt)
|
|
|
154 (setq passwd-history prompt
|
|
|
155 default (cdr (car passwd-history))))
|
|
|
156 (set-buffer input)
|
|
|
157 (buffer-disable-undo input)
|
|
|
158 (use-local-map read-passwd-map)
|
|
|
159 (unwind-protect
|
|
|
160 (progn
|
|
|
161 (if (passwd-grab-keyboard)
|
|
|
162 (passwd-secure-display))
|
|
|
163 (read-passwd-1 input prompt nil default)
|
|
|
164 (set-buffer input)
|
|
|
165
|
|
|
166 (if (not confirm)
|
|
|
167 (buffer-string)
|
|
|
168 (let ((ok nil)
|
|
|
169 passwd)
|
|
|
170 (while (not ok)
|
|
|
171 (set-buffer input)
|
|
|
172 (setq passwd (buffer-string))
|
|
|
173 (read-passwd-1 input prompt "[Retype to confirm]")
|
|
|
174 (if (passwd-compare-string-to-buffer passwd input)
|
|
|
175 (setq ok t)
|
|
|
176 (fillarray passwd 0)
|
|
|
177 (setq passwd nil)
|
|
|
178 (beep)
|
|
|
179 (read-passwd-1 input prompt "[Mismatch. Start over]")
|
|
|
180 ))
|
|
|
181 passwd)))
|
|
|
182 ;; protected
|
|
|
183 (passwd-ungrab-keyboard)
|
|
|
184 (passwd-insecure-display)
|
|
|
185 (passwd-kill-buffer input)
|
|
24
|
186 (message "")
|
|
0
|
187 ))))
|
|
|
188
|
|
|
189
|
|
|
190 (defun read-passwd-1 (buffer prompt &optional prompt2 default)
|
|
|
191 (set-buffer buffer)
|
|
|
192 (passwd-erase-buffer)
|
|
|
193 (if default (insert default))
|
|
|
194 (catch 'exit ; exit-minibuffer throws here
|
|
|
195 (while t
|
|
|
196 (set-buffer buffer)
|
|
|
197 (let* ((minibuffer-completion-table nil)
|
|
|
198 (cursor-in-echo-area t)
|
|
|
199 (echo-keystrokes 0)
|
|
|
200 (key (passwd-read-key-sequence
|
|
|
201 (concat (if (listp prompt)
|
|
|
202 (car (nth passwd-history-posn passwd-history))
|
|
|
203 prompt)
|
|
|
204 prompt2
|
|
|
205 (if passwd-echo
|
|
|
206 (make-string (buffer-size) passwd-echo)))))
|
|
|
207 (binding (key-binding key)))
|
|
|
208 (setq prompt2 nil)
|
|
|
209 (set-buffer buffer) ; just in case...
|
|
|
210 (if (fboundp 'event-to-character) ;; lemacs
|
|
|
211 (setq last-command-event (aref key (1- (length key)))
|
|
|
212 last-command-char (event-to-character last-command-event))
|
|
|
213 ;; v18/FSFmacs compatibility
|
|
|
214 (setq last-command-char (aref key (1- (length key)))))
|
|
|
215 (setq this-command binding)
|
|
|
216 (condition-case c
|
|
|
217 (command-execute binding)
|
|
|
218 (error
|
|
|
219 (beep)
|
|
|
220 (if (fboundp 'display-error)
|
|
|
221 (display-error c t)
|
|
|
222 ;; v18/FSFmacs compatibility
|
|
|
223 (message (concat (or (get (car-safe c) 'error-message) "???")
|
|
|
224 (if (cdr-safe c) ": ")
|
|
|
225 (mapconcat
|
|
|
226 (function (lambda (x) (format "%s" x)))
|
|
|
227 (cdr-safe c) ", "))))
|
|
|
228 (sit-for 2)))
|
|
|
229 ))))
|
|
|
230
|
|
|
231 (defun passwd-previous-history-element (n)
|
|
|
232 (interactive "p")
|
|
|
233 (or passwd-history
|
|
|
234 (error "Password history is empty."))
|
|
|
235 (let ((l (length passwd-history)))
|
|
|
236 (setq passwd-history-posn
|
|
|
237 (% (+ n passwd-history-posn) l))
|
|
|
238 (if (< passwd-history-posn 0)
|
|
|
239 (setq passwd-history-posn (+ passwd-history-posn l))))
|
|
|
240 (let ((obuff (current-buffer))) ; want to move point in passwd buffer
|
|
|
241 (unwind-protect
|
|
|
242 (progn
|
|
|
243 (set-buffer " *password*")
|
|
|
244 (passwd-erase-buffer)
|
|
|
245 (insert (cdr (nth passwd-history-posn passwd-history))))
|
|
|
246 (set-buffer obuff))))
|
|
|
247
|
|
|
248 (defun passwd-next-history-element (n)
|
|
|
249 (interactive "p")
|
|
|
250 (passwd-previous-history-element (- n)))
|
|
|
251
|
|
|
252 (defun passwd-erase-buffer ()
|
|
|
253 ;; First erase the buffer, which will simply enlarge the gap.
|
|
|
254 ;; Then insert null characters until the gap is filled with them
|
|
|
255 ;; to prevent the old text from being visible in core files or kmem.
|
|
|
256 ;; (Actually use 3x the size of the buffer just to be safe - a longer
|
|
|
257 ;; passwd might have been typed and backspaced over.)
|
|
|
258 (interactive)
|
|
|
259 (widen)
|
|
|
260 (let ((s (* (buffer-size) 3)))
|
|
|
261 (erase-buffer)
|
|
|
262 (while (> s 0)
|
|
|
263 (insert ?\000)
|
|
|
264 (setq s (1- s)))
|
|
|
265 (erase-buffer)))
|
|
|
266
|
|
|
267 (defun passwd-kill-buffer (buffer)
|
|
|
268 (save-excursion
|
|
|
269 (set-buffer buffer)
|
|
|
270 (buffer-disable-undo buffer)
|
|
|
271 (passwd-erase-buffer)
|
|
|
272 (set-buffer-modified-p nil))
|
|
|
273 (kill-buffer buffer))
|
|
|
274
|
|
|
275
|
|
|
276 (defun passwd-compare-string-to-buffer (string buffer)
|
|
|
277 ;; same as (equal string (buffer-string)) but with no dangerous consing.
|
|
|
278 (save-excursion
|
|
|
279 (set-buffer buffer)
|
|
|
280 (goto-char (point-min))
|
|
|
281 (let ((L (length string))
|
|
|
282 (i 0))
|
|
|
283 (if (/= L (- (point-max) (point-min)))
|
|
|
284 nil
|
|
|
285 (while (not (eobp))
|
|
|
286 (if (/= (following-char) (aref string i))
|
|
|
287 (goto-char (point-max))
|
|
|
288 (setq i (1+ i))
|
|
|
289 (forward-char)))
|
|
|
290 (= (point) (+ i (point-min)))))))
|
|
|
291
|
|
|
292
|
|
|
293 (defvar passwd-face-data nil)
|
|
|
294 (defun passwd-secure-display ()
|
|
|
295 ;; Inverts the screen - used to indicate secure input, like xterm.
|
|
|
296 (cond
|
|
|
297 ((and passwd-invert-frame-when-keyboard-grabbed
|
|
|
298 (fboundp 'set-face-foreground))
|
|
|
299 (setq passwd-face-data
|
|
|
300 (delq nil (mapcar (function
|
|
|
301 (lambda (face)
|
|
|
302 (let ((fg (face-foreground face))
|
|
|
303 (bg (face-background face)))
|
|
|
304 (if (or fg bg)
|
|
|
305 (if (fboundp 'color-name)
|
|
|
306 (list face
|
|
|
307 (color-name fg)
|
|
|
308 (color-name bg))
|
|
|
309 (list face fg bg))
|
|
|
310 nil))))
|
|
|
311 (if (fboundp 'list-faces)
|
|
|
312 (list-faces) ; lemacs
|
|
|
313 (face-list) ; FSFmacs
|
|
|
314 ))))
|
|
|
315 (let ((rest passwd-face-data))
|
|
|
316 (while rest
|
|
|
317 (set-face-foreground (nth 0 (car rest)) (nth 2 (car rest)))
|
|
|
318 (set-face-background (nth 0 (car rest)) (nth 1 (car rest)))
|
|
|
319 (setq rest (cdr rest))))))
|
|
|
320 nil)
|
|
|
321
|
|
|
322 (defun passwd-insecure-display ()
|
|
|
323 ;; Undoes the effect of `passwd-secure-display'.
|
|
|
324 (cond
|
|
|
325 (passwd-invert-frame-when-keyboard-grabbed
|
|
|
326 (while passwd-face-data
|
|
|
327 (set-face-foreground (nth 0 (car passwd-face-data))
|
|
|
328 (nth 1 (car passwd-face-data)))
|
|
|
329 (set-face-background (nth 0 (car passwd-face-data))
|
|
|
330 (nth 2 (car passwd-face-data)))
|
|
|
331 (setq passwd-face-data (cdr passwd-face-data)))
|
|
|
332 nil)))
|
|
|
333
|
|
|
334 (defun passwd-grab-keyboard ()
|
|
|
335 (cond ((not (and (fboundp 'x-grab-keyboard) ; lemacs 19.10+
|
|
|
336 (eq 'x (if (fboundp 'frame-type)
|
|
|
337 (frame-type (selected-frame))
|
|
|
338 (live-screen-p (selected-screen))))))
|
|
|
339 nil)
|
|
|
340 ((x-grab-keyboard)
|
|
|
341 t)
|
|
|
342 (t
|
|
|
343 (message "Unable to grab keyboard - waiting a second...")
|
|
|
344 (sleep-for 1)
|
|
|
345 (cond ((x-grab-keyboard)
|
|
|
346 (message "Keyboard grabbed on second try.")
|
|
|
347 t)
|
|
|
348 (t
|
|
|
349 (beep)
|
|
|
350 (message "WARNING: keyboard is insecure (unable to grab!)")
|
|
|
351 (sleep-for 3)
|
|
|
352 nil)))))
|
|
|
353
|
|
|
354 (defun passwd-ungrab-keyboard ()
|
|
|
355 (if (and (fboundp 'x-ungrab-keyboard) ; lemacs 19.10+
|
|
|
356 (eq 'x (if (fboundp 'frame-type)
|
|
|
357 (frame-type (selected-frame))
|
|
|
358 (live-screen-p (selected-screen)))))
|
|
|
359 (x-ungrab-keyboard)))
|
|
|
360
|
|
|
361 ;; v18 compatibility
|
|
|
362 (or (fboundp 'buffer-disable-undo)
|
|
|
363 (fset 'buffer-disable-undo 'buffer-flush-undo))
|
|
|
364
|
|
|
365 ;; read-key-sequence echoes the key sequence in Emacs 18.
|
|
|
366 (defun passwd-read-key-sequence (prompt)
|
|
|
367 (let ((inhibit-quit t)
|
|
|
368 str)
|
|
|
369 (while (or (null str) (keymapp (key-binding str)))
|
|
24
|
370 (message prompt)
|
|
0
|
371 (setq str (concat str (char-to-string (read-char)))))
|
|
|
372 (setq quit-flag nil)
|
|
|
373 str))
|
|
|
374
|
|
|
375 (or (string-match "^18" emacs-version)
|
|
|
376 (fset 'passwd-read-key-sequence 'read-key-sequence))
|
|
|
377
|
|
|
378 (provide 'passwd)
|
|
|
379
|
|
|
380 ;;; passwd.el ends here
|
