| Age | Commit message (Collapse) | Author |
|---|
|
|
|
Emacs backup files add a duplicate entry, that is, if you have the two files,
foo.bar and foo.bar~, then you'd get two entries for `foo'.
* password-store.el (password-store-list): Delete duplicate entries. Bump
version to 2.0.2. Update Copyright notice.
|
|
Drop nil arguments in `password-store--run` and `password-store--run-1`. This
fixes an error running `password-store-generate`.
|
|
|
|
When using EXWM, if `password-store-get` is called and a pinentry
program needs to be executed, Emacs deadlocks. This happens becuase
Emacs blocks waiting for output from `gpg(1)`, which is blocked
waiting for output from the pinentry-program, which is blocked waiting
for Emacs to manage its window.
This updates `password-store-copy` to work asynchronously. This
should be fine, since its primary purpose is side-effecting, and it
doesn’t matter when its evaluation completes. The ability to call
`password-store-get` asynchronously with a callback has also been
added to support this usecase.
A new function has been added for general cases of async `pass`
commands where the output is needed, `password-store--run-1`. While
there is an existing `password-store--run-async`, it discards output
-- it’s only used for `pass edit`, where it’s not needed. The body of
`password-store--run` has been replacing it with one that uses
`--run-1` and a wait loop which blocks until it’s complete.
Supporting all this necessitated moving the file to lexical binding
and dropping Emacs 24 support. The latter requirement could be worked
around if there are concerns around it.
**SECURITY INTERLUDE**
I was unbelievably distressed to discover that the implementation of
`password-store--run` redirects the decrypted file contents to disk,
reads that into a buffer, then removes the file. This approach is
preposterous and may warrant a CVE, as it exposes users to numerous
conditions where their cleartext passwords could be recovered:
- If the user hits C-g, the Emacs function may not get to the point
of removing the file, leaving the password on disk.
- It’s not a safe assumption that `make-temp-file` is secure, and
even if it were, the time windows in play are likely to be very
large, opening race conditions where the file contents can be read
by an attacker before the file is removed.
- Even if the file is removed, it could be recovered by examining the
contents of deleted inodes.
Information this sensitive should NEVER be persisted in cleartext in
non-volatile storage. You may as well write it on a post-it and stick
it on your monitor.
re NicolasPetton/pass#25
|
|
"http://" was repeated, fix the second instance to read "https://".
|
|
Use the autocmd pattern to match the password filename rather than doing
it manually within the called function.
|
|
Per debugging from Enno Nagel <enno.nagel+vim@gmail.com>, it's become
apparent to me that to have any degree of confidence that none of these
options have actually got any plaintext password data in them, we need
to disable the options globally when a password file is edited.
In particular, in the case of the 'viminfo' global option, it's not
possible to disable it per path, and not terribly meaningful either;
things like the last seach pattern or the contents of registers, i.e.
global state of the editor, are recorded. There's no sensible approach I
can see except to actually switch the feature off entirely by blanking
it.
I've therefore completely rewritten this, to make as thorough a check as
possible that the Vim user is editing a pass(1) file by calling `pass
edit`, and then to disable the "leaky" options globally, with an
explicit warning so that the user can see it's been done.
This plugin is also available as Vim script #5707:
<https://www.vim.org/scripts/script.php?script_id=5707>
Its homepage is here:
<https://sanctum.geek.nz/cgit/vim-redact-pass.git/about/>
|
|
If IFS (Input Field Separator) is not emptied, read will actually strip
spaces and tabs at the beginning/end end of the "line".
|
|
|
|
This is important for filenames with special characters such as spaces
and parenthesis.
|
|
|
|
|
|
|
|
Instead of editing the password file directly using Emacs, "pass edit" is
run. This allows password-store's git change tracking to work.
This adds a dependency on the with-editor Emacs package.
|
|
|
|
|
|
- Code is now PEP 8 compliant
- Uses argparse module for command line arguments
- Prints what it will do and prompts for confirmation before
proceeding
- Does not put URL and notes fields in the entry unless they
are present in the CSV file
- Adds a "user" field in the entry
- There are now command line arguments for the following:
- Exclude specific groups from being imported
- Convert groups and names to lowercase
- Use the name of the KeePass entry rather than the
username as the pass entry name
|
|
|
|
|
|
|
|
The CSV is generated by KeePassX 2.0 on Mac OSX
|
|
|
|
|
|
To assist the migration from the default Firefox password store to
passff.
Add also some basic tests.
More info at:
- <https://addons.mozilla.org/en-US/firefox/addon/password-exporter>
- <https://addons.mozilla.org/en-US/firefox/addon/passff>
|
|
Prof. Aho always seemed neat, but parsing a script inside a script for
the simple purpose of removing the trailing new line seems a bit absurd.
So, instead use two processes! One for getting the first line and one
for removing the trailing line. Everybody loves more calls to fork(),
right?
|
|
Without this patch, all entries are processed twice: once in the first
call to import_group (which recursively processes all entries), then in
the following import_group on all subgroups.
This leads to spurious warnings ("Duplicate needs merging") and extra
text added to each entry.
|
|
Use a defvar for the timeout timer in order to have better control and
not starting multiple timers when calling password-store-copy.
|
|
In particular, people were encountering exceptions when `empty?` was
called on a `nil` grouping.
|
|
The output of pass may contain "%", which will cause `message` to throw
the error: "Not enough arguments for format string".
For example, `pass rename foo bar` outputs:
[master c33f7a9] Rename foo to bar.
1 file changed, 0 insertions(+), 0 deletions(-)
rename foo.gpg => bar.gpg (100%)
|
|
It seems this file doesn't use spaces any more.
|
|
In 87ec1489fa98, I forgot that some people like to store more than one line in
their password files. We should only pass the first line to xdotool.
|
|
This works around a bug in xdotool parsing when encountering quotes, see
https://github.com/jordansissel/xdotool/issues/72.
Thanks to Gerd Wachsmuth for the report.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Use delq instead of -reject from the dash package.
|
|
|
|
This fixes a problem where gnupg-agent messages would get mixed with the
password content.
|
|
|
|
Quote shell arguments for insert so that it handles passwords and entry
names that contain special characters.
|
|
|
|
|
|
Suggested-by: Christoph Egger <christoph@christoph-egger.org>
|
|
If keepassx2pass.py is given an xml file containing passwords with an empty
title, like <title></title>, ElementTree.text returns None. This commit
substitutes an empty string; which will produce a password with name '_',
instead of raising AtttributeError, as shown in this exception::
Traceback (most recent call last):
File "contrib/importers/keepassx2pass.py", line 80, in <module>
main(sys.argv[1])
File "contrib/importers/keepassx2pass.py", line 77, in main
import_group(group)
File "contrib/importers/keepassx2pass.py", line 71, in import_group
import_entry(entry, npath)
File "contrib/importers/keepassx2pass.py", line 58, in import_entry
print "Importing " + path_for(element, path)
File "contrib/importers/keepassx2pass.py", line 37, in path_for
title = cleanTitle(space_to_camelcase(element.find('title').text))
File "contrib/importers/keepassx2pass.py", line 16, in space_to_camelcase
for word in value.split(" "):
AttributeError: 'NoneType' object has no attribute 'split'
|
|
Timeout password after PASSWORD_STORE_CLIP_TIME seconds, if set.
Otherwise timeout after 45 seconds. These are the setting used by pass.
|
|
|