On Tue, 28 Jan 2003, Peter Davis wrote:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On Tuesday 28 January 2003 07:53, Karl Fogel wrote:
See my comments in issue #1117. Short summary: we can probably apply
the use-stderr patch right away, because it's an improvement over the
existing situation, but the right fix would be a portable function in
APR to do what getpass()/getpassphrase() do. However, hmmm, it looks
like APR does use stderr when no system getpass()/getpassphrase() is
available -- that is, APR doesn't have any prompt-hiding code of its
own. So the Right Solution might be harder than I thought, oh well.
Now, looking through one of the three *getpass implementations in that
file, I'm confused again.
Well, that seems to have been there since before Apache 1.3, so it most
likely just hasn't been noticed before.
static char *getpass(const char *prompt)
{
struct termios attr;
static char password[MAX_STRING_LEN];
int n=0;
fputs(prompt, stderr);
fflush(stderr);
if (tcgetattr(STDIN_FILENO, attr) != 0)
return NULL;
attr.c_lflag = ~(ECHO);
if (tcsetattr(STDIN_FILENO, TCSAFLUSH, attr) != 0)
return NULL;
while ((password[n] = getchar()) != '\n') {
if (n sizeof(password) - 1 password[n] = ' ' password[n] = '~') {
n++;
} else {
fprintf(stderr,\n);
fputs(prompt, stderr);
fflush(stderr);
n = 0;
}
}
password[n] = '\0';
printf(\n);
^^^^^^^^^^^^^
**** What's this? ****
That is how we add the newline to the string. Since we aren't echoing the
user's keystrokes to the screen, this is required or the user wouldn't
have any feedback that they had actually pressed return. :-)
snipped
Look at the printf just above. Before that, it prints the prompt
to stderr, and if the password contains control chars, it uses
stderr to print a newline and start over. But when the password
is complete, it prints a newline to stdout. In fact, everywhere
except that one line uses fputs(stderr).
Has nobody noticed this just because it uses one of the other
implementations for most builds? Seems like the same change should
be made here.
It looks like a simple bug, although I am wondering how this interacts
with piping. I am thinking of `htpasswd passwd rbb err.log`
What is happening now, is that the password prompt is printed to stdout,
but the final \n (to reset the line) is printed to stdout (the log file).
Changing that shouldnn't hurt anything, but it feels like there is a
reason for this.
Ryan
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@subversion.tigris.org
For additional commands, e-mail: dev-help@subversion.tigris.org
Received on Sat Oct 14 02:22:34 2006