From e06248ef69b33d102a57aaa31fffcde3240dad9c Mon Sep 17 00:00:00 2001 From: Anders Betts Date: Wed, 23 Sep 2026 10:08:44 +0200 Subject: user.set_password: change your own password; TUI "Byt lösenord" MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Needs the current password (wrong ones rate limited like logins) and a password session, requires at least 10 characters, closes the user's other sessions and is audited without secrets. The TUI main menu gets "Byt lösenord" with masked prompts; ^R keeps working with the new password. Masked prompt buffers are wiped before they are freed. Co-Authored-By: Claude Opus 5.5 --- clients/tui.c | 2 ++ 1 file changed, 2 insertions(+) (limited to 'clients/tui.c') diff --git a/clients/tui.c b/clients/tui.c index 4bc1d66..43a3d27 100644 --- a/clients/tui.c +++ b/clients/tui.c @@ -596,6 +596,8 @@ static int field_scratch(int y, int x, int width, char *buf, size_t cap, int rc = field_loop(y, x, width, scratch, cap, mask, date, tabs, 1, first); if (rc) snprintf(buf, cap, "%s", scratch); + if (mask) + memset(scratch, 0, cap); /* no password copy left in freed memory */ free(scratch); return rc; } -- cgit v1.3