From 46275eef3de4e025b5657e67e142fc58125779be Mon Sep 17 00:00:00 2001
From: Simeon Simeonov
Date: Fri, 13 Apr 2018 15:24:01 +0200
Subject: Add support for auto-unloading av the master password

---
 src/main.c                |  7 +++++++
 src/prefs_common_dialog.c | 15 ++++++++++++++-
 src/prefs_ui.c            | 19 ++++++++++++++++++-
 3 files changed, 39 insertions(+), 2 deletions(-)

(limited to 'src')

diff --git a/src/main.c b/src/main.c
index c6bd812..3c87c70 100644
--- a/src/main.c
+++ b/src/main.c
@@ -412,6 +412,13 @@ int main(int argc, char *argv[])
 
 	remote_command_exec();
 
+#if USE_SSL
+	if (prefs_common.auto_unload_master_password && master_password_active()) {
+		debug_print("Auto unloading master password\n");
+		unload_master_password();
+	}
+#endif
+
 #if USE_UPDATE_CHECK
 	if (prefs_common.auto_update_check)
 		update_check(FALSE);
diff --git a/src/prefs_common_dialog.c b/src/prefs_common_dialog.c
index 41fdb24..119a056 100644
--- a/src/prefs_common_dialog.c
+++ b/src/prefs_common_dialog.c
@@ -219,6 +219,7 @@ static struct Privacy {
 #if USE_SSL
 static struct MasterPassword {
 	GtkWidget *checkbtn_use_master_password;
+	GtkWidget *checkbtn_auto_unload_master_password;
 	GtkWidget *spinbtn_encrypted_password_min_length;
 } master_password;
 #endif
@@ -573,6 +574,9 @@ static PrefsUIData ui_data[] = {
 #if USE_SSL
 	{"use_master_password", &master_password.checkbtn_use_master_password,
 	 prefs_set_data_from_toggle, prefs_set_toggle},
+	{"auto_unload_master_password",
+	 &master_password.checkbtn_auto_unload_master_password,
+	 prefs_set_data_from_toggle, prefs_set_toggle},
 	{"encrypted_password_min_length",
 	 &master_password.spinbtn_encrypted_password_min_length,
 	 prefs_set_data_from_spinbtn,
@@ -2681,6 +2685,7 @@ static void prefs_master_password_create(void)
 	GtkWidget *hbox_spc;
 	GtkWidget *label;
 	GtkWidget *checkbtn_use_master_password;
+	GtkWidget *checkbtn_auto_unload_master_password;
 	GtkWidget *spinbtn_encrypted_password_min_length;
 	GtkObject *spinbtn_encrypted_password_min_length_adj;
 
@@ -2706,6 +2711,11 @@ static void prefs_master_password_create(void)
 						FALSE,
 						0);
 
+	PACK_CHECK_BUTTON (vbox_master_password_suboptions,
+					   checkbtn_auto_unload_master_password,
+					   _("Automatically unload master password "
+						 "after session initialization"));
+
 	hbox1 = gtk_hbox_new (FALSE, 8);
 	gtk_widget_show (hbox1);
 	gtk_box_pack_start (GTK_BOX (vbox_master_password_suboptions),
@@ -2740,10 +2750,13 @@ static void prefs_master_password_create(void)
 								 64,
 								 -1);
 
-	SET_TOGGLE_SENSITIVITY (checkbtn_use_master_password, hbox1);
+	SET_TOGGLE_SENSITIVITY (checkbtn_use_master_password,
+							vbox_master_password_suboptions);
 
 	master_password.checkbtn_use_master_password
 		= checkbtn_use_master_password;
+	master_password.checkbtn_auto_unload_master_password
+		= checkbtn_auto_unload_master_password;
 	master_password.spinbtn_encrypted_password_min_length
 		= spinbtn_encrypted_password_min_length;
 }
diff --git a/src/prefs_ui.c b/src/prefs_ui.c
index 5539f4a..051a058 100644
--- a/src/prefs_ui.c
+++ b/src/prefs_ui.c
@@ -31,6 +31,7 @@
 #include <errno.h>
 
 #include "prefs.h"
+#include "prefs_common.h"
 #include "prefs_ui.h"
 #include "menu.h"
 #include "codeconv.h"
@@ -276,9 +277,25 @@ void prefs_set_data_from_epass_entry(PrefParam *pparam)
 	gchar **str;
 	const gchar *entry_str;
 
-	if (!master_password_active()) {
+	/* This is where decrypted passwords are encrypted and stored again */
+
+	/* TODO: A potential exploit is disabling master password and then forcing
+	 * Sylpheed to store the password
+	 */
+
+	/* master_password == NULL for any of the following reasons:
+	 * - use_master_password is not enabled (we just save without encrypting)
+	 * - master_password is auto unloaded (let the encrypt function handle it)
+	 * - undefined reason (refure to store the password)
+	 */
+	if (!prefs_common.use_master_password) {
 		prefs_set_data_from_entry(pparam);
 		return;
+	} else if ((master_password == NULL) &&
+			   (!prefs_common.auto_unload_master_password)) {
+		debug_print("Master password enabled, but not loaded for no "
+					"apparent reason. Not storing\n");
+		return;
 	}
 
 	ui_data = (PrefsUIData *)pparam->ui_data;
-- 
cgit v1.3