From 7addc67cd3f6a4c0358f70b4fb9906ebcd88b9e3 Mon Sep 17 00:00:00 2001
From: Simeon Simeonov
Date: Sun, 15 Apr 2018 15:40:25 +0200
Subject: Add support for auto-unloading of the master password

---
 src/main.c     | 14 ++++++++++++--
 src/prefs_ui.c | 27 ++++++++++++++++-----------
 2 files changed, 28 insertions(+), 13 deletions(-)

(limited to 'src')

diff --git a/src/main.c b/src/main.c
index 3c87c70..97a4bd0 100644
--- a/src/main.c
+++ b/src/main.c
@@ -280,7 +280,7 @@ int main(int argc, char *argv[])
 #if USE_SSL
 	if (prefs_common.use_master_password) {
 		if (prefs_common.master_password_hash != NULL) {
-			if (check_master_password_interactively(3) != RC_OK) {
+			if (check_master_password_interactively(3) != MP_RC_OK) {
 				if (alertpanel(_("Master password"),
 							   _("Invalid master password"),
 							   GTK_STOCK_DISCARD,
@@ -292,7 +292,7 @@ int main(int argc, char *argv[])
 		} else {
 			alertpanel_notice(
 				_("Master password enabled but not set. Setting one now"));
-			if (set_master_password_interactively(3) != RC_OK) {
+			if (set_master_password_interactively(3) != MP_RC_OK) {
 				if (alertpanel(_("Master password"),
 							   _("Unable to set master password"),
 							   GTK_STOCK_DISCARD,
@@ -303,6 +303,16 @@ int main(int argc, char *argv[])
 			}
 		}
 	}
+	/* security goal: 
+	 * if the master password is enabled and loaded on init,
+	 * an attacker can potentially set use_master_password - disabled
+	 * afterwards and then force Sylpheed to save account data - the result
+	 * being passwords saved to accountrc in plain-text.
+	 * possible solution:
+	 * Do not allow the passwords to be stored in plain-text if Sylpheed
+	 * was started with use_master_password - enabled.
+	 */
+	master_password_enabled_on_init = prefs_common.use_master_password;
 #endif
 	filter_set_addressbook_func(addressbook_has_address);
 	filter_read_config();
diff --git a/src/prefs_ui.c b/src/prefs_ui.c
index 051a058..2ab1d45 100644
--- a/src/prefs_ui.c
+++ b/src/prefs_ui.c
@@ -279,23 +279,28 @@ void prefs_set_data_from_epass_entry(PrefParam *pparam)
 
 	/* This is where decrypted passwords are encrypted and stored again */
 
-	/* TODO: A potential exploit is disabling master password and then forcing
-	 * Sylpheed to store the password
-	 */
-
 	/* master_password == NULL for any of the following reasons:
 	 * - use_master_password is not enabled (we just save without encrypting)
-	 * - master_password is auto unloaded (let the encrypt function handle it)
+	 * - master_password is auto unloaded (prompt for the master password)
 	 * - undefined reason (refure to store the password)
 	 */
 	if (!prefs_common.use_master_password) {
-		prefs_set_data_from_entry(pparam);
-		return;
-	} else if ((master_password == NULL) &&
-			   (!prefs_common.auto_unload_master_password)) {
-		debug_print("Master password enabled, but not loaded for no "
-					"apparent reason. Not storing\n");
+		/* check if use_master_password was enabled when Sylpheed started */
+		if (!master_password_enabled_on_init) {
+			prefs_set_data_from_entry(pparam);
+		}
 		return;
+	} else if (master_password == NULL) {
+        if (!prefs_common.auto_unload_master_password) {
+            debug_print("Master password enabled, but not loaded for no "
+                        "apparent reason. Not storing\n");
+            return;
+        } else {
+            if (check_master_password_interactively(3) != MP_RC_OK) {
+                debug_print("Failed to reload the master password\n");
+                return;
+            }
+        }
 	}
 
 	ui_data = (PrefsUIData *)pparam->ui_data;
-- 
cgit v1.3