From: Bram Moolenaar <Bram@vim.org>
Date: Tue, 25 Sep 2018 18:48:57 +0000 (+0200)
Subject: patch 8.1.0433: mapping can obtain text from inputsecret()
X-Git-Tag: v8.1.0433
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=31cbadf74bccc2a5cd8233bc31bbcfe466b00021;p=thirdparty%2Fvim.git

patch 8.1.0433: mapping can obtain text from inputsecret()

Problem:    Mapping can obtain text from inputsecret(). (Tommy Allen)
Solution:   Disallow CTRL-R = and CTRL-\ e when using inputsecret().
---

diff --git a/src/ex_getln.c b/src/ex_getln.c
index c2c74534b0..f08ae90326 100644
--- a/src/ex_getln.c
+++ b/src/ex_getln.c
@@ -1308,7 +1308,11 @@ getcmdline(
 	    /* CTRL-\ e doesn't work when obtaining an expression, unless it
 	     * is in a mapping. */
 	    if (c != Ctrl_N && c != Ctrl_G && (c != 'e'
-				    || (ccline.cmdfirstc == '=' && KeyTyped)))
+				    || (ccline.cmdfirstc == '=' && KeyTyped)
+#ifdef FEAT_EVAL
+				    || cmdline_star
+#endif
+				    ))
 	    {
 		vungetc(c);
 		c = Ctrl_BSL;
@@ -1801,7 +1805,8 @@ getcmdline(
 		new_cmdpos = -1;
 		if (c == '=')
 		{
-		    if (ccline.cmdfirstc == '=')/* can't do this recursively */
+		    if (ccline.cmdfirstc == '=' // can't do this recursively
+			    || cmdline_star)	// or when typing a password
 		    {
 			beep_flush();
 			c = ESC;
diff --git a/src/version.c b/src/version.c
index a009ef099d..6c69b17d69 100644
--- a/src/version.c
+++ b/src/version.c
@@ -794,6 +794,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    433,
 /**/
     432,
 /**/