patch 8.1.0433: mapping can obtain text from inputsecret()

Problem:    Mapping can obtain text from inputsecret(). (Tommy Allen)
Solution:   Disallow CTRL-R = and CTRL-\ e when using inputsecret().

diff --git a/src/ex_getln.c b/src/ex_getln.c
index c2c74534b072449ac22956a3fef40e240d4636a4..f08ae903261008f82fd188e9e39754d71aaa8cf3 100644 (file)
--- a/src/ex_getln.c
+++ b/src/ex_getln.c
@@ -1308,7 +1308,11 @@ getcmdline(
            /* CTRL-\ e doesn't work when obtaining an expression, unless it
             * is in a mapping. */
            if (c != Ctrl_N && c != Ctrl_G && (c != 'e'
-                                   || (ccline.cmdfirstc == '=' && KeyTyped)))
+                                   || (ccline.cmdfirstc == '=' && KeyTyped)
+#ifdef FEAT_EVAL
+                                   || cmdline_star
+#endif
+                                   ))
            {
                vungetc(c);
                c = Ctrl_BSL;
@@ -1801,7 +1805,8 @@ getcmdline(
                new_cmdpos = -1;
                if (c == '=')
                {
-                   if (ccline.cmdfirstc == '=')/* can't do this recursively */
+                   if (ccline.cmdfirstc == '=' // can't do this recursively
+                           || cmdline_star)    // or when typing a password
                    {
                        beep_flush();
                        c = ESC;

diff --git a/src/version.c b/src/version.c
index a009ef099d31bb615b815b83c44fa5aece95832d..6c69b17d696414724d0cd808c18405b838fbe264 100644 (file)
--- a/src/version.c
+++ b/src/version.c
@@ -794,6 +794,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    433,
 /**/
     432,
 /**/