1
0
Fork 0
mirror of https://we.phorge.it/source/phorge.git synced 2024-12-01 19:22:42 +01:00
phorge-phorge/src/applications/passphrase
epriestley 3dea92081b Fix an issue where passphrase-protected private keys were stored without discarding passphrases
Summary:
Ref T13454. See <https://discourse.phabricator-community.org/t/newly-created-ssh-private-keys-with-passphrase-not-working-anymore/3883>.

After changes to distinguish between invalid and passphrase-protected keys, SSH private key management code incorrectly uses "-y ..." ("print public key") when it means "-p ..." ("modify input file, removing passphrase"). This results in the command having no effect, and Passphrase stores the raw input credential, not the stripped version.

We can't recover the keys because we don't store the passphrase, so no migration here is really possible. (We could add more code to detect this case, but it's presumably rare.)

Also, correct the behavior of the "Show Public Key" action: this is available for users who can see the credential and does not require edit permission.

Test Plan:
  - Created a new credential with a passphrase, then showed the public key.

Maniphest Tasks: T13006, T13454

Differential Revision: https://secure.phabricator.com/D21245
2020-05-13 08:14:37 -07:00
..
application Move FontIcon calls to Icon 2016-01-28 08:48:45 -08:00
capability Save authorPHID on Passphrase Credentials to support "Credential Author" object policy 2015-06-22 11:28:33 -07:00
conduit Make Passphrase "token" credentials accessible via the API 2016-11-15 09:12:35 -08:00
controller Fix an issue where passphrase-protected private keys were stored without discarding passphrases 2020-05-13 08:14:37 -07:00
credentialtype Correctly identify more SSH private key problems as "formatting" or "passphrase" related 2019-11-13 10:22:00 -08:00
editor Update Passphrase for modular transactions 2017-05-04 11:31:37 -07:00
keys Add a "Token" Credential type 2016-03-22 12:11:58 -07:00
phid Separate handle "status" and "availability" 2015-05-14 11:14:44 -07:00
policyrule Save authorPHID on Passphrase Credentials to support "Credential Author" object policy 2015-06-22 11:28:33 -07:00
query Support Ferret engine for Passphrase credentials 2017-09-07 13:23:13 -07:00
remarkup Rename PhutilRemarkupRule subclasses 2014-08-05 00:55:43 +10:00
search Reduce the amount of boilerplate that implementing FerretInterface requires 2017-09-07 13:23:31 -07:00
storage Make the default behavior of getApplicationTransactionCommentObject() "return null" instead of "throw" 2019-02-07 14:56:38 -08:00
view Fix spelling 2017-10-09 10:48:04 -07:00
xaction Replace "Show Secret" in Passphrase with one-shot MFA 2019-01-28 09:44:08 -08:00