(GH-503) Credential request should mask password

when a source and/or a proxy does not have the credentials stored in the chocolatey.config file or when they are incorrect, choco will prompt for valid credentials. When requesting proxy/network password for a source, the password should be masked on the screen so that the password is not able to be seen by other folks.
chocolatey · Feb 3, 2016 · 1ff10bd · 1ff10bd
1 parent a1474ea
commit 1ff10bd
Show file tree

Hide file tree

Showing 3 changed files with 40 additions and 30 deletions.
diff --git a/src/chocolatey/infrastructure.app/nuget/ChocolateyNugetCredentialProvider.cs b/src/chocolatey/infrastructure.app/nuget/ChocolateyNugetCredentialProvider.cs
@@ -87,7 +87,7 @@ public ICredentials get_credentials_from_user(Uri uri, IWebProxy proxy, Credenti
             Console.Write("User name: ");
             string username = Console.ReadLine();
             Console.Write("Password: ");
-            var password = Console.ReadLine();
+            var password = InteractivePrompt.get_password(_config.PromptForConfirmation);
 
             //todo: set this up as secure
             //using (var securePassword = new SecureString())

diff --git a/src/chocolatey/infrastructure/commandline/InteractivePrompt.cs b/src/chocolatey/infrastructure/commandline/InteractivePrompt.cs
@@ -27,6 +27,7 @@ namespace chocolatey.infrastructure.commandline
     public class InteractivePrompt
     {
         private static Lazy<IConsole> _console = new Lazy<IConsole>(() => new Console());
+        private const int TIMEOUT_IN_SECONDS = 30;
 
         [EditorBrowsable(EditorBrowsableState.Never)]
         public static void initialize_with(Lazy<IConsole> console)
@@ -106,5 +107,41 @@ public static string prompt_for_confirmation(string prompt, IEnumerable<string>
 
             return choiceDictionary[selected];
         }
+
+        public static string get_password(bool interactive)
+        {
+            var password = string.Empty;
+            var possibleNonInteractive = !interactive;
+            ConsoleKeyInfo info = possibleNonInteractive ? Console.ReadKey(TIMEOUT_IN_SECONDS * 1000) : Console.ReadKey(true);
+            while (info.Key != ConsoleKey.Enter)
+            {
+                if (info.Key != ConsoleKey.Backspace)
+                {
+                    Console.Write("*");
+                    password += info.KeyChar;
+                    info = possibleNonInteractive ? Console.ReadKey(TIMEOUT_IN_SECONDS * 1000) : Console.ReadKey(true);
+                }
+                else if (info.Key == ConsoleKey.Backspace)
+                {
+                    if (!string.IsNullOrEmpty(password))
+                    {
+                        password = password.Substring(0, password.Length - 1);
+                        // get the location of the cursor
+                        int pos = System.Console.CursorLeft;
+                        // move the cursor to the left by one character
+                        System.Console.SetCursorPosition(pos - 1, System.Console.CursorTop);
+                        // replace it with space
+                        Console.Write(" ");
+                        // move the cursor to the left by one character again
+                        System.Console.SetCursorPosition(pos - 1, System.Console.CursorTop);
+                    }
+                    info = possibleNonInteractive ? Console.ReadKey(TIMEOUT_IN_SECONDS * 1000) : Console.ReadKey(true);
+                }
+            }
+            for (int i = 0; i < password.Length; i++) Console.Write("*");
+            System.Console.WriteLine("");
+
+            return password;
+        }
     }
 }
diff --git a/src/chocolatey/infrastructure/powershell/PoshHostUserInterface.cs b/src/chocolatey/infrastructure/powershell/PoshHostUserInterface.cs
@@ -24,6 +24,7 @@ namespace chocolatey.infrastructure.powershell
     using System.Security;
     using System.Text;
     using app.configuration;
+    using commandline;
     using logging;
     using Console = adapters.Console;
 
@@ -267,35 +268,7 @@ public override PSCredential PromptForCredential(string caption, string message,
 
             var password = string.Empty;
             this.Log().Warn("Please provide password:");
-            var possibleNonInteractive = !_configuration.PromptForConfirmation;
-            ConsoleKeyInfo info = possibleNonInteractive ? Console.ReadKey(TIMEOUT_IN_SECONDS * 1000) : Console.ReadKey(true);
-            while (info.Key != ConsoleKey.Enter)
-            {
-                if (info.Key != ConsoleKey.Backspace)
-                {
-                    Console.Write("*");
-                    password += info.KeyChar;
-                    info = possibleNonInteractive ? Console.ReadKey(TIMEOUT_IN_SECONDS * 1000) : Console.ReadKey(true);
-                }
-                else if (info.Key == ConsoleKey.Backspace)
-                {
-                    if (!string.IsNullOrEmpty(password))
-                    {
-                        password = password.Substring(0, password.Length - 1);
-                        // get the location of the cursor
-                        int pos = System.Console.CursorLeft;
-                        // move the cursor to the left by one character
-                        System.Console.SetCursorPosition(pos - 1, System.Console.CursorTop);
-                        // replace it with space
-                        Console.Write(" ");
-                        // move the cursor to the left by one character again
-                        System.Console.SetCursorPosition(pos - 1, System.Console.CursorTop);
-                    }
-                    info = possibleNonInteractive ? Console.ReadKey(TIMEOUT_IN_SECONDS * 1000) : Console.ReadKey(true);
-                }
-            }
-            for (int i = 0; i < password.Length; i++) Console.Write("*");
-            System.Console.WriteLine("");
+            password = InteractivePrompt.get_password(_configuration.PromptForConfirmation);
 
             if (string.IsNullOrWhiteSpace(userName) || string.IsNullOrWhiteSpace(password))
             {