"Name" in the template file could be interpreted as either the
name of the account itself, or of the (person's) name in the
template.  The result of this confusion is that editing the
Name in the SSN template didn't work; it would be assigned
to account fullname instead (which we later throw away when
editing secure notes).

Use line-number to disambiguate the case: account name should
always be on the first line, everything thereafter is part of
a note.

Also move the strdup to where it is used so the lifetime of the
string copy is clearer.

Signed-off-by: Bob Copeland <copeland@lastpass.com>

Signed-off-by: Filippo Cucchetto filippocucchetto@gmail.com

Signed-off-by: Filippo Cucchetto filippocucchetto@gmail.com

Signed-off-by: Filippo Cucchetto filippocucchetto@gmail.com

A user reported that using Server secure note type resulted
in some odd stuff showing up in the plugin vault.  This note
type has a "Username" and "Password" field, but we already
use that to map to account->username and account->password.

When collapsing, the contents of those fields gets copied
back into the note, along with any fields in the fields list.
Unfortunately, we *also* copied in the empty duplicate
Username/Password fields from the fields, resulting in a
note with extra fields that confused the plugin.

Fix this by not creating the duplicate fields in the fields
list in the first place; then only the version in the account
will get copied into the note.

Signed-off-by: Bob Copeland <copeland@lastpass.com>

Similarly to account_is_group, add a function that documents the
special url format denoting secure note types rather than open-coding
the comparison.

Signed-off-by: Bob Copeland <copeland@lastpass.com>

It was reported that editing a secure note to rename it doesn't work,
while it does work for accounts.  The reason is we only apply name
changes only if the user had specified `--name`.  But this is a
historical limitation, e.g. when using the "any" edit type it makes
sense to retain username edits, so just do it always since we
always have a copy of the original account name in any case.

Fixes lastpass#106.

Signed-off-by: Bob Copeland <copeland@lastpass.com>

I stumbled across a segfault doing 'lpass ls -l' -- it's possible for
an account not to have an mtime at all, so don't crash in this case.

Signed-off-by: Bob Copeland <copeland@lastpass.com>

There is more than one implementation now for a simple string
buffer object (string + allocated size + used length), so
standardize on the implementation in blob.c.

Add append_char (used by import) and append_str (to be used later)
to round out the common operations we will need.

This also fixes an off-by-one in append_char.

Signed-off-by: Bob Copeland <copeland@lastpass.com>

We occasionally get requests to add new fields to ls output
or somehow customize what stuff gets shown to make things
better for humans or for screen scrapers.

Rather than trying to accomodate everyone's use case, add
a new format library like printf, so that you can (eventually)
do things like

    ./lpass ls --format='%N %i %u'

or
    ./lpass show --format='%fN'

...or whatever.  I haven't really settled on the right format
strings to use so this is still a WIP, but currently it can
handle generating the existing (non-color) ls format.

Signed-off-by: Bob Copeland <copeland@lastpass.com>

The format string only needs to be created once instead of in
a loop, and using xasprintf simplifies things a bit, so do that.

Signed-off-by: Bob Copeland <copeland@lastpass.com>

This drops a bit of code duplication by using the same format
string for both color-less and tree mode output.  The only
difference in the format string between the two is whether the
fullname or short acpcount name is used; we can go ahead and
embed the terminal color codes which will simply get stripped
in terminal_printf.

Signed-off-by: Bob Copeland <copeland@lastpass.com>

This adds the ability to supply a custom format string to ls.
This might be useful for certain scripting tasks; e.g. you can
save a sed/awk pipeline when grabbing an id by doing:

    lpass ls --format=%i account-name

Signed-off-by: Bob Copeland <copeland@lastpass.com>

This adds some infrastructure useful for cmd-show:

 - You can use '/' after % to include a slash only if the expansion
   of the rest of the placeholder is non-empty
 - group and shared folder name gained their own placeholders

Thus showing a path-like representation of a name can be done
like "%/S%/g%Nf".

Also, format_field function was added which formats a name/value pair
("%fn", "%fv" resp.).  It also takes an account so that it can format
any of the existing account fields as needed.

Signed-off-by: Bob Copeland <copeland@lastpass.com>

This adds the ability to specify the field format used with command-show
using "--format", and the title format with "--title-format".

Just as a fairly contrived example, you can get almost-json like this:

echo "{"; \
./lpass show --title-format='    "title": "%/S%/g%Ns",' \
    --format='    "%fn": "%fv",' foo; \
echo "}"

Signed-off-by: Bob Copeland <copeland@lastpass.com>

Group the placeholders by type of object being printed (so "%aX" for
account).  This reduces pollution of the top-level namespace a bit
so that we can use more natural characters.

Signed-off-by: Bob Copeland <copeland@lastpass.com>

This uses the new format string infrastructure to display
just fieldnames in a subshell so that the fields in a specific
account can be tab-completed.  In order for lpass to know which
account is being queried, you have to specify account name first,
like:

    lpass show foo --field [tab]

There's a slight annoyance that title cannot go away completely,
so post-process with egrep to drop those.

Signed-off-by: Bob Copeland <copeland@lastpass.com>

$(wildcard) does not guarantee a sorted list, which causes
also a non-deterministic order while linking the binary.
To support reproducible building, the list is explicitely sorted.

Signed-off-by: Reiner Herrmann <reiner@reiner-h.de>

Sort list of source files

Builds with CMake would link against the wrong (apple-supplied)
version of openssl; make sure we use the one installed by brew.

Pass -DOPENSSL_INCLUDE_DIR to use something else.

Signed-off-by: Bob Copeland <copeland@lastpass.com>

Add the install-doc target to install the manpage which was present
in the original Makefile but missing here.

Signed-off-by: Bob Copeland <copeland@lastpass.com>

"cmake ." in order to get a Makefile for make.

Signed-off-by: Bob Copeland <copeland@lastpass.com>

Signed-off-by: Bob Copeland <copeland@lastpass.com>

This is needed on some Linux platforms for error-free build.

Signed-off-by: Bob Copeland <copeland@lastpass.com>

If we can determine the destination directory, install
bash completions file.

Signed-off-by: Bob Copeland <copeland@lastpass.com>

CMake complains when building in cygwin unless you tell it
whether or not your project needs win32.  So tell it.

Signed-off-by: Bob Copeland <copeland@lastpass.com>

Signed-off-by: Bob Copeland <copeland@lastpass.com>

Signed-off-by: Bob Copeland <copeland@lastpass.com>

For some use cases we may need to ask the user for one of several
options, not just yes or no.  Add a function that implements this,
taking the charset of options as a string and returning the selected
option.

Rewrite ask_yes_no to use the new function.

Signed-off-by: Bob Copeland <copeland@lastpass.com>

This change adds the ability to retrieve attachments for secure notes.
The `lpass show` command now shows attachment ids and filenames if
a secure note has attachments.  The attachment id can then be passed
to `lpass show acct --attach=attachid` which will either print the
attachment (if non-binary) or offer the ability to save.

Signed-off-by: Bob Copeland <copeland@lastpass.com>

In OpenSSL 1.1+, EVP_CIPHER_CTX can no longer be declared on
the stack; instead you have to declare a pointer and then
use _new()/_free() to allocate or free it.  These functions
continue to work on older OpenSSL, so switch to the new
method.

Signed-off-by: Bob Copeland <copeland@lastpass.com>

struct pkcs8_priv_key_info_st is now opaque as of OpenSSL 1.1
so we cannot look directly at its flags going forward.

./cipher.c: In function ‘cipher_rsa_decrypt’: ./cipher.c:73:11: error: dereferencing pointer to incomplete type ‘PKCS8_PRIV_KEY_INFO {aka struct
pkcs8_priv_key_info_st}’
  if (p8inf->broken)
           ^

Signed-off-by: Bob Copeland <copeland@lastpass.com>

In OpenSSL 1.1, HMAC_CTX is now opaque and _init/_cleanup functions
are history.  Change the pbkdf2 implementation to conditionally
use HMAX_CTX_new()/_free() and use context pointers throughout.

Signed-off-by: Bob Copeland <copeland@lastpass.com>

- The GNUInstallDirs package, unlike the builtin install() macro,
  doesn't handle DESTDIR for you. So specify DESTDIR by hand, wherever
  applicable.
- Specify the correct path of the manpage to install.
- Don't require the HTML doc to be built as a prerequisite of installing
  the manpage.
- Make targets "more correct", add uninstall target.

We would like to clean up the overly tortuous layer of indirection over
pkg-config, but on systems with ancient versions of CMake (i.e. Debian
stable) pkg_get_variable simply doesn't exist.

Signed-off-by: Eli Schwartz <eschwartz93@gmail.com>

CMakeLists.txt: Fix system installation

This variable doesn't exist on all installations, so don't
try to install it if not defined.

Signed-off-by: Bob Copeland <copeland@lastpass.com>

Build for OSX was failing in travis due to existing cmake.

Signed-off-by: Bob Copeland <copeland@lastpass.com>

Travis doesn't like the '||:' syntax; use '|| true' instead.

Signed-off-by: Bob Copeland <copeland@lastpass.com>

When undoing the newline conversion of ascii armor keys, don't
convert embedded spaces that follow a colon.  These signify headers
and are used in encrypted private keys.

Signed-off-by: Bob Copeland <copeland@lastpass.com>

This normalizes build to happen in build subdirectory so that
existing source tree doesn't get polluted by build artifacts.

The main targets are replicated in the top-level makefile so
that most existing build setups should mostly continue to work,
though the output files will now end up in the build/ directory.

Of course doing 'cmake . && make' will continue to put the
build artifacts in the top-level directory if someone wants
that.

Signed-off-by: Bob Copeland <copeland@lastpass.com>

This reinstates the default of /usr for the installation
directory prefix, and adds the build/xxx path for manpages,
so that the debian package works again.

Signed-off-by: Bob Copeland <copeland@lastpass.com>

Fixes lastpass#226.

Signed-off-by: Bob Copeland <copeland@lastpass.com>

Signed-off-by: Bob Copeland <copeland@lastpass.com>

This adds the (read-only) attachment functionality to lpass.

Signed-off-by: Bob Copeland <copeland@lastpass.com>

Signed-off-by: Bob Copeland <copeland@lastpass.com>

This lets 'make MANDIR=x install-doc" work as expected.

Signed-off-by: Bob Copeland <copeland@lastpass.com>

OSX doesn't support install -D; do it in two steps.

Signed-off-by: Bob Copeland <copeland@lastpass.com>

This updates (some of) the debian directory to match that
of the downstream debian package so that packages built
directly from source with dpkg-buildpackage more closely
match the ones provided from the distribution.  Set version
to 1.1.0 to match upcoming release.

Signed-off-by: Bob Copeland <copeland@lastpass.com>

Signed-off-by: Bob Copeland <copeland@lastpass.com>

Fix undefined reference to `HMAC_CTX_new' and `HMAC_CTX_free' when using
LibreSSL instead of OpenSSL.

Signed-off-by: Björn Ketelaars <bjorn.ketelaars@hydroxide.nl>

a971ec2 removed part of the support for
OpenBSD. Re-add -lkvm to LDLIBS (if lastpass-cli is compiled on
OpenBSD).

Signed-off-by: Björn Ketelaars <bjorn.ketelaars@hydroxide.nl>

Fix compiling when using LibreSSL

Fix support for OpenBSD

Display fullname differs from account name when there is no group;
in this case (none) is prepended to the account, but we sort as
if it isn't there, leading to mixed up sorting.

Signed-off-by: Bob Copeland <copeland@lastpass.com>

vinceatbluelabs reported a segfault due to the new attachments
code -- if attachment key is unspecified (like it is for most
notes) then expansion will fail.  I had intended to make this
field always present like id, name, etc but left that part out.

Also free these fields when the account is freed.

Fixes lastpass#241.

Signed-off-by: Bob Copeland <copeland@lastpass.com>

Signed-off-by: Bob Copeland <copeland@lastpass.com>

Signed-off-by: Bob Copeland <copeland@lastpass.com>

vinceatbluelabs on github reports a segfault with lpass logout
--color=never due to unsigned overflow when len < 2.  Fix this
by checking first that len is at least two characters long before
trying to strip out any escape characters.

Signed-off-by: Bob Copeland <copeland@lastpass.com>

lpass add was failling in secure notes due to attachment
keys being uninitialized.  Fix by setting these where other
fields are initialized.

Signed-off-by: Bob Copeland <copeland@lastpass.com>

ls: sort by display fullname

Add documentation for --fixed-strings, --basic-regexp, --expand multi.

Signed-off-by: Eric B. Hymowitz <eric_b_hymowitz@yahoo.com>
[copeland@lastpass.com: fixed up commitlog]
Signed-off-by: Bob Copeland <copeland@lastpass.com>

Add documentation for the alias feature.

Signed-off-by: Eric B. Hymowitz <eric_b_hymowitz@yahoo.com>
[copeland@lastpass.com: fixed up commitlog]
Signed-off-by: Bob Copeland <copeland@lastpass.com>

Simplify the aliases documentation a bit by showing echo
commands to create the necessary files.

As the configuration directory is not necessarily in
$LPASS_HOME, add a reference to the previous section,
and use ~/.config/lpass in the examples since that is
where it is typically found on Linux.

Signed-off-by: Bob Copeland <copeland@lastpass.com>

This adds a new executable target, lpass-test, which
returns canned responses for http requests.  With
suitable mocked responses, we can use this to do
testing without an external server.

Signed-off-by: Bob Copeland <copeland@lastpass.com>

This adds a bash-driven test infrastructure that uses the lpass-test
binary to do some simple tests of login, add, edit, show, duplicate,
and generate.  All commands disable syncing and either operate on the
local blob records (of added accounts) or the accounts that are
returned in the mock getaccts function.

Signed-off-by: Bob Copeland <copeland@lastpass.com>

When using the normal build/ build directory, everything under
there can be removed on a clean build and regenerated.  Failure
to clean up all of this was causing some issues in package
builds.

Signed-off-by: Bob Copeland <copeland@lastpass.com>

These are needed for the build now.  Reported by Knut Ahlers.

Signed-off-by: Bob Copeland <copeland@lastpass.com>

Signed-off-by: Bob Copeland <copeland@lastpass.com>

Signed-off-by: Bob Copeland <copeland@lastpass.com>

Signed-off-by: Bob Copeland <copeland@lastpass.com>

This creates a 'make test' target in toplevel makefile, and also
excludes lpass-test from being built as part of "make all".

Signed-off-by: Bob Copeland <copeland@lastpass.com>

A lot of these functions are only used in libcurl, so we should
leave them out of the test builds.

Signed-off-by: Bob Copeland <copeland@lastpass.com>

Signed-off-by: Bob Copeland <copeland@lastpass.com>

Signed-off-by: Bob Copeland <copeland@lastpass.com>

User has reported an issue in this area and we did
have a bug here once, so add another test just to
make sure this works.

Signed-off-by: Bob Copeland <copeland@lastpass.com>

There's a certain amount of confusion by the fact that lpass insists
on forcing the Shared-XXX filename convention, so users can't find
the shared folder they just created.  Make it a little more obvious
by telling the folder name that was ultimately created.

Signed-off-by: Bob Copeland <copeland@lastpass.com>

Currently only folders with something in them get shown.
For regular folders, there is the concept of the 'group'
type account which can be used to represent an empty folder,
so these can be displayed in `lpass ls`.  For shared folders,
though, there is not such an account type.

But we know all the shared folders as they are added to a list
in the blob, so we can create a fake group account just for
displaying inside `lpass ls`.

Signed-off-by: Bob Copeland <copeland@lastpass.com>

I plan to add editing of reprompt status, and it would be helpful
to see it in the 'show' command to see if it is currently enabled
or not.  Since the vast majority of sites are unlikely to have
reprompt enabled, only show it if set to true, to avoid adding too
much noise.

Signed-off-by: Bob Copeland <copeland@lastpass.com>

Although we track it and now show it, there is no way for a user
using the CLI to modify the reprompt setting for a site.  This
change adds a new line into the edit buffer for accounts if the
reprompt setting is set to true, like so:

    [...]
    Reprompt: Yes

If reprompt is not true (vast majority of cases), we just leave it
out.  If the value is changed to anything other than Yes during the
edit session, then reprompt is changed accordingly.  Thus reprompt
can be turned on and off like so:

    echo "Reprompt: Yes" | lpass edit site --non-interactive
    echo "Reprompt: No" | lpass edit site --non-interactive

Add a test to capture this functionality.

Signed-off-by: Bob Copeland <copeland@lastpass.com>

We didn't copy the edited pwprotect back into expanded notes;
fix that.

Signed-off-by: Bob Copeland <copeland@lastpass.com>

Fixes lastpass#283.

Signed-off-by: Kyle Burton <kyle.burton@gmail.com>
Signed-off-by: Bob Copeland <copeland@lastpass.com>

If format_account() wound up not appending any characters at all,
then buf->bytes might still be a null pointer (i.e., only appending
a character causes buf->bytes to get created).  We would then pass
this into terminal_printf again in order to use it for show().

Fix the issues in this area by introducing buffer_init() and using
that in the format cases.  The buffer_init function always allocates
an empty 80-character string in the expectation it will get used.

Signed-off-by: Bob Copeland <copeland@lastpass.com>

cmake -DCMAKE_BUILD_TYPE=Debug .
make
valgrind --log-file=./valgrind.log --leak-check=full ./lpass export --sync=now

Signed-off-by: Kyle Burton <kyle.burton@gmail.com>
Signed-off-by: Bob Copeland <copeland@lastpass.com>

Fix:

/tmp/lastpass-cli/cmd-ls.c:351:29: warning: The left operand of '!=' is a garbage value
/tmp/lastpass-cli/endpoints.c:429:7: warning: Use of memory after it is freed

Reported by @wkoszek on github (lastpass#281).

There were a few false positives caused by the pattern:

    _cleanup_free_ char *reply = NULL;
    reply = get_some_data();

In which the reply is there so it can be freed.  I left these alone.

Signed-off-by: Bob Copeland <copeland@lastpass.com>

The server will reject fields that are too large which will cause
sync to hang.  Add an upper limit.  Fixes lastpass#278.

Reported by deniseyu on github.

Signed-off-by: Bob Copeland <copeland@lastpass.com>

Signed-off-by: Christian Rondeau <christian.rondeau@gmail.com>
[copeland@lastpass.com - squashed two related patches]
Signed-off-by: Bob Copeland <copeland@lastpass.com>

Signed-off-by: Christian Rondeau <christian.rondeau@gmail.com>

Fix a typo in asciidoc instructions

The trust.php call was missing a token which caused
trust updates to be ignored.

Signed-off-by: Bob Copeland <copeland@lastpass.com>

Due to the way LastPass stores multiline fields, this
frequently comes up as a bug report; make a test to
demonstrate how it currently works (notably you have
to remove newlines.)

Signed-off-by: Bob Copeland <copeland@lastpass.com>

The LastPass plugins now support multiline fields (besides Notes)
if the field is part of a known note template.  This has been used
to capture the embedded newlines in ascii-armored private SSH keys
with the ssh-key note type.

Until now lpass only supported ssh keys stored on a single line,
so add the ability to parse these kinds of strings to enable
support for keys created in the newer plugins.

Signed-off-by: Bob Copeland <copeland@lastpass.com>

Ubuntu requires the `build-essential` package for cmake to complete.

Signed-off-by: Craig Menning <cmenning@gmail.com>

Add build-essential to Ubuntu package dependencies

Running `cmake .` on Ubuntu 16.04 gives an error:

```
Could NOT find PkgConfig (missing: PKG_CONFIG_EXECUTABLE)
```

Signed-off-by: Glenn Oppegard <goppegard@pivotal.io>

Include pkg-config in Ubuntu dependencies

Signed-off-by: Christian Rondeau <christian.rondeau@gmail.com>
Note that this code is found as-is in multiple `un.h` implementations.
Source and alternatives for SUN_LEN: https://stackoverflow.com/a/2307539/154480

Add SUN_LEN when not defined (termux)