Re: BUG #8438: Usage of Pipe operator in Windows(CMD.exe) shows the password typed with any PG utility.

On Fri, Sep  6, 2013 at 05:35:57AM +0000, raghavendra.rao@enterprisedb.com wrote:
> I have PostgreSQL 9.2 instance on Windows 7 running in MD5 authentication
> mode. Anytime I connect I need to pass the password for connection. When I
> try to connect from command prompt using PIPE ('|") operator; and the
> password I type is visible(shown) instead of hiding it. For example in
> linux, any password typed when prompted will not show it just hides it.
> Which seems not the same in windows. Please look at the example below:
>
>
> 1. Go to command prompt (runas /user:postgres "cmd.exe")
>
>
> 2. Pass the some command using pipe operator to Psql (or any utility).
>
>
> c:\Program Files\PostgreSQL\9.2\bin>echo select version(); | psql -p 5433
> Password: postgres
>
>
>                            version
> -------------------------------------------------------------
>  PostgreSQL 9.2.2, compiled by Visual C++ build 1600, 32-bit
> (1 row)
>
>
> If you see above output, the password I typed as "postgres" is clearly
> visible. I didn't tried to reproduce on any other version of PG or Windows.
> Below are my version details:
>
>
> Operating System: Windows 7 64 bit
> PostgreSQL: PostgreSQL 9.2.2
>
>
> For any further information required, I would be glad to share if its sent
> to my email id: raghavendra.rao@enterprisedb.com.

I checked on our code and this is what we use in simple_prompt() on
Windows to turn off echo:

        /* get a new handle to turn echo off */
        t_orig = (LPDWORD) malloc(sizeof(DWORD));
        t = GetStdHandle(STD_INPUT_HANDLE);

        /* save the old configuration first */
        GetConsoleMode(t, t_orig);

        /* set to the new mode */
        SetConsoleMode(t, ENABLE_LINE_INPUT | ENABLE_PROCESSED_INPUT);

I think the last line is turning off ENABLE_ECHO_INPUT:

    http://msdn.microsoft.com/en-us/library/windows/desktop/ms686033%28v=vs.85%29.aspx

Obviously it isn't working for you.  Does anyone else see the psql typed
password echoed on Windows?

--
  Bruce Momjian  <bruce@momjian.us>        http://momjian.us
  EnterpriseDB                             http://enterprisedb.com

  + Everyone has their own god. +