GNOME Bugzilla – Bug 619058
gnome-screensaver should disable input method in password entry
Last modified: 2013-02-04 06:46:44 UTC
Currently gnome-screensaver enables input method in invisible gtk-entry. input method needs to be disabled on password because input method shows preedit text and breaks the security issue. Setting "gtk-im-context-simple" im module can fix this issue. I'm attaching the patch.
Created attachment 161408 [details] [review] Patch for gnome-screensaver gs-lock-plug.c Attached the patch.
Created attachment 174657 [details] [review] Patch for gnome-screensaver gs-lock-plug.c Revised the patch. Could you review the patch?
Created attachment 174658 [details] [review] Patch for gnome-screensaver gs-lock-plug.c Typo is fixed.
what if the user needs the input method to enter their password?
(In reply to comment #4) > what if the user needs the input method to enter their password? Currently I don't see such a request and we have used ASCII password. The problem is, when the text visibility is FALSE, the text is invisible but input-method lookup window is visible. e.g. Password: [* ] |1. à| |2. á| |3. â| |4. ã| +----+ It would become a security issue. You might think it would be good to set invisible for input-method's lookup. But probably I think it's not useful, e.g. [1. *, 2. *, 3. *, 4. *]. In the current GTK+ implementation, when GtkEntry visibility is set FALSE, GtkIMContext doesn't receive any info. So I think it's a bit complicated and another story for password entry to support input method. On the other hand, you know that password entry can work with XKB so you still can switch the keyboard layouts in password and put your characters. I also think the actual typed chars are not important for users because the chars are not visible and probably I think the key sequence needs to be passed in either input-method on or off. I think the password is determined by keyboard layout and key sequence.
Comment on attachment 174658 [details] [review] Patch for gnome-screensaver gs-lock-plug.c Honestly, this patch doesn't seem right to me. If it's a problem for gnome-screensaver, it's a problem for all gtk entries that have visibility turned off.
Reassigning...