42517 - Password dialog for PSM shouldn't offer to save

Status: VERIFIED DUPLICATE of bug 41390

(SeaMonkey :: Passwords & Permissions, defect, P3)

Description

[Terry Hayes]

The PSM glue code uses a standard nsIPrompt interface implementation to prompt
for the password to unlock security tokens.  This dialog normally allows the
password to be saved, which is a useful feature in other parts of the product.
However, PSM passwords should never be saved, both for security reasons, and
because PSM is itself used to securely save passwords.

Comment 1

[sairuh (rarely reading bugmail)]

junruh's the qa contact for psm...

Comment 2

[Stephen P. Morse]

No, I agree they shouldn't.  This is a consequence of some restructuring that 
warren did for the dialogs.  It is related to (but not the same as) bug 41390.

However, you can easily work around it by calling common dialogs directly.  See 
the way I do it in singsign.cpp.  Specifically, look at the code in 
SINGSIGN_PromptPassword for the case when the pref is not enabled.  
Alternatively, look at the code in si_CheckGetPassword and how it calls 
UniversalDialog to do this.

So since there's a work-around for you case, I'm marking this as invalid.  
Hopefully the fix for 41390 will fix it for the general case.

Comment 3

[Warren Harris]

No, don't do that. Common dialogs is going away.

Comment 4

[Terry Hayes]

So what would you suggest.  I tried changing the "persist" parameter to
PromptPassword to PR_FALSE, but that doesn't seem to have any effect.  Is there
a way to get the nsIPrompt interface to do what I want?

Comment 5

[Stephen P. Morse]

There will be soon.  See the latest comments in bug 41390.  In fact, with the 
solution that warren is leaning towards in that bug report, it's now clear that 
this bug is a dup of that one.

*** This bug has been marked as a duplicate of 41390 ***

Comment 6

[John Unruh]

Verified.