pam/rpassword: Handle VWERASE (e.g. Ctrl+W) by clearing the field

[3v1n0]

In case Ctrl+W is used in the password field, it would be unsafe to
clear the password words as it may reveal password information, but
rather we want to clear the field fully.

Closes: #1596

[bjorn3]

og-sudo doesn't support ctrl-w at all afaict: https://github.com/sudo-project/sudo/blob/a9859d3d91a0c7845b0e9e846210462921a0dd7a/src/tgetpass.c#L425-L452 I modeled the editing functionality of read_unbuffered after this og-sudo code.

[3v1n0]

og-sudo doesn't support ctrl-w at all afaict: https://github.com/sudo-project/sudo/blob/a9859d3d91a0c7845b0e9e846210462921a0dd7a/src/tgetpass.c#L425-L452 I modeled the editing functionality of read_unbuffered after this og-sudo code.

Yeah, well I think it worked in some older versions, but still we are already quite different in the password handling (as per showing chars by default) that I think we should not be particularly be 1:1 here.

What I was wondering is to enable VWERASE only in case the only in Hidden::No case.

[bjorn3]

Yeah, well I think it worked in some older versions

With pwfeedback disabled it probably worked as that kept delegating line editing to the kernel, but with pwfeedback enabled it shouldn't have worked. And with the current main of og-sudo it shouldn't work with pwfeedback disabled either.