2 files changed, 14 insertions, 11 deletions

diff --git a/ChangeLog b/ChangeLog
index 9304075ba..ccff55763 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,6 +1,6 @@
 20020125
- - (djm) Don't grab Xserver by default. x11-ssh-askpass doesn't and grabbing
-   can cause deadlocks with kinput2
+ - (djm) Don't grab Xserver or pointer by default. x11-ssh-askpass doesn't 
+   and grabbing can cause deadlocks with kinput2. 
 
 20020124
  - (stevesk) Makefile.in: bug #61; delete commented line for now.
@@ -7394,4 +7394,4 @@
  - Wrote replacements for strlcpy and mkdtemp
  - Released 1.0pre1
 
-$Id: ChangeLog,v 1.1795 2002/01/24 13:46:04 djm Exp $
+$Id: ChangeLog,v 1.1796 2002/01/24 13:59:25 djm Exp $
diff --git a/contrib/gnome-ssh-askpass.c b/contrib/gnome-ssh-askpass.c
index 949b80781..7cece5620 100644
--- a/contrib/gnome-ssh-askpass.c
+++ b/contrib/gnome-ssh-askpass.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2000-2001 Damien Miller.  All rights reserved.
+ * Copyright (c) 2000-2002 Damien Miller.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -27,10 +27,11 @@
  * environment variable SSH_ASKPASS to point to the location of 
  * gnome-ssh-askpass before calling "ssh-add < /dev/null". 
  *
- * There is only one run-time option: if you set the environment variable
+ * There is only two run-time options: if you set the environment variable
  * "GNOME_SSH_ASKPASS_GRAB_SERVER=true" then gnome-ssh-askpass will grab
- * the X server. This may have some benefit to security if you don't trust
-  * your X server. We grab the keyboard and pointer anyway.
+ * the X server. If you set "GNOME_SSH_ASKPASS_GRAB_POINTER=true", then the 
+ * pointer will be grabbed too. These may have some benefit to security if 
+ * you don't trust your X server. We grab the keyboard always.
  */
 
 /*
@@ -68,10 +69,11 @@ passphrase_dialog(char *message)
 {
         char *passphrase;
         char **messages;
-        int result, i, grab_server;
+        int result, i, grab_server, grab_pointer;
         GtkWidget *dialog, *entry, *label;
 
         grab_server = (getenv("GNOME_SSH_ASKPASS_GRAB_SERVER") != NULL);
+        grab_pointer = (getenv("GNOME_SSH_ASKPASS_GRAB_POINTER") != NULL);
 
         dialog = gnome_dialog_new("OpenSSH", GNOME_STOCK_BUTTON_OK,
             GNOME_STOCK_BUTTON_CANCEL, NULL);
@@ -103,8 +105,8 @@ passphrase_dialog(char *message)
         /* Grab focus */
         if (grab_server)
                 XGrabServer(GDK_DISPLAY());
-        if (gdk_pointer_grab(dialog->window, TRUE, 0, NULL, NULL, 
-            GDK_CURRENT_TIME))
+        if (grab_pointer && gdk_pointer_grab(dialog->window, TRUE, 0, 
+            NULL, NULL, GDK_CURRENT_TIME))
                 goto nograb;
         if (gdk_keyboard_grab(dialog->window, FALSE, GDK_CURRENT_TIME))
                 goto nograbkb;
@@ -118,7 +120,8 @@ passphrase_dialog(char *message)
         /* Ungrab */
         if (grab_server)
                 XUngrabServer(GDK_DISPLAY());
-        gdk_pointer_ungrab(GDK_CURRENT_TIME);
+        if (grab_pointer)
+                gdk_pointer_ungrab(GDK_CURRENT_TIME);
         gdk_keyboard_ungrab(GDK_CURRENT_TIME);
         gdk_flush();