Add safe password handling to restore function

Author: mrrfv

functions/backup_func.sh

@@ -175,20 +175,7 @@ backup_contacts: $backup_contacts
     # -bb3: verbose logging
     # The undefined variable (archive_password) is set by the user if they're using unattended mode
     if [ -z "$archive_password" ]; then
-      while true; do
-        cecho "Enter a password to encrypt the backup archive (input will be hidden):"
-        IFS= read -s archive_password
-        echo
-        cecho "Re-enter the password to confirm:"
-        IFS= read -s archive_password_confirm
-        echo
-        if [ "$archive_password" = "$archive_password_confirm" ]; then
-          unset archive_password_confirm
-          break
-        else
-          cecho "Passwords do not match. Please try again."
-        fi
-      done
+      get_password_input "Enter a password to encrypt the backup archive (input will be hidden):" archive_password
     fi
     declare backup_archive="$archive_path/open-android-backup-$(date +%m-%d-%Y-%H-%M-%S).7z"
     retry 5 7z a -p -mhe=on -mx=$compression_level -bb3 "$backup_archive" backup-tmp/* < <(echo "$archive_password")

functions/helper.sh

@@ -231,4 +231,26 @@ function directory_ok() {
     fi
     return 0
 }
-# ---
+
+# Prompts the user to enter and confirm a password
+# Usage: get_password_input <prompt_message> <result_variable>
+function get_password_input() {
+  local prompt_message="$1"
+  local -n password_ref="$2"  # Use nameref for indirect assignment
+
+  while true; do
+    cecho "$prompt_message"
+    IFS= read -s password_input
+    echo
+    cecho "Re-enter the password to confirm:"
+    IFS= read -s password_confirm
+    echo
+    if [ "$password_input" = "$password_confirm" ]; then
+      password_ref="$password_input"
+      unset password_confirm
+      break
+    else
+      cecho "Passwords do not match. Please try again."
+    fi
+  done
+}

functions/restore_func.sh

@@ -44,7 +44,12 @@ function restore_func() {
   fi
 
   cecho "Extracting archive."
-  7z x "$archive_path" # -obackup-tmp isn't needed
+  # Archive is encrypted, ask for password
+  get_password_input "Enter the password to decrypt the backup archive (input will be hidden):" archive_password
+  # Extract with password
+  7z x "$archive_path" < <(echo "$archive_password")
+  # Clear sensitive data
+  unset archive_password
 
   # Check if directories are empty
   apps_empty=$(find ./backup-tmp/Apps -mindepth 1 | read -r && echo "no" || echo "yes")