2 files changed, 3 insertions, 0 deletions
diff --git a/NEWS b/NEWS
index bcea2097..1559a766 100644
--- a/NEWS
+++ b/NEWS
@@ -4,6 +4,8 @@
 
 * The `localhost' special case of `via' is gone.  Use `plugin %h' for talking
   to ssh instead.
+* Prevent POP3 code from authenticating multiple times on success.
+* Fixed IMAP password shrouding.
 * GCC warning cleanups from ahaas@neosoft.com.
 * Plug another hole that was letting zombies through.
 * SA_RESDTART portability fix for SunOS.
diff --git a/imap.c b/imap.c
index 3dce0a8d..73a68d31 100644
--- a/imap.c
+++ b/imap.c
@@ -414,6 +414,7 @@ static int imap_getauth(int sock, struct query *ctl, char *greeting)
 	imap_canonicalize(remotename, ctl->remotename, NAMELEN);
 	imap_canonicalize(password, ctl->password, PASSWORDLEN);
 
+	strcpy(shroud, ctl->password);
 	ok = gen_transact(sock, "LOGIN \"%s\" \"%s\"", remotename, password);
 	shroud[0] = '\0';
 	if (ok)