From ff9cbab5fa36fef07f9237dcef073e16b0c72de8 Mon Sep 17 00:00:00 2001
From: n4n5 <56606507+Its-Just-Nans@users.noreply.github.com>
Date: Fri, 25 Jul 2025 12:24:18 +0200
Subject: [PATCH] config: add error if RCLONE_CONFIG_PASS was supplied but
 didn't decrypt config

---
 fs/config/crypt.go | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/fs/config/crypt.go b/fs/config/crypt.go
index 4a68d4159..4b356580c 100644
--- a/fs/config/crypt.go
+++ b/fs/config/crypt.go
@@ -51,6 +51,7 @@ func Decrypt(b io.ReadSeeker) (io.Reader, error) {
 	ctx := context.Background()
 	ci := fs.GetConfig(ctx)
 	var usingPasswordCommand bool
+	var usingEnvPassword bool
 
 	// Find first non-empty line
 	r := bufio.NewReader(b)
@@ -99,15 +100,18 @@ func Decrypt(b io.ReadSeeker) (io.Reader, error) {
 		} else {
 			usingPasswordCommand = false
 
-			envpw := os.Getenv("RCLONE_CONFIG_PASS")
+			envPassword := os.Getenv("RCLONE_CONFIG_PASS")
 
-			if envpw != "" {
-				err := SetConfigPassword(envpw)
+			if envPassword != "" {
+				usingEnvPassword = true
+				err := SetConfigPassword(envPassword)
 				if err != nil {
 					fs.Errorf(nil, "Using RCLONE_CONFIG_PASS returned: %v", err)
 				} else {
 					fs.Debugf(nil, "Using RCLONE_CONFIG_PASS password.")
 				}
+			} else {
+				usingEnvPassword = false
 			}
 		}
 	}
@@ -144,6 +148,9 @@ func Decrypt(b io.ReadSeeker) (io.Reader, error) {
 			if usingPasswordCommand {
 				return nil, errors.New("using --password-command derived password, unable to decrypt configuration")
 			}
+			if usingEnvPassword {
+				return nil, errors.New("using RCLONE_CONFIG_PASS env password, unable to decrypt configuration")
+			}
 			if !ci.AskPassword {
 				return nil, errors.New("unable to decrypt configuration and not allowed to ask for password - set RCLONE_CONFIG_PASS to your configuration password")
 			}