Project

General

Profile

« Previous | Next » 

Revision 942

Fixed: svn or ldap password can be found in clear text in the html source in editing mode.

View differences:

trunk/app/helpers/repositories_helper.rb
62 62
      content_tag('p', form.text_field(:url, :size => 60, :required => true, :disabled => (repository && !repository.root_url.blank?)) +
63 63
                       '<br />(http://, https://, svn://, file:///)') +
64 64
      content_tag('p', form.text_field(:login, :size => 30)) +
65
      content_tag('p', form.password_field(:password, :size => 30))
65
      content_tag('p', form.password_field(:password, :size => 30, :name => 'ignore',
66
                                           :value => ((repository.new_record? || repository.password.blank?) ? '' : ('x'*15)),
67
                                           :onfocus => "this.value=''; this.name='repository[password]';",
68
                                           :onchange => "this.name='repository[password]';"))
66 69
  end
67 70

  
68 71
  def darcs_field_tags(form, repository)
trunk/app/views/auth_sources/_form.rhtml
15 15
<%= text_field 'auth_source', 'account'  %></p>
16 16

  
17 17
<p><label for="auth_source_account_password"><%=l(:field_password)%></label>
18
<%= password_field 'auth_source', 'account_password'  %></p>
18
<%= password_field 'auth_source', 'account_password', :name => 'ignore',
19
                                           :value => ((@auth_source.new_record? || @auth_source.account_password.blank?) ? '' : ('x'*15)),
20
                                           :onfocus => "this.value=''; this.name='auth_source[account_password]';",
21
                                           :onchange => "this.name='auth_source[account_password]';" %></p>
19 22

  
20 23
<p><label for="auth_source_base_dn"><%=l(:field_base_dn)%> <span class="required">*</span></label>
21 24
<%= text_field 'auth_source', 'base_dn', :size => 60 %></p>

Also available in: Unified diff