Item3583: 'configure' password gets saved as 'smtp' password (in plain text!)

Mine is a fresh install of 4.1.1 with some files copied over from the previous (4.0.5) installation

The problem is that the behavior of bin/configure with respect to the admin/configure password is strange (and possibly a security issue).

If I press 'Next' on the bin/configure page without changing any settings and there is sometimes a message:

1 configuration item was changed
{SMTP}{Password}

I then enter the configuration password in the box and press 'Save'. I get a popup message:

'Confirm password change' 
Confirm the user you are changing the password for
   <>
   MyWikiName

The strange thing is I am not attempting to change the password for anybody, I merely clicked on save to save the configuration. So I press 'Ok' selecting <> as the user, and the next page says:

{SMTP}{Password}
$TWiki::cfg{SMTP}{Password} = 'MyAdminPassword';

Now the fact that my admin password is saved in plain text in lib/LocalSite.cfg (as if it were the smtp password) is slightly worrying from a security point of view.

To try to figure out what is going on, I repeat the procedure

• Back to configure
• Press next
• message saying SMTP password changed (I didn't change it)
• enter password
• press 'Save'
  • Confirm password change
  • Confirm the user you are changing the password for
  • ok

• $TWiki::cfg{SMTP}{Password} = ''; 

Is this peculiar to my setup? I can give more details of the configure options and installed packages if needed Thanks , Jon

-- TWiki:Main/JonJackson - 08 Feb 2007

This happens because some browser try to be clever about password input fileds, by remembering the password for them. In fact we use a password field simply to hide the data entry; there is no intent to change anyone's password (stupid browsers). The correct course of action is to simply ignore the popup message (cancel it) and continue as normal.

This a nasty, and we really need to find a fix for it.

CC

-- TWiki:Main.CrawfordCurrie - 09 Feb 2007

simple add

-autocomplete=>'off' to the password field, and bob's you're auntie (ok, this is actually an IE-ism, but seems to help with my current FF, so I think it might be a good fix.)

quick whiparound makes it look like its an IE, gecko(2003) now Web Forms 2.0 thing

comitting it

SD

-- TWiki:Main.SvenDowideit - 09 Mar 2007

Good fix

Remember to put fixed core / default plugin items in Waiting for Release. Otherwise they will not make it to the release note.

KJL