Bug #9606

Password input prints value tag with password in clear text.

Details

Request #9606	Password input prints value tag with password in clear text.
Submitted	2006-12-13 19:36 UTC
From	kc at kccloyd dot com
Status	Bogus
Package	HTML_QuickForm
PHP Version	Irrelevant
OS	All
Roadmaps	(Not assigned)

Comments

[2006-12-13 19:36 UTC] kc at kccloyd dot com

Description:
------------
When submitting the 'password' type input element, if the form is displayed a second time, the value attribute of the password field is set to the clear text value of the submitted password. This allows anyone to see what has been entered into the password field by looking at the page source and could be considered a security vulnerability. The element should be changed to behave like a standard input element of type password and not retain its value after submission. This behavior is identical in multiple versions of QuickForm and PHP under both IIS and Apache in Windows and Linux systems.

Test script:
---------------
Problem Code:
require_once 'HTML/QuickForm.php';
$form = new HTML_QuickForm('loginForm');
$form->addElement('header', null, 'Login');
$form->addElement('text', 'username', 'Username:');
$form->addElement('password', 'password', 'Password:');
$form->addElement('submit', null, 'Submit');
$form->addRule('username', 'Please enter a username', 'required', null, 'client');
$form->addRule('password', 'Please enter a password', 'required', null, 'client');
if ($form->validate()) {}
$form->display();

Hotfix - Modify HTML_QuickForm_Input::setValue() as such:
function setValue($value) {
if ($this->_type != 'password') {
$this->updateAttributes(array('value'=>$value));
}
}

Expected result:
----------------
As with a standard HTML form, the password field should be blank and not have a defined value when redisplayed after submitting the form.

Actual result:
--------------
The form adds the value attribute to the password field and sets it to the value of the submitted password, making the password visible in the page source.