This problem was patched here today:
https://github.com/web2py/web2py/commit/5364193759f266e0c07128de2a7b6b54a82ef736


On Wed, Aug 27, 2014 at 10:40 AM, Willoughby <neil.erik...@gmail.com> wrote:

> It got posted to the developer list yesterday, so it would seem at least
> some of the maintainers think it's an issue worth discussion.
>
>
> On Wednesday, August 27, 2014 1:11:57 PM UTC-4, Mark Li wrote:
>>
>> Under the Net tab in Firebug, the Post contains the submitted variables,
>> and the response tab is the HTML of the returned page. This response
>> contains the password input value in plain text.
>>
>> If I submitted the password as "asdf" and submitted the registration form
>> with failures, the response will contain this (as shown in the net tab):
>> <input class="password" id="auth_user_password" name="password" type=
>> "password" value="asdf" />
>>
>> Does no one else experience this behavior?
>>
>> On Tuesday, August 26, 2014 11:08:14 AM UTC-7, Willoughby wrote:
>>>
>>> Using the same Firebug, look at the Net tab - look at your post and the
>>> response.
>>>
>>>
>>> On Tuesday, August 26, 2014 1:32:14 PM UTC-4, Mark Li wrote:
>>>>
>>>> Looking at the password input through Firebug/developer tools, and the
>>>> value of the password input is the plaintext of the password I entered.
>>>>
>>>> I have a test site here: http://tedlee.pythonanywhere.
>>>> com/welcome/default/user/register
>>>>
>>>> Typing in a password and failing registration will return that
>>>> password. Is this just the behavior of a modern browser (to remember failed
>>>> inputs), or is it web2py form handling?
>>>>
>>>> In the case that web2py did only return asterisks, wouldn't that be
>>>> very misleading to the user? Because the password input is masked, they
>>>> would assume that the returned password value (after registration failure)
>>>> was what they previously had typed, not a password replaced with asterisks.
>>>> Thus on re-submitting the form, they would not think to alter the password
>>>> and would just submit a password with asterisks.
>>>>
>>>> On Monday, August 25, 2014 3:25:44 PM UTC-7, Derek wrote:
>>>>>
>>>>> Have you actually looked at it? I believe it just returns asterisks.
>>>>>
>>>>> On Monday, August 25, 2014 3:02:49 PM UTC-7, Mark Li wrote:
>>>>>>
>>>>>> I am currently looking into whether or not password fields should be
>>>>>> cleared on registration error after the form fails server-side 
>>>>>> validation.
>>>>>> At the moment, web2py shows the password after a registration error,
>>>>>> instead of leaving it blank. While this may make editing the password
>>>>>> easier (in case there are pw errors), it seems to pose a security risk
>>>>>> because you are sending the password back to the client in plain text. To
>>>>>> my understanding, this would allow the page to be cached with the
>>>>>> password's value in plain text.
>>>>>>
>>>>>> I tested this on a variety of browsers and systems, so to the best of
>>>>>> my knowledge this is behavior is not unique to a browser.
>>>>>>
>>>>>> Does this pose a reasonable security risk?
>>>>>>
>>>>>> Some reference links:
>>>>>> http://ux.stackexchange.com/questions/39999/why-do-most-
>>>>>> create-account-forms-clear-the-password-fields-upon-wrong-validation
>>>>>> http://ux.stackexchange.com/questions/20418/when-form-
>>>>>> submission-fails-password-field-gets-blanked-why-is-that-the-case
>>>>>>
>>>>>  --
> Resources:
> - http://web2py.com
> - http://web2py.com/book (Documentation)
> - http://github.com/web2py/web2py (Source code)
> - https://code.google.com/p/web2py/issues/list (Report Issues)
> ---
> You received this message because you are subscribed to a topic in the
> Google Groups "web2py-users" group.
> To unsubscribe from this topic, visit
> https://groups.google.com/d/topic/web2py/5zmTyjSlr5E/unsubscribe.
> To unsubscribe from this group and all its topics, send an email to
> web2py+unsubscr...@googlegroups.com.
> For more options, visit https://groups.google.com/d/optout.
>

-- 
Resources:
- http://web2py.com
- http://web2py.com/book (Documentation)
- http://github.com/web2py/web2py (Source code)
- https://code.google.com/p/web2py/issues/list (Report Issues)
--- 
You received this message because you are subscribed to the Google Groups 
"web2py-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to web2py+unsubscr...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

Reply via email to