Page 1 of 1
Quick Start Wizard - Server Password in Cleartext
Posted: December 1st, 2015, 6:44 pm
by smidley
When setting up sab 0.8 beta 3 using the quickstart wizard, it asks for your usenet server info. When you enter in the username and password, it shows up as clear text for the password. This should be censored out.
Re: Quick Start Wizard - Server Password in Cleartext
Posted: December 2nd, 2015, 2:12 am
by shypike
It should not.
Must be a recently introduced bug.
Re: Quick Start Wizard - Server Password in Cleartext
Posted: December 2nd, 2015, 2:28 am
by smidley
That's what I thought. Consider this my bug report
Re: Quick Start Wizard - Server Password in Cleartext
Posted: December 2nd, 2015, 3:17 am
by safihre
This is done on purpose:
While before password managers of browsers such as Chrome and Firefox would look for fields named Username and Password, now they will ask you to 'Save a password' as soon as they detect a password type field on the screen, whatever we name it.
If the users then in the wizzard let's the browser save their password, later it will very aggressively try to automatically fill that username and password everywhere it thinks there is something to fill. In the case of Sabnzbd, we had cases where this caused the browser to fill the server username and pass for the general Sabnzbd password in the first page of the Config.. Causing people to be locked out of their sabnzbd after hitting save and not noticing that.
Also, it might look censored, but it's only a visual browser trick in case anyone is looking over your shoulder.. Any code can still easily read the field.
So we chose to remove any password type field to avoid accidental fills by browsers or password managers.
In the config you will see passwords being replaced by ********, so it only is visible for those few moments during the wizzard.