#3626 - Password input with show password button

By Chris Graham
Added 7th Jun 2018, 11:49 AM
4 views

Identifier	#3626
Issue type	Feature request or suggestion
Title	Password input with show password button
Status	Open
Tags	Roadmap: Over the horizon (custom) Type: Security (custom)
Handling member	Deleted
Addon	core_form_interfaces
Description	Have a new $value parameter to form_input_password. If not null, it will put a 'show password' button next to it. Currently we don't use password inputs for passwords in configuration, because you may legitimately want to see the value when checking your configuration. All these would need moving over to using form_input_password (including password inputs in modules like admin_cns_forums, and actual configuration options, including config options for secret keys).
Steps to reproduce
Additional information	Using a password field with a default value is not secure - it can easily be revealed by a little JS or looking at the HTML source. However, it is 'secure' against someone looking over your shoulder or watching a webcast or watching a prerecorded video (where the field was not blurred).
Funded?	No

The system will post a comment when this issue is modified (e.g., status changes). To be notified of this, click "Enable comment notifications".

Rating

Unrated

Comments

By Guest posted 7th Jun 2018, 12:08 PM

We could also consider a setting and/or privilege on whether to pass through existing passwords at all, and instead only allow them to be changed. This would require more work though.

By Guest posted 9th Jul 2020, 1:00 PM

Actually the show/hide button should be there even when there's no default password. It's an accessibility feature for those who are not confident in their typing.

However, as a stopgap, browser extensions do exist:
https://addons.mozilla.org/en-US/firefox/addon/show-me-the-passsword/?src=recommended
https://chrome.google.com/webstore/detail/show-and-hide-passwords/panhbjhhhpldcicghpekhonnmfnpgibd

By Guest posted 19th Sep 2022, 9:43 PM

Note you need to put spellcheck="false" on any field that is converted from type="password" to type="text", as there is a security concern:
https://it.slashdot.org/story/22/09/19/2133252/microsoft-edge-google-chrome-enhanced-spellcheck-feature-exposes-passwords?utm_source=rss1.0mainlinkanon&utm_medium=feed

By Guest posted 24th Oct 2022, 1:02 PM

We also need to consider hybridauth.xml, which is a config file which can contain raw keys in. I think anywhere a key can be defined should support Tempcode, so you could do {$VALUE_OPTION,facebook_private_key) for example, and then set that in Commandr:
:set_value('facebook_private_key', 'abcdef');

EDIT: This is now implemented using the new keys.csv importing mechanism from admin_config.

#3626 - Password input with show password button

Rating

Comments

Statistics