Page MenuHomePhabricator

Password repeated in HTML page if login unsucessful
Closed, ResolvedPublic


Author: postmaster


When you try to log in to the Wikipedia web site, if you mistype the password or
the user name than the user name and password is written back.

Thought repeating the password field as well makes us one field less when we
don't type our user name correctly, I think it is a big security problem to put
it in the web page. Perhaps not replying would be the best.

To try:

Go to the Wikipedia login page
Mistype your user name or password (or both)
The page saying "login error" comes. Now right click on the page and say

"view source".

Look for the string "password", and you'll see the types password appears in

the web page.

Thank you

Version: unspecified
Severity: normal



Event Timeline

bzimport raised the priority of this task from to Medium.Nov 21 2014, 9:30 PM
bzimport set Reference to bz8931.
bzimport added a subscriber: Unknown Object (MLST).

felix.reimann wrote:

Values of password fields cleared


postmaster wrote:


Thank you

robchur wrote:

Reopening bug; fix not committed to source control.

cannon.danielc wrote:

Committed as r22665.