Page MenuHomePhabricator
Create Task
Maniphest T394796

Administrator account password field shown in cleartext and in autocomplete
Closed, ResolvedPublic
Actions

Description

Screenshot 2025-05-20 at 16.37.25.png (629×284 px, 21 KB)

Also, previously submitted passwords appear in the autocomplete box

Screenshot 2025-05-20 at 17.14.18.png (606×149 px, 14 KB)

Details

Related Changes in Gerrit:
SubjectAuthorRepoBranchLines +/-
installer: Use input type from params if providedSomeRandomDevelopermediawiki/coremaster+1 -1
installer: Use input type from params if providedSomeRandomDevelopermediawiki/coreREL1_44+1 -1
Customize query in gerrit

Related Objects

Event Timeline

Reedy created this task.May 20 2025, 3:38 PM
Herald added a subscriber: Aklapper. · View Herald TranscriptMay 20 2025, 3:38 PM
Reedy renamed this task from Administrator account password field shown in cleartext to Administrator account password field shown in cleartext and in autocomplete.May 20 2025, 4:15 PM
Reedy added a project: Security.
Reedy updated the task description. (Show Details)
Reedy updated the task description. (Show Details)
Reedy moved this task from General to Web installer on the MediaWiki-Installer board.May 20 2025, 4:32 PM
Pppery merged tasks: T394795: Administrator account password field not detected by a password manager, T399047: During install process, the "admin password" field is a normal input not a password input.Jul 9 2025, 1:00 AM
Pppery added a subscriber: Bawolff.
SomeRandomDeveloper claimed this task.Aug 1 2025, 8:39 PM
gerritbot added a comment.Aug 1 2025, 8:44 PM

Change #1175172 had a related patch set uploaded (by SomeRandomDeveloper; author: SomeRandomDeveloper):

[mediawiki/core@master] Use input type from params if provided

https://gerrit.wikimedia.org/r/1175172

gerritbot added a project: Patch-For-Review.Aug 1 2025, 8:44 PM
SomeRandomDeveloper added a comment.Aug 1 2025, 8:46 PM

How it looks like with my patch:

image.png (670×377 px, 20 KB)

This also fixes the same issue occuring with the database password input box.

SomeRandomDeveloper added a project: Regression.Aug 1 2025, 8:47 PM

Tagging as regression, looks like this was caused by https://gerrit.wikimedia.org/r/q/I499ea40d05ed9a8181f3f41c16979925c241983b.

• matmarex added a project: MW-1.44-release.Aug 1 2025, 10:43 PM
• matmarex subscribed.
gerritbot added a comment.Aug 1 2025, 11:05 PM

Change #1175172 merged by jenkins-bot:

[mediawiki/core@master] installer: Use input type from params if provided

https://gerrit.wikimedia.org/r/1175172

gerritbot added a comment.Aug 1 2025, 11:06 PM

Change #1175179 had a related patch set uploaded (by SomeRandomDeveloper; author: SomeRandomDeveloper):

[mediawiki/core@REL1_44] installer: Use input type from params if provided

https://gerrit.wikimedia.org/r/1175179

gerritbot added a comment.Aug 1 2025, 11:31 PM

Change #1175179 merged by jenkins-bot:

[mediawiki/core@REL1_44] installer: Use input type from params if provided

https://gerrit.wikimedia.org/r/1175179

• matmarex closed this task as Resolved.Aug 1 2025, 11:59 PM
ReleaseTaggerBot added projects: MW-1.45-notes (1.45.0-wmf.13; 2025-08-05), MW-1.44-notes.Aug 2 2025, 12:00 AM
Maintenance_bot removed a project: Patch-For-Review.Aug 2 2025, 12:30 AM
Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL · Credits