42037 - Passwords visible on editusers.cgi page

Status: VERIFIED FIXED

(Bugzilla :: Bugzilla-General, defect, P3)

Description

[Jon Robertson]

When editing users via the editusers.cgi page, the user's password is visible.  
This causes some concern for our users, since they may want to use one of their 
common passwords.

It is trivial to change this field to a password field so the password isn't 
visible.  Someone with rights can still change a users password, they just 
can't see it on the screen.  I've attached a patch to make this change.

Bugzilla passwords are still stored in the mysql database as plain text.  
However, I suspect that very few bugzilla users have direct access to mysql.

Comment 1

[Jon Robertson]

Attachment: Patch to change password entry to use a HTML password field

Comment 2

[Sebastian Späth]

Seems like a reasonable very low risk patch to make bugzilla respect privacy. 
Adding 'patch' keyword for easier querying.

Comment 3

[Dave Miller [:justdave]]

Taking this one...

Comment 4

[Dave Miller [:justdave]]

This has been checked in.

Comment 5

[Dave Miller [:justdave]]

In search of accurate queries....  (sorry for the spam)

Comment 6

[Dawn Endico]

this has been working for a long time. marking verified

Comment 7

[Dave Miller [:justdave]]

Moving closed bugs to Bugzilla product