Project

General

Profile

Actions
Copy link

Bug #8597

closed

When we use password 'plain' method, the password is always displayed in the directive

Added by Nicolas CHARLES almost 8 years ago. Updated about 7 years ago.

Status:
Rejected
Priority:
N/A
Assignee:
François ARMAND
Category:
Web - Config management
Target version:
3.1.19
Pull Request:
Severity:
Minor - inconvenience | misleading | easy workaround
UX impact:
User visibility:
Getting started - demo | first install | level 1 Techniques
Effort required:
Priority:
0
Name check:
Fix check:
Regression:

Description

In User Management technique, if we use the 'plain' method for password management, the clear text password is always displayed. We should have an option to at least obfucate it so that people with little rights won't see it

Actions
Copy link
 #1

Updated by François ARMAND almost 8 years ago

To make the need more clear: we need to specify what a user with READ ONLY rights on the directive can see.

It may make sens to only display "*******" for any password, be it plain or hash or whatever.

Actions
Copy link
 #2

Updated by François ARMAND almost 8 years ago

  • Assignee set to François ARMAND
Actions
Copy link
 #3

Updated by Vincent MEMBRÉ over 7 years ago

  • Target version changed from 2.11.23 to 2.11.24
Actions
Copy link
 #4

Updated by Vincent MEMBRÉ over 7 years ago

  • Target version changed from 2.11.24 to 308
Actions
Copy link
 #5

Updated by Vincent MEMBRÉ over 7 years ago

  • Target version changed from 308 to 3.1.14
Actions
Copy link
 #6

Updated by Vincent MEMBRÉ over 7 years ago

  • Target version changed from 3.1.14 to 3.1.15
Actions
Copy link
 #7

Updated by Vincent MEMBRÉ over 7 years ago

  • Target version changed from 3.1.15 to 3.1.16
Actions
Copy link
 #8

Updated by Vincent MEMBRÉ over 7 years ago

  • Target version changed from 3.1.16 to 3.1.17
Actions
Copy link
 #9

Updated by Vincent MEMBRÉ over 7 years ago

  • Target version changed from 3.1.17 to 3.1.18
Actions
Copy link
 #10

Updated by Vincent MEMBRÉ about 7 years ago

  • Target version changed from 3.1.18 to 3.1.19
Actions
Copy link
 #11

Updated by Benoît PECCATTE about 7 years ago

  • Severity set to Minor - inconvenience | misleading | easy workaround
  • User visibility set to Getting started - demo | first install | level 1 Techniques
  • Priority set to 0
Actions
Copy link
 #12

Updated by François ARMAND about 7 years ago

  • Status changed from New to Rejected

In last version of the technique, we are not displaying the password unless if you check the option for that.

About the right: it does not seem correct to forbid people with READ ONLY rights to see the clear text password (think for example about an auditor who need to have access to that information). The correct behavior if it is a problem is to use hashed passwords.

Actions
Copy link

Also available in: Atom PDF