[#32045] - [4] Security. Uncouple the length of a placeholder mask from the actual password length.
- Fixed in Code Base
- 22 Jan 2021
- Medium
- Build: 4.0-dev
- # 32045
- Diff
- PhilETaylor:uncouplepwlen
User tests: Successful: Unsuccessful:
Summary of Changes
Currently in Joomla 4, the Password field (used for fields like the Joomla Global Configuration Database Password) uses a mask and doesn't show the actual password. (Because $lock is set)
The placeholder is a set of bullets (used to be asterisks)
The placeholder and mask is currently the same length as the REAL PASSWORD therefore giving away too much information about the real value of the password.
This PR changes this behaviour to set a standard (plucked out of the air) 10 bullets mask/placeholder so that the real length of the underlying password is not leaked to the viewer.
Testing Instructions
Check Joomla Global Configuration -> Database password - Note the number of bullets equals the number of chars in your REAL database password
Apply PR
Check Joomla Global Configuration -> Database password - Note the number of bullets equals 10.
Actual result BEFORE applying this Pull Request
The length of the real password was leaked to the user interface when the password field locked specifically to hide such password.
Expected result AFTER applying this Pull Request
10 bullet length placeholder/hint regardless of the length of the underlying password.
Documentation Changes Required
None.
| Status | New | ⇒ | Pending |
joomla-cms-bot
- | Category | ⇒ | Layout |
I appreciate that, but that is probably not the right thing to do, to show the length, as it reveals information about the password.
Ok in the context of Joomla Global Configuration then its not harmful, but remember this code can be reused elsewhere... and you cannot always be sure that 3PD would never use it incorrectly.
I have tested this item
Tested successfully in Beta7-dev of 15 January.
This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/32045.
I have tested this item
This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/32045.
| Status | Pending | ⇒ | Ready to Commit |
RTC
This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/32045.
| Status | Ready to Commit | ⇒ | Fixed in Code Base |
| Closed_Date | 0000-00-00 00:00:00 | ⇒ | 2021-01-22 22:39:49 |
| Closed_By | ⇒ | HLeithner | |
| Labels |
Added:
?
?
|
||
thanks
this a hint of the password length actually it's intended to give the user a feeling if the password is right but yeah can be removed.