[#47733] - [5.4] Installer silently trims leading and trailing spaces from admin passwords
- New
- Medium
- Build: 5.4-dev
- # 47733
What happened?
found while testing #46173
Steps to reproduce:
on a fresh Joomla installation
At the Super User setup step type or paste a password that has a space at the end eg " mypasswordis " (it has space in begining and a space in ending)
finish the installation process
now on the admin login page
Try to log in with the exact password you just used (including the space) or use your password manager like in video shared.
Version
5.4
Expected result
show a warning message that leading and trailing spaces were removed.
Actual result
The installer form silently trims the trailing/leading spaces before saving to the database, but doesn't warn the user.
558994276-fb2ddb30-2d04-4628-9fb5-8162bd5b4765.mp4
System Information
No response
Additional Comments
No response
joomla-cms-bot
- | Labels |
Added:
No Code Attached Yet
bug
|
||
@brianteeman That’s absolutely right, you’re not mistaken. However, as it isn’t obvious to the user and, as @krishnagandhicode mentioned, happens silently later on, it can simply be very confusing if the browser offers to save the password at this point and we only ‘manipulate’ it later, meaning the user can’t log in with their saved password. Krishna separated these as an additional Issue intentionally, as the first fix is more of a functional nature and this one is a UX fix.
@brianteeman That’s absolutely right, you’re not mistaken. However, as it isn’t obvious to the user and, as @krishnagandhicode mentioned, happens silently later on, it can simply be very confusing if the browser offers to save the password at this point and we only ‘manipulate’ it later, meaning the user can’t log in with their saved password. Krishna separated these as an additional Issue intentionally, as the first fix is more of a functional nature and this one is a UX issue.
@brianteeman That’s absolutely right, you’re not mistaken. However, as it isn’t obvious to the user and, as @krishnagandhicode mentioned, happens silently later on. It can simply be very confusing if the browser offers to save the password at this point and we only ‘manipulate’ it later, meaning the user can’t log in with their saved password. Krishna separated these as an additional Issue intentionally, as the first fix is more of a functional nature and this one is a UX issue.
@brianteeman That’s absolutely right, you’re not mistaken. However, as it isn’t obvious to the user and, as @krishnagandhicode mentioned, happens silently later on. It can simply be very confusing if the browser offers to save the password at this point and we only ‘manipulate’ it later, meaning the user can’t log in with their saved password. Krishna separated this as an additional Issue intentionally, as the first fix is more of a functional nature and this one is a UX issue.
I might be wrong but I seem to recall that this trim was specifically requested.