I set user as admin and password as 12345 and it shows it on the form?

a

CommentFileSizeAuthor
#3 Screen Shot 2017-12-11 at 11.10.20 AM.png69.32 KBsurbz
reveals-pwd.png9.41 KBmatas.k

Comments

vibrasphere created an issue. See original summary.

web247’s picture

web247 commented

I checked by setting up the credentials and I cannot duplicate this bug.

surbz’s picture

surbz commented
StatusFileSize
new Screen Shot 2017-12-11 at 11.10.20 AM.png69.32 KB

This message is completely optional.If you see on the config screen [Screen shot attached]

surbz’s picture

surbz commented
Status: Active » Reviewed & tested by the community
leon kessler’s picture

leon kessler commented

Shouldn't this message be empty by default?

Seems odd that the configuration this module ships with would expose a password to the public.

leon kessler’s picture

leon kessler commented

Btw, the message doesn't show for me in Chrome, but does on Firefox (on Mac OSX).

cashwilliams’s picture

cashwilliams commented
Status: Reviewed & tested by the community » Needs work

I agree this default configuration should be changed.

The module even has a comment based around removing the message for security https://cgit.drupalcode.org/shield/tree/config/install/shield.settings.y...

dewalt’s picture

dewalt commented

+1, user name and password shouldn't appear in default message. It breaks privacy, if the module is used to limit access to the site and site administator just didn't payed attention to the field below and kept it default. I had such occasions :(

  • badjava committed d9f00a0 on 8.x-1.x 
    Issue #2919568 by vibrasphere, Leon Kessler, cashwilliams, dewalt,...
badjava’s picture

badjava commented
Status: Needs work » Fixed

Fixed - thank you for the feedback.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.