Disable the password field

Yes, people might assume that the password element is secure by default. I think we need to provide a warning to site builders that passwords are stored as plain text.

I don't think we should remove the password element because there are sites that do not store any data in Drupal and push their data to a remote CRM. There are also some sites that are using a webform to create a Drupal user account and might need to collect a password.

How about we add a warning message to the password element that warns users that submitted passwords are stored as plain text and recommend that they install the Webform Encrypt module.

I would also be open to defaulting all new installations of the Webform module to have the password element disabled by default with a warning displayed when it is enabled. (@see /admin/structure/webform/config/elements)

The below notes can be used for the change record.

Summary

• Disable password and the password_confirm element for new installations.
• Disable password and password_confirm element on existing installations that are not using these elements.
• Add warning message to all enabled password elements. (/admin/structure/webform/config/elements)
• Add warning to all password elements that are stored in the database.
• Remove password and password elements from webform_examples.module

Notes

• Recommending people use the Webform Encrypt module.
• The Webform Encrypt module is still in Alpha release, so we are not trying to determine when it is enabled or disable for a password element.
• Any element type that included the word password is going to be flagged.

I committed the patch. Please download the latest dev release to review.

@jrockowitz I have a doubt here:

+++ b/includes/webform.install.update.inc
+  // If password element is not being used in any webform display both the
		+  // password and password_confirm element.
		+  if (!$has_password_element) {
		+    $admin_config = \Drupal::configFactory()->getEditable('webform.settings');
		+    $excluded_elements = $admin_config->get('element.excluded_elements') ?: [];
		+    $excluded_elements['password'] = 'password';
		+    $excluded_elements['password_confirm'] = 'password_confirm';
		+  }
		+}
		+

Here I can't see the use of $excluded_elements is an error or I'm missing something here?

@adriancid You are absolutely right. Thanks for catching that.

I think that you need to add another webform update function because some users maybe have the webform_update_8110() update on their sites, so to apply the changes another update is needed.

Done!

@see https://cgit.drupalcode.org/webform/commit/?id=b2a99e7

There are use cases acceptable both in terms of security and morality (not storing in db and sending encrypted to endpoint via handler for instance). It's not terribly time consuming to sidestep if you're familiar with the module and discovered this issue, but I'm unsure if I agree with the decision. Technical ability doesn't imply morality, so the decision is whether to make work for technical users in order to prevent unintentional misuse.