-
Improvement
-
Resolution: Fixed
-
Minor
-
3.5.2, 3.9
-
MOODLE_35_STABLE, MOODLE_39_STABLE
-
MOODLE_39_STABLE
-
MDL-63734-master_hidepassword -
Test for regressions when passwords are not forced
- Navigate to Site administration -> Messaging -> Jabber
- For the "Jabber password" field, check that you can:
- edit the field
- view its value
- mask/unmask it
- save it
- view the saved value and that it is correct
- Navigate to Site administration -> Plugins -> Activity modules -> URL
- For the "Password" field, check that you can:
- edit the field
- view its value
- mask/unmask it
- save it
- view the saved value and that it is correct
Forcing passwords
- Edit your config.php and add the following line just before the require_once('setup.php'); line:
$CFG->jabberpassword = 'cfgpassword'; - Navigate to Site administration -> Messaging -> Jabber
- For the "Jabber password" field, check that:
- the field is now a disabled text field
- the password unmask features are missing (edit icon, eye icon)
- Inspect the element
- Confirm that you cannot see cfgpassword anywhere in the source
- Test that the password is not visible and cannot be seen in source etc
- Edit your config.php again and add the following line just before the require_once('setup.php'); line:
$CFG->forced_plugin_settings['url']['secretphrase'] = 'cfgpassword'; - Navigate to Site administration -> Plugins -> Activity modules -> URL
- For the "Jabber password" field, check that:
- the field is now a disabled text field
- the password unmask features are missing (edit icon, eye icon)
- Inspect the element
- Confirm that you cannot see cfgpassword anywhere in the source
- Test that the password is not visible and cannot be seen in source etc
Test for regressions when passwords are not forced Navigate to Site administration -> Messaging -> Jabber For the "Jabber password" field, check that you can: edit the field view its value mask/unmask it save it view the saved value and that it is correct Navigate to Site administration -> Plugins -> Activity modules -> URL For the "Password" field, check that you can: edit the field view its value mask/unmask it save it view the saved value and that it is correct Forcing passwords Edit your config.php and add the following line just before the require_once('setup.php'); line: $CFG->jabberpassword = 'cfgpassword'; Navigate to Site administration -> Messaging -> Jabber For the "Jabber password" field, check that: the field is now a disabled text field the password unmask features are missing (edit icon, eye icon) Inspect the element Confirm that you cannot see cfgpassword anywhere in the source Test that the password is not visible and cannot be seen in source etc Edit your config.php again and add the following line just before the require_once('setup.php'); line: $CFG->forced_plugin_settings['url']['secretphrase'] = 'cfgpassword'; Navigate to Site administration -> Plugins -> Activity modules -> URL For the "Jabber password" field, check that: the field is now a disabled text field the password unmask features are missing (edit icon, eye icon) Inspect the element Confirm that you cannot see cfgpassword anywhere in the source Test that the password is not visible and cannot be seen in source etc
GA number of passwordunmask fields should (in some situations) be hidden from admins, e.g. if you don't want Moodle admins to know the passwords for, e.g.:
- auth_cas | bind_pw
- enrol_database | dbpass
- logstore_database | dbpass
There's cases where admins do set these values via the Moodle UI, and in those cases it should be visible.
One flexible way to do this is to prevent the value of passwordunmask fields from being populated if the value is hard-coded in config.php
|
pseuocode |
class admin_setting_configpasswordunmask extends admin_setting_configtext { |
...
|
public function output_html($data, $query='') { |
global $OUTPUT; |
$context = (object) [ |
'id' => $this->get_id(), |
'name' => $this->get_full_name(), |
'size' => $this->size, |
'value' => (isset($CFG->...):'':$data), |
'forceltr' => $this->get_force_ltr(), |
];
|
$element = $OUTPUT->render_from_template('core_admin/setting_configpasswordunmask', $context); |
return format_admin_setting($this, $this->visiblename, $element, $this->description, true, '', null, $query); |
}
|
