Uploaded image for project: 'Moodle'
  1. Moodle
  2. MDL-63734

If passwordunmask field is hardcoded in config.php, do not show the value

    XMLWordPrintable

    Details

    • Testing Instructions:
      Hide

      Test for regressions when passwords are not forced

      1. Navigate to Site administration -> Messaging -> Jabber
      2. For the "Jabber password" field, check that you can:
        1. edit the field
        2. view its value
        3. mask/unmask it
        4. save it
        5. view the saved value and that it is correct
      3. Navigate to Site administration -> Plugins -> Activity modules -> URL
      4. For the "Password" field, check that you can:
        1. edit the field
        2. view its value
        3. mask/unmask it
        4. save it
        5. view the saved value and that it is correct

      Forcing passwords

      1. Edit your config.php and add the following line just before the require_once('setup.php'); line:

        $CFG->jabberpassword = 'cfgpassword';
        

      2. Navigate to Site administration -> Messaging -> Jabber
      3. For the "Jabber password" field, check that:
        1. the field is now a disabled text field
        2. the password unmask features are missing (edit icon, eye icon)
      4. Inspect the element
        1. Confirm that you cannot see cfgpassword anywhere in the source
      5. Test that the password is not visible and cannot be seen in source etc
      6. Edit your config.php again and add the following line just before the require_once('setup.php'); line:

         $CFG->forced_plugin_settings['url']['secretphrase'] = 'cfgpassword';
        

      7. Navigate to Site administration -> Plugins -> Activity modules -> URL
      8. For the "Jabber password" field, check that:
        1. the field is now a disabled text field
        2. the password unmask features are missing (edit icon, eye icon)
      9. Inspect the element
        1. Confirm that you cannot see cfgpassword anywhere in the source
      10. Test that the password is not visible and cannot be seen in source etc
      Show
      Test for regressions when passwords are not forced Navigate to Site administration -> Messaging -> Jabber For the "Jabber password" field, check that you can: edit the field view its value mask/unmask it save it view the saved value and that it is correct Navigate to Site administration -> Plugins -> Activity modules -> URL For the "Password" field, check that you can: edit the field view its value mask/unmask it save it view the saved value and that it is correct Forcing passwords Edit your config.php and add the following line just before the require_once('setup.php'); line: $CFG->jabberpassword = 'cfgpassword'; Navigate to Site administration -> Messaging -> Jabber For the "Jabber password" field, check that: the field is now a disabled text field the password unmask features are missing (edit icon, eye icon) Inspect the element Confirm that you cannot see cfgpassword anywhere in the source Test that the password is not visible and cannot be seen in source etc Edit your config.php again and add the following line just before the require_once('setup.php'); line:  $CFG->forced_plugin_settings['url']['secretphrase'] = 'cfgpassword'; Navigate to Site administration -> Plugins -> Activity modules -> URL For the "Jabber password" field, check that: the field is now a disabled text field the password unmask features are missing (edit icon, eye icon) Inspect the element Confirm that you cannot see cfgpassword anywhere in the source Test that the password is not visible and cannot be seen in source etc
    • Affected Branches:
      MOODLE_35_STABLE, MOODLE_39_STABLE
    • Fixed Branches:
      MOODLE_39_STABLE
    • Pull from Repository:
    • Pull Master Branch:
      MDL-63734-master_hidepassword

      Description

      GA number of passwordunmask fields should (in some situations) be hidden from admins, e.g. if you don't want Moodle admins to know the passwords for, e.g.:

      • auth_cas | bind_pw
      • enrol_database | dbpass
      • logstore_database | dbpass

      There's cases where admins do set these values via the Moodle UI, and in those cases it should be visible.

      One flexible way to do this is to prevent the value of passwordunmask fields from being populated if the value is hard-coded in config.php

      pseuocode

      class admin_setting_configpasswordunmask extends admin_setting_configtext {
      ...
          public function output_html($data, $query='') {
              global $OUTPUT;
              $context = (object) [
                  'id' => $this->get_id(),
                  'name' => $this->get_full_name(),
                  'size' => $this->size,
                  'value' => (isset($CFG->...):'':$data),
                  'forceltr' => $this->get_force_ltr(),
              ];
              $element = $OUTPUT->render_from_template('core_admin/setting_configpasswordunmask', $context);
              return format_admin_setting($this, $this->visiblename, $element, $this->description, true, '', null, $query);
          }
      

        Attachments

        1. image-2019-12-30-18-08-53-866.png
          11 kB
          Brendan Heywood
        2. image-2019-12-30-18-09-31-106.png
          19 kB
          Brendan Heywood
        3. MDL-63734.jpg.PNG
          60 kB
          Anna Carissa Sadia
        4. MDL-63734 (2).jpg.PNG
          61 kB
          Anna Carissa Sadia

          Issue Links

            Activity

              People

              Assignee:
              danmarsden Dan Marsden
              Reporter:
              mwebster Mark van Hoek
              Peer reviewer:
              Brendan Heywood
              Integrator:
              Andrew Nicols
              Tester:
              Anna Carissa Sadia
              Participants:
              Component watchers:
              Adrian Greeve, Jake Dallimore, Mathew May, Mihail Geshoski, Peter Dias, Amaia Anabitarte, Carlos Escobedo, Ferran Recio, Sara Arjona (@sarjona)
              Votes:
              2 Vote for this issue
              Watchers:
              9 Start watching this issue

                Dates

                Created:
                Updated:
                Resolved:
                Fix Release Date:
                15/Jun/20

                  Time Tracking

                  Estimated:
                  Original Estimate - Not Specified
                  Not Specified
                  Remaining:
                  Remaining Estimate - 0 minutes
                  0m
                  Logged:
                  Time Spent - 50 minutes
                  50m