jro_apps/redmine Commit - r929:457c9a8e727d

Fixed: svn or ldap password can be found in clear text in the html source in editing mode....

Jean-Philippe Lang -

r929:457c9a8e727d

parent child

Context file:

r929:457c9a8e727d

Collapse all files

app/helpers/repositories_helper.rb +4 -1

             # redMine - project management software
             # Copyright (C) 2006  Jean-Philippe Lang
             #
             # This program is free software; you can redistribute it and/or
             # modify it under the terms of the GNU General Public License
             # as published by the Free Software Foundation; either version 2
             # of the License, or (at your option) any later version.
             #
             # This program is distributed in the hope that it will be useful,
             # but WITHOUT ANY WARRANTY; without even the implied warranty of
             # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
             # GNU General Public License for more details.
             #
             # You should have received a copy of the GNU General Public License
             # along with this program; if not, write to the Free Software
             # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
             require 'coderay'
             require 'coderay/helpers/file_type'
             require 'iconv'
             module RepositoriesHelper
               def syntax_highlight(name, content)
                 type = CodeRay::FileType[name]
                 type ? CodeRay.scan(content, type).html : h(content)
               end
               def to_utf8(str)
                 return str if /\A[\r\n\t\x20-\x7e]*\Z/n.match(str) # for us-ascii
                 @encodings ||= Setting.repositories_encodings.split(',').collect(&:strip)
                 @encodings.each do |encoding|
                   begin
                     return Iconv.conv('UTF-8', encoding, str)
                   rescue Iconv::Failure
                     # do nothing here and try the next encoding
                   end
                 end
                 str
               end
               def repository_field_tags(form, repository)
                 method = repository.class.name.demodulize.underscore + "_field_tags"
                 send(method, form, repository) if repository.is_a?(Repository) && respond_to?(method)
               end
               def scm_select_tag(repository)
                 container = [[]]
                 REDMINE_SUPPORTED_SCM.each {|scm| container << ["Repository::#{scm}".constantize.scm_name, scm]}
                 select_tag('repository_scm',
                            options_for_select(container, repository.class.name.demodulize),
                            :disabled => (repository && !repository.new_record?),
                            :onchange => remote_function(:url => { :controller => 'repositories', :action => 'edit', :id => @project }, :method => :get, :with => "Form.serialize(this.form)")
                            )
               end
               def with_leading_slash(path)
                 path ||= ''
                 path.starts_with?("/") ? "/#{path}" : path
               end
               def subversion_field_tags(form, repository)
                   content_tag('p', form.text_field(:url, :size => 60, :required => true, :disabled => (repository && !repository.root_url.blank?)) +
                                    '<br />(http://, https://, svn://, file:///)') +
                   content_tag('p', form.text_field(:login, :size => 30)) +
-                  content_tag('p', form.password_field(:password, :size => 30))
+                  content_tag('p', form.password_field(:password, :size => 30, :name => 'ignore',
+                                                       :value => ((repository.new_record? || repository.password.blank?) ? '' : ('x'*15)),
+                                                       :onfocus => "this.value=''; this.name='repository[password]';",
+                                                       :onchange => "this.name='repository[password]';"))
               end
               def darcs_field_tags(form, repository)
                   content_tag('p', form.text_field(:url, :label => 'Root directory', :size => 60, :required => true, :disabled => (repository && !repository.new_record?)))
               end
               def mercurial_field_tags(form, repository)
                   content_tag('p', form.text_field(:url, :label => 'Root directory', :size => 60, :required => true, :disabled => (repository && !repository.root_url.blank?)))
               end
               def cvs_field_tags(form, repository)
                   content_tag('p', form.text_field(:root_url, :label => 'CVSROOT', :size => 60, :required => true, :disabled => !repository.new_record?)) +
                   content_tag('p', form.text_field(:url, :label => 'Module', :size => 30, :required => true, :disabled => !repository.new_record?))
               end
             end

app/views/auth_sources/_form.rhtml +4 -1

             <%= error_messages_for 'auth_source' %>
             <div class="box">
             <!--[form:auth_source]-->
             <p><label for="auth_source_name"><%=l(:field_name)%> <span class="required">*</span></label>
             <%= text_field 'auth_source', 'name'  %></p>
             <p><label for="auth_source_host"><%=l(:field_host)%> <span class="required">*</span></label>
             <%= text_field 'auth_source', 'host'  %></p>
             <p><label for="auth_source_port"><%=l(:field_port)%> <span class="required">*</span></label>
             <%= text_field 'auth_source', 'port', :size => 6 %> <%= check_box 'auth_source', 'tls'  %> LDAPS</p>
             <p><label for="auth_source_account"><%=l(:field_account)%></label>
             <%= text_field 'auth_source', 'account'  %></p>
             <p><label for="auth_source_account_password"><%=l(:field_password)%></label>
-            <%= password_field 'auth_source', 'account_password'  %></p>
+            <%= password_field 'auth_source', 'account_password', :name => 'ignore',
+                                                       :value => ((@auth_source.new_record? || @auth_source.account_password.blank?) ? '' : ('x'*15)),
+                                                       :onfocus => "this.value=''; this.name='auth_source[account_password]';",
+                                                       :onchange => "this.name='auth_source[account_password]';" %></p>
             <p><label for="auth_source_base_dn"><%=l(:field_base_dn)%> <span class="required">*</span></label>
             <%= text_field 'auth_source', 'base_dn', :size => 60 %></p>
             </div>
             <div class="box">
             <p><label for="auth_source_onthefly_register"><%=l(:field_onthefly)%></label>
             <%= check_box 'auth_source', 'onthefly_register' %></p>
             <p>
             <fieldset><legend><%=l(:label_attribute_plural)%></legend>
             <p><label for="auth_source_attr_login"><%=l(:field_login)%> <span class="required">*</span></label>
             <%= text_field 'auth_source', 'attr_login', :size => 20  %></p>
             <p><label for="auth_source_attr_firstname"><%=l(:field_firstname)%></label>
             <%= text_field 'auth_source', 'attr_firstname', :size => 20  %></p>
             <p><label for="auth_source_attr_lastname"><%=l(:field_lastname)%></label>
             <%= text_field 'auth_source', 'attr_lastname', :size => 20  %></p>
             <p><label for="auth_source_attr_mail"><%=l(:field_mail)%></label>
             <%= text_field 'auth_source', 'attr_mail', :size => 20  %></p>
             </fieldset>
             </p>
             </div>
             <!--[eoform:auth_source]-->

General Comments 0

Write
Preview

You need to be logged in to leave comments. Login now

No TODOs yet

	Site-wide shortcuts
/	Use quick search box
g h	Goto home page
g g	Goto my private gists page
g G	Goto my public gists page
g 0-9	Goto bookmarked items from 0-9
n r	New repository page
n g	New gist page

	Repositories
g s	Goto summary page
g c	Goto changelog page
g f	Goto files page
g F	Goto files page with file search activated
g p	Goto pull requests page
g o	Goto repository settings
g O	Goto repository access permissions settings
t s	Toggle sidebar on some pages