Bug 1087936 - [GUI] Run Once & Sysprep: entered user password is not masked
Summary: [GUI] Run Once & Sysprep: entered user password is not masked
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: Red Hat Enterprise Virtualization Manager
Classification: Red Hat
Component: ovirt-engine
Version: 3.4.0
Hardware: Unspecified
OS: Unspecified
unspecified
medium
Target Milestone: ovirt-3.6.0-rc
: 3.6.0
Assignee: Shmuel Melamud
QA Contact: Petr Kubica
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2014-04-15 15:56 UTC by Pavel Novotny
Modified: 2016-04-20 01:10 UTC (History)
7 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2016-04-20 01:10:12 UTC
oVirt Team: Virt
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)
screenshots: sysprep & cloud-init password inputs in Run Once/Initial Run (93.58 KB, application/x-gzip)
2014-04-15 15:56 UTC, Pavel Novotny
no flags Details


Links
System ID Private Priority Status Summary Last Updated
oVirt gerrit 39418 0 master MERGED webadmin: Run Once & Sysprep: mask and verify user password Never

Description Pavel Novotny 2014-04-15 15:56:32 UTC
Created attachment 886543 [details]
screenshots: sysprep & cloud-init password inputs in Run Once/Initial Run

Description of problem:
When entering alternate credentials for a Windows VM in Run Once dialog -> Initial Run (sysprep), the password input field does not mask it at all.

Version-Release number of selected component (if applicable):
rhevm-3.4.0-0.13.beta3.el6ev.noarch (av6).

How reproducible:
100%

Steps to Reproduce:
1. Have a Windows VM and open Run Once dialog.
2. In Boot Options select to attach [sysprep] floppy.
3. In Initial Run enter following alternate credentials:
     User Name: administrator
     Password: SuperSecretPassword
4. Ask your colleague to take a look at your monitor and to guess your password.

Actual results:
Your colleague doesn't have much trouble to find out your password because it's displayed in plain text in the GUI!
The password input field is actually <input type="text"> HTML widget.
(see screenshot "runonce-sysprep-password.png" in zipped attachment)

Expected results:
Usually two <input type="password"> widgets are used for passwords - for entering and re-entering the password.
It should be implemented the same way as it's done in Run Once / Cloud-Init dialog of Linux-based VMs.
(see "runonce-cloudinit-password.png" in zipped attachment)


Additional info:

Comment 1 Michal Skrivanek 2014-05-21 08:09:25 UTC
it's Windows, everyone knows it's less secure! :-D

Comment 2 Petr Kubica 2015-07-21 13:47:59 UTC
Verified in 3.6.0-0.0.master.20150628172322.git3c12761.el6


Note You need to log in before you can comment on or make changes to this bug.