Bug 1814752 - Receptor installation playbook job invocation page shows entered password in plaintext (text input)
Summary: Receptor installation playbook job invocation page shows entered password in ...
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: Red Hat Satellite
Classification: Red Hat
Component: Templates Plugin
Version: 6.7.0
Hardware: Unspecified
OS: Unspecified
unspecified
low
Target Milestone: Unspecified
Assignee: Marek Hulan
QA Contact: Lukáš Hellebrandt
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2020-03-18 15:49 UTC by Lukáš Hellebrandt
Modified: 2020-04-14 19:08 UTC (History)
6 users (show)

Fixed In Version: foreman-1.24.1.21-1
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2020-04-14 19:08:59 UTC
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Foreman Issue Tracker 29464 0 Normal Closed Receptor installation playbook job invocation page shows entered password in plaintext (text input) 2020-07-28 17:28:30 UTC
Github theforeman foreman pull 7559 0 None closed Fixes #29464 - plain inputs can be hidden 2020-07-28 17:28:30 UTC

Description Lukáš Hellebrandt 2020-03-18 15:49:24 UTC
Description of problem:
When running the playbook "Configure Cloud Connector", when entering parameters, there is text input "satellite_password". It's not hidden in asterisks, it's plaintext. Users usually expect password fields to be of type password, not text.

Version-Release number of selected component (if applicable):
6.7 snap 16, NOT regression

How reproducible:
Deterministic

Steps to Reproduce:
1. Hosts -> Job Templates
2. Run template Configure Cloud Connector
3. Start typing in field satellite_password

Actual results:
The entered password is visible

Expected results:
The entered password is hidden as passwords usually are

Comment 3 Marek Hulan 2020-03-19 08:18:16 UTC
Perhaps we should document that it's a good idea to use token instead of a password. It's additional manual step that must be done through CLI, but probably a good idea. Anyway, this is a generic RFE for template inputs in Foreman core, we should be able to mark inputs as hidden like we do with parameters.

Comment 5 Lukáš Hellebrandt 2020-03-20 09:02:19 UTC
No, it's not - this bug is about filling the invocation form and not having the password asterisked-out, the other one is about already invoked job having password in its name.

Comment 8 Marek Hulan 2020-04-02 19:52:06 UTC
Created redmine issue https://projects.theforeman.org/issues/29464 from this bug

Comment 9 Bryan Kearney 2020-04-02 20:02:07 UTC
Upstream bug assigned to mhulan

Comment 10 Bryan Kearney 2020-04-02 20:02:10 UTC
Upstream bug assigned to mhulan

Comment 12 Bryan Kearney 2020-04-03 14:02:09 UTC
Moving this bug to POST for triage into Satellite 6 since the upstream issue https://projects.theforeman.org/issues/29464 has been resolved.

Comment 14 Lukáš Hellebrandt 2020-04-06 13:46:04 UTC
Verified with Sat 6.7 snap 20. Password is now correctly asterisked-out while being entered. Verified with WebUI and Hammer, job passed.

Comment 15 Bryan Kearney 2020-04-14 19:08:59 UTC
This was fixed in 6.7.


Note You need to log in before you can comment on or make changes to this bug.