[GH-ISSUE #442] Password visible during password reset on web interface #167

New issue

Closed

opened 2026-02-27 08:15:38 +03:00 by kerem · 4 comments

kerem commented

2026-02-27 08:15:38 +03:00

Owner

Originally created by @DarkSpir on GitHub (Feb 12, 2023).
Original GitHub issue: https://github.com/lldap/lldap/issues/442

I log into lldap via its webinterface on port 17170, click on the user logo on the top right, and select "Profile". Then I click the button "Change Password".

The first input form "Current password" is type="text", the second and third input forms "New password" and "Confirm password" are type="password". Thus the new passwords are hidden behind whatever char the OS uses for obfuscating password input boxes but the old password is visible in plain text. Not sure if that was desired behavior.

Originally created by @DarkSpir on GitHub (Feb 12, 2023). Original GitHub issue: https://github.com/lldap/lldap/issues/442 I log into lldap via its webinterface on port 17170, click on the user logo on the top right, and select "Profile". Then I click the button "Change Password". The first input form "Current password" is type="text", the second and third input forms "New password" and "Confirm password" are type="password". Thus the new passwords are hidden behind whatever char the OS uses for obfuscating password input boxes but the old password is visible in plain text. Not sure if that was desired behavior.

kerem closed this issue

2026-02-27 08:15:39 +03:00

kerem commented

2026-02-27 08:15:39 +03:00

Author

Owner

@DarkSpir commented on GitHub (Feb 12, 2023):

I have no experience with programing in Rust but if I have to guess I'd say on /app/src/components/change_password.rs between line 248 and 249 a input_type="password" is missing. If that is not the desired behavior.

@DarkSpir commented on GitHub (Feb 12, 2023): I have no experience with programing in Rust but if I have to guess I'd say on /app/src/components/change_password.rs between line 248 and 249 a input_type="password" is missing. If that is not the desired behavior.

kerem commented

2026-02-27 08:15:39 +03:00

Author

Owner

@nitnelave commented on GitHub (Feb 12, 2023):

It sounds like you found the spot! Would you like to do a PR?

@nitnelave commented on GitHub (Feb 12, 2023): It sounds like you found the spot! Would you like to do a PR?

kerem commented

2026-02-27 08:15:39 +03:00

Author

Owner

@DarkSpir commented on GitHub (Feb 12, 2023):

Created PR #443

@DarkSpir commented on GitHub (Feb 12, 2023): Created PR #443

kerem commented

2026-02-27 08:15:39 +03:00

Author

Owner

@DarkSpir commented on GitHub (Feb 13, 2023):

Wow I think this was the first time I created a PR to actually change code of something that has not been written by myself. Thanks!

@DarkSpir commented on GitHub (Feb 13, 2023): Wow I think this was the first time I created a PR to actually change code of something that has not been written by myself. Thanks!

kerem referenced this issue

2026-02-27 08:18:05 +03:00

[PR #167] [MERGED] app: Implement login refresh #587