[patch] Don't cache password field content

[Steffen Hoffmann]

This plugin works great for me with Trac 0.12.1dev-​r9990, but IMHO it's going little too far.

Today DataSaverPlugin basically is an effective password logger as well. I do use the login form provided by AccountManagerPlugin, and this is where the last username/password combination is cached and successfully restored later according to my tests tonight.

A privacy/security sensitive application would never want to restore any password field input or even cache such content at all. By doing so, DataSaverPlugin poses a considerable vulnerability, since even someone else could use it in the same browser to get valid authentication credentials, as long as cookies where not cleared meanwhile.

I judge this bad habit - hence looking at it as a major defect.

[Steffen Hoffmann]

Suggested fix could be easy: Just prevent reading of any input of type password. This would be sufficient:

 datasaver.js |    1 +
 1 file changed, 1 insertion(+)

datasaverplugin/0.12/datasaver/htdocs/datasaver.js

@@ -83 +83 @@
             var element = form.elements[elemidx];
             if (element.type != 'submit' && 
                 element.type != 'hidden' &&
+                element.type != 'password' &&
                 element.value)
             {
                 formdata.push(

Verified to work with a patched version just fine, only user name is cached/restored then.

[Steffen Hoffmann]

Taking over responsibility after plugin adoption.

[Steffen Hoffmann]

(In [8703]) DataSaverPlugin: Prevent password input field data collection, closes #7510.