diff --git a/CHANGELOG.md b/CHANGELOG.md index 0356309..46e8254 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,6 +4,11 @@ All notable changes to this project will be documented in this file. The format is based on [Keep a Changelog](http://keepachangelog.com/) and this project adheres to [Semantic Versioning](http://semver.org/). +## [UNRELEASE] + +## Fixed + +- Do not disclose `password` from `form` input. ## [1.0.2] - 2024-12-13 diff --git a/inc/credential.class.php b/inc/credential.class.php index 5932d56..058aed5 100644 --- a/inc/credential.class.php +++ b/inc/credential.class.php @@ -134,6 +134,7 @@ public function rawSearchOptions() public function showForm($ID, array $options = []) { $this->initForm($ID, $options); + TemplateRenderer::getInstance()->display( '@databaseinventory/credential.html.twig', [ @@ -158,6 +159,9 @@ public function prepareInput(array $input, $mode = 'add'): array $input['password'] = (new GLPIKey())->encrypt($input['password']); } } + if (isset($input['_blank_password'])) { + $input['password'] = ''; + } return $input; } diff --git a/templates/credential.html.twig b/templates/credential.html.twig index be13da5..30a3205 100644 --- a/templates/credential.html.twig +++ b/templates/credential.html.twig @@ -49,7 +49,7 @@ 'password', item.fields['password'], __('Password', 'databaseinventory'), - {'clearable': false, 'is_disclosable' : true} + {'clearable': true, 'is_disclosable' : false} ) }} {{ fields.textField( @@ -59,4 +59,4 @@ ) }} -{% endblock %} \ No newline at end of file +{% endblock %}