From 4b3588feb2b7e260bf237b0f3944c90cdc47c3b5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alexandre=20K=C3=BChn?= <aku@odoo.com>
Date: Thu, 26 Jul 2018 17:37:36 +0200
Subject: [FIX] web: edited password fields should not contain '*'

Before this commit, when someone was editing a password, the stored
password may not be the expected one by the user.

Steps to reproduce:

	1. Open "Outgoing Mail Servers" form.
	2. Set a password (e.g. "yop").
	3. Save, then edit.
	4. Add "y" at the end of the password field.

	> Expected value: "yopy"
	> Actual value: "***y"

This is due to the use of the char field formatter, which displays passwords
by replacing the characters with '*'. It is not necessary to do this in edit
mode, because it uses an input field of type 'password'. The browser
automatically hides the value of such inputs.

Any changes on a input field in edit mode uses the value of the input, so the
value of an password input should contain the password, without '*'.

This commit fixes the issue by using the formatter in edit mode for the input
of type 'password'.

Task-ID 1869565
---
 addons/web/static/src/js/fields/basic_fields.js | 22 ++++++++++++++--------
 1 file changed, 14 insertions(+), 8 deletions(-)

(limited to 'addons/web/static/src/js/fields/basic_fields.js')

diff --git a/addons/web/static/src/js/fields/basic_fields.js b/addons/web/static/src/js/fields/basic_fields.js
index bd13305df0c..d4af202d39f 100644
--- a/addons/web/static/src/js/fields/basic_fields.js
+++ b/addons/web/static/src/js/fields/basic_fields.js
@@ -243,14 +243,20 @@ var InputField = DebouncedField.extend({
     _prepareInput: function ($input) {
         this.$input = $input || $("<input/>");
         this.$input.addClass('o_input');
-        this.$input.attr({
-            type: this.nodeOptions.isPassword ? 'password' : 'text',
-            placeholder: this.attrs.placeholder || "",
-            autocomplete: this.nodeOptions.isPassword ?
-                'new-password' :
-                this.attrs.autocomplete,
-        });
-        this.$input.val(this._formatValue(this.value));
+
+        var inputAttrs = { placeholder: this.attrs.placeholder || "" };
+        var inputVal;
+        if (this.nodeOptions.isPassword) {
+            inputAttrs = _.extend(inputAttrs, { type: 'password', autocomplete: 'new-password' });
+            inputVal = this.value;
+        } else {
+            inputAttrs = _.extend(inputAttrs, { type: 'text', autocomplete: this.attrs.autocomplete });
+            inputVal = this._formatValue(this.value);
+        }
+
+        this.$input.attr(inputAttrs);
+        this.$input.val(inputVal);
+
         return this.$input;
     },
     /**
-- 
cgit v1.2.3