From 4b3588feb2b7e260bf237b0f3944c90cdc47c3b5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alexandre=20K=C3=BChn?= <aku@odoo.com>
Date: Thu, 26 Jul 2018 17:37:36 +0200
Subject: [FIX] web: edited password fields should not contain '*'

Before this commit, when someone was editing a password, the stored
password may not be the expected one by the user.

Steps to reproduce:

	1. Open "Outgoing Mail Servers" form.
	2. Set a password (e.g. "yop").
	3. Save, then edit.
	4. Add "y" at the end of the password field.

	> Expected value: "yopy"
	> Actual value: "***y"

This is due to the use of the char field formatter, which displays passwords
by replacing the characters with '*'. It is not necessary to do this in edit
mode, because it uses an input field of type 'password'. The browser
automatically hides the value of such inputs.

Any changes on a input field in edit mode uses the value of the input, so the
value of an password input should contain the password, without '*'.

This commit fixes the issue by using the formatter in edit mode for the input
of type 'password'.

Task-ID 1869565
---
 .../web/static/tests/fields/basic_fields_tests.js  | 28 ++++++++++++++++++++++
 1 file changed, 28 insertions(+)

(limited to 'addons/web/static/tests/fields/basic_fields_tests.js')

diff --git a/addons/web/static/tests/fields/basic_fields_tests.js b/addons/web/static/tests/fields/basic_fields_tests.js
index 443fb194d87..9ed633ad4c2 100644
--- a/addons/web/static/tests/fields/basic_fields_tests.js
+++ b/addons/web/static/tests/fields/basic_fields_tests.js
@@ -1183,6 +1183,34 @@ QUnit.module('basic_fields', {
         form.destroy();
     });
 
+    QUnit.test('input field: change password value', function (assert) {
+        assert.expect(4);
+
+        var form = createView({
+            View: FormView,
+            model: 'partner',
+            data: this.data,
+            arch: '<form>' +
+                    '<field name="foo" password="True"/>' +
+                '</form>',
+            res_id: 1,
+        });
+
+        assert.notOk(form.$('.o_field_char').text() === "yop",
+            "password field value should not be visible in read mode");
+        assert.strictEqual(form.$('.o_field_char').text(), "***",
+            "password field value should be hidden with '*' in read mode");
+
+        form.$buttons.find('.o_form_button_edit').click();
+
+        assert.strictEqual(form.$('input.o_field_char').attr('type'), 'password',
+            "password field input should be with type 'password' in edit mode");
+        assert.strictEqual(form.$('input.o_field_char').val(), 'yop',
+            "password field input value should be the (non-hidden) password value");
+
+        form.destroy();
+    });
+
     QUnit.module('UrlWidget');
 
     QUnit.test('url widget in form view', function (assert) {
-- 
cgit v1.2.3