SSF-6 Fix security flaw

diff --git a/sonar-server/src/main/webapp/WEB-INF/app/helpers/properties_helper.rb b/sonar-server/src/main/webapp/WEB-INF/app/helpers/properties_helper.rb
index 303eb072fb7500936e0726dc813a058d87ae44f5..d5bb3198feeb33817b242a325e7ed6ae73dbd25e 100644 (file)
--- a/sonar-server/src/main/webapp/WEB-INF/app/helpers/properties_helper.rb
+++ b/sonar-server/src/main/webapp/WEB-INF/app/helpers/properties_helper.rb
@@ -49,7 +49,7 @@ module PropertiesHelper
         text_area_tag name, value, {:class => html_class, :rows => '5', :cols => cols}.update(html_options)
 
       when PropertyType::TYPE_PASSWORD
-        password_field_tag name, value, {:size => options[:size] || 50}.update(html_options)
+        password_field_tag name, value, {:size => options[:size] || 50, :autocomplete => 'off'}.update(html_options)
 
       when PropertyType::TYPE_BOOLEAN
         select_options = "<option value='' #{ 'selected' if value.blank? }>#{ message('default') }</option>"

diff --git a/sonar-server/src/main/webapp/WEB-INF/app/views/account/index.html.erb b/sonar-server/src/main/webapp/WEB-INF/app/views/account/index.html.erb
index e08ec65c8f65526bc37fa7e7005f5da1aa13057e..0b62c6bd5cacf395f44ee99d6fe14ea0f01e148b 100644 (file)
--- a/sonar-server/src/main/webapp/WEB-INF/app/views/account/index.html.erb
+++ b/sonar-server/src/main/webapp/WEB-INF/app/views/account/index.html.erb
@@ -38,15 +38,15 @@
         <table class="form">
           <tr>
             <td class="keyCell"><label for="old_password"><%= message('my_profile.password.old') -%>:</label></td>
-            <td><%= password_field_tag 'old_password' %></td>
+            <td><%= password_field_tag 'old_password', nil, {:autocomplete => 'off'} %></td>
           </tr>
           <tr>
             <td class="keyCell"><label for="password"><%= message('my_profile.password.new') -%>:</label></td>
-            <td><%= password_field_tag 'password' %></td>
+            <td><%= password_field_tag 'password', nil, {:autocomplete => 'off'}  %></td>
           </tr>
           <tr>
             <td class="keyCell"><label for="password_confirmation"><%= message('my_profile.password.confirm') -%>:</label></td>
-            <td><%= password_field_tag 'password_confirmation' %></td>
+            <td><%= password_field_tag 'password_confirmation', nil, {:autocomplete => 'off'}  %></td>
           </tr>
           <tr>
             <td></td>
@@ -80,4 +80,4 @@
     <% end %>
   </div>
   
-</div>
\ No newline at end of file
+</div>

diff --git a/sonar-server/src/main/webapp/WEB-INF/app/views/email_configuration/index.html.erb b/sonar-server/src/main/webapp/WEB-INF/app/views/email_configuration/index.html.erb
index f5f7cadd4d10d815656713ef52ba994048d418d9..9b60c65d4d412e5e78e6c90aa0359585b693db31 100644 (file)
--- a/sonar-server/src/main/webapp/WEB-INF/app/views/email_configuration/index.html.erb
+++ b/sonar-server/src/main/webapp/WEB-INF/app/views/email_configuration/index.html.erb
@@ -28,7 +28,7 @@
     </tr>
     <tr class="even">
       <td class="keyCell"><label for="smtp_password"><%= message('email_configuration.smtp_password') -%>:</label></td>
-      <td><%= password_field_tag 'smtp_password', @smtp_password %></td>
+      <td><%= password_field_tag 'smtp_password', @smtp_password, {:autocomplete => 'off'}  %></td>
       <td class="comments"><%= message('email_configuration.smtp_password.description') -%></td>
     </tr>
     <tr class="odd">
@@ -81,4 +81,4 @@
     </tr>
     </tbody>
   </table>
-</form>
\ No newline at end of file
+</form>

diff --git a/sonar-server/src/main/webapp/WEB-INF/app/views/sessions/login.html.erb b/sonar-server/src/main/webapp/WEB-INF/app/views/sessions/login.html.erb
index d76cdcae929cfdc87c21d6f767c6116177430d53..96a22d0aa70541503f2d8c292834943e1279a875 100644 (file)
--- a/sonar-server/src/main/webapp/WEB-INF/app/views/sessions/login.html.erb
+++ b/sonar-server/src/main/webapp/WEB-INF/app/views/sessions/login.html.erb
@@ -12,7 +12,7 @@
                                                </p>
                                                <h3><%= label_tag message('password') %></h3>
                                                <p>
-                                                       <%= password_field_tag 'password', nil, :style => 'width:200px;' %>
+                                                       <%= password_field_tag 'password', nil, {:style => 'width:200px;', :autocomplete => 'off'} %>
                                                </p>
                                                <p>
                                                        <%= check_box_tag 'remember_me', '1', @remember_me %> <%= label_tag 'remember_me', message('sessions.remember_me') %>
@@ -28,4 +28,4 @@
                        </td>
                </tr>
        </table>
-  <script>$j('#login').focus()</script>
\ No newline at end of file
+  <script>$j('#login').focus()</script>

diff --git a/sonar-server/src/main/webapp/WEB-INF/app/views/sessions/new.html.erb b/sonar-server/src/main/webapp/WEB-INF/app/views/sessions/new.html.erb
index e3a9b97b70215688dbdf2d1ef8b81872ee707183..45570058e0b2d6eda17db9d50742e167a7257876 100644 (file)
--- a/sonar-server/src/main/webapp/WEB-INF/app/views/sessions/new.html.erb
+++ b/sonar-server/src/main/webapp/WEB-INF/app/views/sessions/new.html.erb
@@ -16,7 +16,7 @@
           </p>
           <h3><%= label_tag message('password') %></h3>
           <p>
-            <%= password_field_tag 'password', nil, :style => 'width:200px;' %>
+            <%= password_field_tag 'password', nil, {:style => 'width:200px;', :autocomplete => 'off'} %>
           </p>
           <p>
             <%= check_box_tag 'remember_me', '1', @remember_me %> <%= label_tag 'remember_me', message('sessions.remember_me') %>

diff --git a/sonar-server/src/main/webapp/WEB-INF/app/views/users/index.html.erb b/sonar-server/src/main/webapp/WEB-INF/app/views/users/index.html.erb
index dda97c73c5ea34375148129b2cdde840cd4459e1..0896b84153d3eeb4683b52dcda8e2cc0cdb1e045 100644 (file)
--- a/sonar-server/src/main/webapp/WEB-INF/app/views/users/index.html.erb
+++ b/sonar-server/src/main/webapp/WEB-INF/app/views/users/index.html.erb
@@ -95,17 +95,17 @@
         <% end %>
         <% if !@user.id %>
         <tr>
-          <td class="left" valign="top">Password:<br/><%= f.password_field :password, :size => 30, :maxLength => 50 %></td>
+          <td class="left" valign="top">Password:<br/><%= f.password_field :password, :size => 30, :maxLength => 50, :autocomplete => 'off' %></td>
         </tr>
         <tr>
-          <td class="left" valign="top">Confirm password:<br/><%= f.password_field :password_confirmation, :size => 30, :maxLength => 50 %></td>
+          <td class="left" valign="top">Confirm password:<br/><%= f.password_field :password_confirmation, :size => 30, :maxLength => 50, :autocomplete => 'off' %></td>
         </tr>
         <% elsif params[:action] == 'change_password' %>
         <tr>
-          <td class="left" valign="top">New password:<br/><%= f.password_field :password, :size => 30, :maxLength => 50 %></td>
+          <td class="left" valign="top">New password:<br/><%= f.password_field :password, :size => 30, :maxLength => 50, :autocomplete => 'off' %></td>
         </tr>
         <tr>
-          <td class="left" valign="top">Confirm new password:<br/><%= f.password_field :password_confirmation, :size => 30, :maxLength => 50 %></td>
+          <td class="left" valign="top">Confirm new password:<br/><%= f.password_field :password_confirmation, :size => 30, :maxLength => 50, :autocomplete => 'off' %></td>
         </tr>
         <% end %>
       <% end %>

diff --git a/sonar-server/src/main/webapp/WEB-INF/app/views/users/new.html.erb b/sonar-server/src/main/webapp/WEB-INF/app/views/users/new.html.erb
index e53d6638f74e532e4b9b7ad7026dd238f3312e79..e959153ff734fbc694198e68cffdc2fb5320165f 100644 (file)
--- a/sonar-server/src/main/webapp/WEB-INF/app/views/users/new.html.erb
+++ b/sonar-server/src/main/webapp/WEB-INF/app/views/users/new.html.erb
@@ -14,11 +14,11 @@
             <input id="user_name" name="user[name]" size="30" type="text"/>
           </p>
           <h3><%= label_tag 'user_password', message('password') %></h3>
-          <p><input id="user_password" maxLength="50" name="user[password]" size="30" type="password"/></p>
+          <p><input id="user_password" maxLength="50" name="user[password]" size="30" type="password" autocomplete="off"/></p>
 
           <h3><%= label_tag 'user_password_confirmation', message('sessions.confirm_password') %></h3>
           <p>
-            <input id="user_password_confirmation" maxLength="50" name="user[password_confirmation]" size="30" type="password"/>
+            <input id="user_password_confirmation" maxLength="50" name="user[password_confirmation]" size="30" type="password" autocomplete="off"/>
           </p>
           <p>
             <%= submit_tag message('sessions.sign_up') %> <a href="<%= home_path -%>" class="action"><%= message('cancel') -%></a>