Id: | 20735 |
Product: | finPOWER Connect |
Type: | NEW |
Version: | 4.00.04 |
Opened: | 18/09/2023 |
Closed: | 26/09/2023 |
Released: | 05/12/2023 |
Job: | J032062 |
![]() |
HTML Widgets; TextBox password fields with creation option "passwordRevealOnFocus: true" may cause Google Chrome to reveal password in plain text
Recently, a "passwordRevealOnFocus" creation option was added to widget.UI.TextBox.
This is designed to be used in places such as Administration forms (e.g., Cost Centre, ABN Lookup) to hide the content of a field when not focused. This is useful for configuring various third party services.
However, the aggressive password management features in the Chrome browser could cause passwords to be revealed in plain text.
To replicate this:
- Edit the Cost Centre, ABN Lookup, Production Credentials
- Focusing on the "User GUID" field would (assuming Chrome had saved passwords), show a dropdown which, when hovered over, would populate the "User GUID", and the "Request URL" fields with a plain text password
Chrome seems to detect HTML input controls with "type='password'" at the time the page is loaded and, regardless of whether they are made non-password fields (as they were being when focused), would still offer up the password manager functionality.
There seemed to be no reliable way to prevent Chrome from doing this so, password fields that have "passwordRevealOnFocus: true", will no longer be password fields but, rather, use the CSS "text-security: disc" styling to hide content. This way, Chrome will no longer detect them as password fields and interfere with them.