Merge pull request #48 from phpmyadmin/security-45

Fix issue #45 input types in setup script

ChangeLog

@@ -12,6 +12,7 @@ phpMyAdmin - ChangeLog
 - issue #12308 Fix division by zero in case of misconfigured MySQL server
 - issue #12317 Fix editing server variables
 - issue #12303 Fix table size calculation in some circumstances
+- issue        Setup script did not properly use input type password for some input types
 
 4.6.2 (2016-05-25)
 - issue        [security] User SQL queries can be revealed through URL GET parameters, see PMASA-2016-14

libraries/config/FormDisplay.php

@@ -437,7 +437,9 @@ class FormDisplay
 
         // detect password fields
         if ($type === 'text'
-            && mb_substr($translated_path, -9) === '-password'
+            && (mb_substr($translated_path, -9) === '-password'
+               || mb_substr($translated_path, -4) === 'pass'
+               || mb_substr($translated_path, -4) === 'Pass')
         ) {
             $type = 'password';
         }