From d76496ba1d11de13ba1f982a462e014f9d923b29 Mon Sep 17 00:00:00 2001 From: Isaac Bennetch Date: Tue, 14 Jun 2016 22:53:31 -0400 Subject: [PATCH] Setup script did not properly use input type password in all cases Signed-off-by: Isaac Bennetch --- ChangeLog | 1 + libraries/config/FormDisplay.php | 4 +++- 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index 4858f2ea7c..fc694881fe 100644 --- a/ChangeLog +++ b/ChangeLog @@ -12,6 +12,7 @@ phpMyAdmin - ChangeLog - issue #12308 Fix division by zero in case of misconfigured MySQL server - issue #12317 Fix editing server variables - issue #12303 Fix table size calculation in some circumstances +- issue Setup script did not properly use input type password for some input types 4.6.2 (2016-05-25) - issue [security] User SQL queries can be revealed through URL GET parameters, see PMASA-2016-14 diff --git a/libraries/config/FormDisplay.php b/libraries/config/FormDisplay.php index 80974e93ef..ab02fa1f70 100644 --- a/libraries/config/FormDisplay.php +++ b/libraries/config/FormDisplay.php @@ -437,7 +437,9 @@ class FormDisplay // detect password fields if ($type === 'text' - && mb_substr($translated_path, -9) === '-password' + && (mb_substr($translated_path, -9) === '-password' + || mb_substr($translated_path, -4) === 'pass' + || mb_substr($translated_path, -4) === 'Pass') ) { $type = 'password'; }