search

ushahidi / crowdmap-issues

A centralized repository for filing, tracking and discussing bugs and features in Crowdmap.com and Crowdmap's API.
0 stars 2 forks source link

Failed crowdmap login repopulates password field #361

Closed shadowhand closed 10 years ago

shadowhand commented 10 years ago

A failed login attempt should never repopulate a password input, as it can be combined with an XSS vector to scrape user passwords. When login returns with failure, the password input should be immediately cleared.

evansims commented 10 years ago

We never repopulate password fields, actually; the login process is done via a background ajax request so the page never reloads. You're right though we should be clearing that field after failed attempts. I'll ensure this gets in with the design update.

evansims commented 10 years ago

Confirmed fixed in forthcoming UI update.