Hi folks, I've noticed something that concerns me a little - it's quite obscure but I would have thought it would be undesirable?  If you fail the login credential check, whatever you typed in the password input control is retained.  I noticed this whilst logging into this very site - I have typed my username incorrectly and when the page returned my password was still populated and then when I viewed the page source, there was my password in plain text.  Searching in my browser cache this was also stored on my hard drive in plain text.  I know that this doesn't (by the very nature of the username/password combination failing) give a full set of credentials in one file, but isn't it somewhat undesirable to have this (certainly the password data, anyway) stored in case it, even in the event of an incorrect password, gives anything maliciously scanning the browser cache the potential to piece together login credentials (especially if, for some reason, the cache isn't cleared when the browser closes)?  I notice (as far as I can see with a quick glance) in the DNN source code this seems to be being explicity populated in the login control:-

        Protected Sub Page_PreRender(ByVal sender As Object, ByVal e As System.EventArgs) Handles Me.PreRender
            txtPassword.Attributes.Add("value", txtPassword.Text)
        End Sub

Why is this being done?  Surely most of the time if the password is incorrect the user would just delete it and retype it, and in the case of the username being incorrect they may well retype the password anyway, just to make sure, as it is obscured in the input box?

It's not?  I'm rather confused then - unzipping a vanilla installation from DotNetNuke_Community_05.06.01_Install.zip, running the auto config from the startup page then logging in with non-existent credentials seems to suggest otherwise?  If I login with an invalid credential combination it retains the password I entered and this is visible in plain text in the page source.  Also, looking in the unzipped DotNetNuke_Community_05.06.02_Source.zip in the file DotNetNuke_Community_05.06.02_Source\Website\DesktopModules\AuthenticationServices\DNN\Login.ascx.vb you see the code I quoted above.  This happens (to me, at least) logging in on this site, so it looks like standard behaviour to me - or am I missing something?

this issue is on our list to fix for 5.6.3/6.0.

---

Buy the new Professional DNN7: Open Source .NET CMS Platform book Amazon US