From 60a1fce2d18886cca699b965f4ff1cd2939ed8d1 Mon Sep 17 00:00:00 2001
From: Laurent Destailleur <eldy@destailleur.fr>
Date: Tue, 6 Aug 2013 17:26:05 +0200
Subject: [PATCH] Sec: Do not autofill password for remote access
---
htdocs/install/fileconf.php | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/htdocs/install/fileconf.php b/htdocs/install/fileconf.php
index 7a8e1ad1ee9..e54a3275703 100644
--- a/htdocs/install/fileconf.php
+++ b/htdocs/install/fileconf.php
@@ -456,7 +456,6 @@ if (! empty($force_install_message))
-->
</tr>
-
<tr class="hidesqlite hideroot">
<td class="label" valign="top"><b><?php echo $langs->trans("Password"); ?></b>
</td>
@@ -464,7 +463,8 @@ if (! empty($force_install_message))
id="db_pass_root" name="db_pass_root" class="needroot"
value="<?php
$autofill=((! empty($db_pass_root))?$db_pass_root:$force_install_databaserootpass);
- if (! empty($dolibarr_main_prod)) $autofill='';
+ if (! empty($dolibarr_main_prod)) $autofill=''; // Do not autofill password if instance is a production instance
+ if (! empty($_SERVER["SERVER_NAME"]) && ! in_array($_SERVER["SERVER_NAME"], array('127.0.0.1', 'localhost'))) $autofill=''; // Do not autofill password for remote access
print dol_escape_htmltag($autofill);
?>"></td>
<td class="comment"><?php echo $langs->trans("KeepEmptyIfNoPassword"); ?>
--
GitLab