Bug 378276 - Impossible to tell whether password field shows plaintext with empty content
Summary: Impossible to tell whether password field shows plaintext with empty content
Status: RESOLVED FIXED
Alias: None
Product: frameworks-kwidgetsaddons
Classification: Frameworks and Libraries
Component: general (show other bugs)
Version: 5.32.0
Platform: openSUSE Linux
: NOR normal
Target Milestone: ---
Assignee: Christoph Feck
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2017-03-30 13:42 UTC by Fabian Vogt
Modified: 2017-04-21 12:53 UTC (History)
2 users (show)

See Also:
Latest Commit:
Version Fixed In: 5.34


Attachments
kdialog with echo-mode button always visible in plaintext mode (12.81 KB, image/png)
2017-04-05 16:19 UTC, Elvis Angelaccio
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Fabian Vogt 2017-03-30 13:42:44 UTC
In an application with a password input, like

kdialog --password password

enter a password, enable to show the plaintext and erase the password again.
Now the password input is in the plaintext state, but that is not visibly indicated. Now everything typed into the field appears in plaintext.
Comment 1 Christoph Feck 2017-03-30 16:24:46 UTC
Which would make more sense: reset password visibility to "invisible", whenever all text is removed, or always show the icon with its state, even for empty strings?
Comment 2 Fabian Vogt 2017-03-30 17:05:47 UTC
(In reply to Christoph Feck from comment #1)
> Which would make more sense: reset password visibility to "invisible",
> whenever all text is removed, or always show the icon with its state, even
> for empty strings?

As I do not use the button most of the time, it would just be in the way.
I'd say a combination is the best: Always show the button if it's set to plaintext.
Comment 3 Elvis Angelaccio 2017-04-05 16:19:15 UTC
Created attachment 104893 [details]
kdialog with echo-mode button always visible in plaintext mode

Unfortunately KPasswordDialog uses the clear button, so leaving the echo-mode button visible results in wasted space. Is this acceptable?
Comment 4 Elvis Angelaccio 2017-04-05 16:35:28 UTC
On the other hand, if we reset the visibility status we get the same level of "safety" without this visual glitch.
Comment 5 Fabian Vogt 2017-04-05 17:07:48 UTC
(In reply to Elvis Angelaccio from comment #3)
> Created attachment 104893 [details]
> kdialog with echo-mode button always visible in plaintext mode
> 
> Unfortunately KPasswordDialog uses the clear button, so leaving the
> echo-mode button visible results in wasted space. Is this acceptable?

I would say yes, but that should be coordinated with the fix for bug 378277

(In reply to Elvis Angelaccio from comment #4)
> On the other hand, if we reset the visibility status we get the same level
> of "safety" without this visual glitch.

Yes, but that might be less useful for those with a virtual keyboard who probably need the functionality the most.
Comment 6 Elvis Angelaccio 2017-04-05 17:28:30 UTC
Ok, it's a bit ugly but I think it's possible to work-around the empty space in my previous screenshot. Can you expand on the virtual keyboard argument? Why if I'm uisng a virtual keyboard I would want to always see the visibility icon in "plaintext" mode?

About the QML line edit, at least in the lock screen there is no clear button. No idea about other usages...
Comment 7 Fabian Vogt 2017-04-05 17:30:35 UTC
(In reply to Elvis Angelaccio from comment #6)
> Ok, it's a bit ugly but I think it's possible to work-around the empty space
> in my previous screenshot. Can you expand on the virtual keyboard argument?
> Why if I'm uisng a virtual keyboard I would want to always see the
> visibility icon in "plaintext" mode?

Not that, but you would not want to reset to hidden status after clearing the input field.

> About the QML line edit, at least in the lock screen there is no clear
> button. No idea about other usages...

Just checked in plasma-nm, no clear button either.
Comment 8 Elvis Angelaccio 2017-04-05 17:57:45 UTC
I'm actually wondering if this is a bug in QLineEdit. The clear action is always visible (isVisible() == true) even though is not...
Comment 9 Elvis Angelaccio 2017-04-05 21:25:07 UTC
(In reply to Elvis Angelaccio from comment #8)
> I'm actually wondering if this is a bug in QLineEdit. The clear action is
> always visible (isVisible() == true) even though is not...

Reported upstream: https://bugreports.qt.io/browse/QTBUG-59957

I think we can go with the first approach (always show the button in plaintext mode) + a temporary workaround for the aforementioned bug. Will upload a patch soon.
Comment 10 Elvis Angelaccio 2017-04-21 12:53:33 UTC
Git commit 6976a54f235544575994b77ab86a561d537187e7 by Elvis Angelaccio.
Committed on 21/04/2017 at 12:49.
Pushed by elvisangelaccio into branch 'master'.

KNewPasswordWidget: don't hide visibility action in plaintext mode

Summary:
Otherwise the user cannot tell whether what's going to be typed will be
visible or not. Same fix as in D5312.

Reviewers: cfeck

Subscribers: #frameworks

Tags: #frameworks

Differential Revision: https://phabricator.kde.org/D5530

M  +18   -0    autotests/knewpasswordwidgettest.cpp
M  +1    -0    autotests/knewpasswordwidgettest.h
M  +1    -1    src/knewpasswordwidget.cpp

https://commits.kde.org/kwidgetsaddons/6976a54f235544575994b77ab86a561d537187e7
Comment 11 Elvis Angelaccio 2017-04-21 12:53:33 UTC
Git commit 8a1c758516fd606bce23dd92934d899f119ac49f by Elvis Angelaccio.
Committed on 20/04/2017 at 21:34.
Pushed by elvisangelaccio into branch 'master'.

KPasswordDialog: don't hide visibility action in plaintext mode

Summary:
Otherwise the user cannot tell whether what's going to be typed will be
visible or not.
FIXED-IN: 5.34

Reviewers: cfeck, fvogt

Subscribers: #frameworks

Tags: #frameworks

Differential Revision: https://phabricator.kde.org/D5312

M  +1    -0    autotests/CMakeLists.txt
A  +47   -0    autotests/kpassworddialogautotest.cpp     [License: LGPL (v2+)]
A  +34   -0    autotests/kpassworddialogautotest.h     [License: LGPL (v2+)]
M  +2    -1    src/kpassworddialog.cpp

https://commits.kde.org/kwidgetsaddons/8a1c758516fd606bce23dd92934d899f119ac49f