password fields are visible thanks to "set default"

[Antoine(OpenERP)]

On your database
1. load a module with password fields (like import_google)
2. Set information on user form like login and pass of google
3. If you have access to "set default", e.g as an admin, you potentially have access to all the google accounts of your members.

I don't know if it's specifically the import_google or the webclient in general that should be checked, but I think it's a security issue.

[Raphaël Valyi - http://www.akretion.com (rvalyi)]

Hello Antoine,

moreover, in general it's also against the Term Of Service of Google to build a web application that ask Google account and store the password somewhere. Google recommend using OAuth instead, that is asking to login if session has expired, getting a token to perform the operations, but NOT storing the Google password. So even if they fix this gross bug, anybody with access to the database or to the code would still too easily rip all employee's passwords.

[ajay javiya (OpenERP) (aja-openerp)]

Hello Antoine,
We have checked issue in latest trunk and reproduced it.
I agree with you password field should not allow to set as default .
I have fix this issue and attached a patch with this comment for trunk.
Thank You

[ajay javiya (OpenERP) (aja-openerp)]

Hello ,
Fix this issue on branch https://code.launchpad.net/~openerp-dev/openerp-web/trunk-bug-1015092-aja for trunk.
Please ignore comment #2 .
Thank You.