{"action":"created","issue":{"url":"https://api.github.com/repos/wtforms/wtforms/issues/446","repository_url":"https://api.github.com/repos/wtforms/wtforms","labels_url":"https://api.github.com/repos/wtforms/wtforms/issues/446/labels{/name}","comments_url":"https://api.github.com/repos/wtforms/wtforms/issues/446/comments","events_url":"https://api.github.com/repos/wtforms/wtforms/issues/446/events","html_url":"https://github.com/wtforms/wtforms/pull/446","id":355856428,"node_id":"MDExOlB1bGxSZXF1ZXN0MjEyMjg2OTUx","number":446,"title":"undo changes in 2.2.1 for PasswordField","user":{"login":"seanbudd","id":7090342,"node_id":"MDQ6VXNlcjcwOTAzNDI=","avatar_url":"https://avatars0.githubusercontent.com/u/7090342?v=4","gravatar_id":"","url":"https://api.github.com/users/seanbudd","html_url":"https://github.com/seanbudd","followers_url":"https://api.github.com/users/seanbudd/followers","following_url":"https://api.github.com/users/seanbudd/following{/other_user}","gists_url":"https://api.github.com/users/seanbudd/gists{/gist_id}","starred_url":"https://api.github.com/users/seanbudd/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/seanbudd/subscriptions","organizations_url":"https://api.github.com/users/seanbudd/orgs","repos_url":"https://api.github.com/users/seanbudd/repos","events_url":"https://api.github.com/users/seanbudd/events{/privacy}","received_events_url":"https://api.github.com/users/seanbudd/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":3,"created_at":"2018-08-31T06:33:41Z","updated_at":"2018-10-04T02:02:20Z","closed_at":null,"author_association":"NONE","pull_request":{"url":"https://api.github.com/repos/wtforms/wtforms/pulls/446","html_url":"https://github.com/wtforms/wtforms/pull/446","diff_url":"https://github.com/wtforms/wtforms/pull/446.diff","patch_url":"https://github.com/wtforms/wtforms/pull/446.patch"},"body":"The update 2.2.1 now sets the PasswordField using existing data.\r\n\r\ne.g. on my test environment when saving a form with a change password section but the password change UI fields are empty, the PasswordField data is the password hash. "},"comment":{"url":"https://api.github.com/repos/wtforms/wtforms/issues/comments/426860847","html_url":"https://github.com/wtforms/wtforms/pull/446#issuecomment-426860847","issue_url":"https://api.github.com/repos/wtforms/wtforms/issues/446","id":426860847,"node_id":"MDEyOklzc3VlQ29tbWVudDQyNjg2MDg0Nw==","user":{"login":"seanbudd","id":7090342,"node_id":"MDQ6VXNlcjcwOTAzNDI=","avatar_url":"https://avatars0.githubusercontent.com/u/7090342?v=4","gravatar_id":"","url":"https://api.github.com/users/seanbudd","html_url":"https://github.com/seanbudd","followers_url":"https://api.github.com/users/seanbudd/followers","following_url":"https://api.github.com/users/seanbudd/following{/other_user}","gists_url":"https://api.github.com/users/seanbudd/gists{/gist_id}","starred_url":"https://api.github.com/users/seanbudd/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/seanbudd/subscriptions","organizations_url":"https://api.github.com/users/seanbudd/orgs","repos_url":"https://api.github.com/users/seanbudd/repos","events_url":"https://api.github.com/users/seanbudd/events{/privacy}","received_events_url":"https://api.github.com/users/seanbudd/received_events","type":"User","site_admin":false},"created_at":"2018-10-04T02:02:20Z","updated_at":"2018-10-04T02:02:20Z","author_association":"NONE","body":">I don't understand this change. Are you observing password data actually being leaked?\r\n\r\nYep, I was testing 2.2.1. I noticed that the hashes were being revealed in the form as a default value. I can create a minimal example if required. \r\n\r\n>The PasswordInput widget that actually renders the field should hide this by default.\r\n\r\nInteresting, maybe my fix isn't the best approach then?\r\n\r\n>For future reference when you report issues, if this is actually a security issue, announcing it publicly is not the correct way to report it. \r\n\r\nFor sure - I feel like a bit of an idiot for doing it this way, I didn't release this could be an actual security issue until this week, as it's not a huge issue unless you are using bad practices already. "}}
{"actor":{"display_login":"seanbudd"}}