From 2dc0dc6293c8d01aab2bbdbadb63da52857024a3 Mon Sep 17 00:00:00 2001
From: Dan Poltawski <dan@moodle.com>
Date: Thu, 15 Jun 2017 12:54:58 +0100
Subject: [PATCH] MDL-57021 passwords: only use unmask field with shared
 secrets

When a user is entering a password which isn't returned back to them
then its not correct to use the unmask element - this element was
designed for places where we are storing shared secrets.
---
 enrol/guest/locallib.php | 2 +-
 enrol/self/locallib.php  | 2 +-
 login/signup_form.php    | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/enrol/guest/locallib.php b/enrol/guest/locallib.php
index b1757a71808..934d47a7e70 100644
--- a/enrol/guest/locallib.php
+++ b/enrol/guest/locallib.php
@@ -38,7 +38,7 @@ class enrol_guest_enrol_form extends moodleform {
         $heading = $plugin->get_instance_name($instance);
         $mform->addElement('header', 'guestheader', $heading);
 
-        $mform->addElement('passwordunmask', 'guestpassword', get_string('password', 'enrol_guest'));
+        $mform->addElement('password', 'guestpassword', get_string('password', 'enrol_guest'));
 
         $this->add_action_buttons(false, get_string('submit'));
 
diff --git a/enrol/self/locallib.php b/enrol/self/locallib.php
index a60224e1acc..dc17af1f682 100644
--- a/enrol/self/locallib.php
+++ b/enrol/self/locallib.php
@@ -78,7 +78,7 @@ class enrol_self_enrol_form extends moodleform {
 
         if ($instance->password) {
             // Change the id of self enrolment key input as there can be multiple self enrolment methods.
-            $mform->addElement('passwordunmask', 'enrolpassword', get_string('password', 'enrol_self'),
+            $mform->addElement('password', 'enrolpassword', get_string('password', 'enrol_self'),
                     array('id' => 'enrolpassword_'.$instance->id));
             $context = context_course::instance($this->instance->courseid);
             $keyholders = get_users_by_capability($context, 'enrol/self:holdkey', user_picture::fields('u'));
diff --git a/login/signup_form.php b/login/signup_form.php
index 07980d8bc0f..f0a33a37844 100644
--- a/login/signup_form.php
+++ b/login/signup_form.php
@@ -46,7 +46,7 @@ class login_signup_form extends moodleform implements renderable, templatable {
         if (!empty($CFG->passwordpolicy)){
             $mform->addElement('static', 'passwordpolicyinfo', '', print_password_policy());
         }
-        $mform->addElement('passwordunmask', 'password', get_string('password'), 'maxlength="32" size="12"');
+        $mform->addElement('password', 'password', get_string('password'), 'maxlength="32" size="12"');
         $mform->setType('password', core_user::get_property_type('password'));
         $mform->addRule('password', get_string('missingpassword'), 'required', null, 'client');