Cancelling password update on user-profile fails

[peterwilsoncc]

Cancelling a new password on the user profile form fails.

1. Edit user profile
2. Click Generate Password
3. Click Cancel
4. Submit the form
5. New password is set

Prior to step 1, #pass1's value is empty; following step 3, #pass1 is set, #pass2 is empty.

[peterwilsoncc]

33419.1.diff​ clears the password fields when a user clicks the cancel new password button on the profile page.

Setting milestone and upping severity as inadvertently setting a user's passwords seems to warrant it.

[adamsilverstein]

Good catch @peterwilsoncc, I will test the patch.

Related: #33450.

[adamsilverstein]

This looks good, thanks for catching and fixing this!

I tested this and verified: before the patch, clicking cancel then save resulted in a changed password. With the patch, performing the same sequence the password is not updated.

Thanks!

[SergeyBiryukov]

We could replace $( '#pass1' ) with $pass1, which is set earlier.

I've found another quirk:

1. Click Generate Password.
2. Enter a weak password (e.g. "123").
3. Click Cancel.
4. The Update User button is still inactive after clicking cancel, because "Confirm use of weak password" checkbox was not checked.

33419.2.diff​ fixes that too.

[adamsilverstein]

Nice improvements! Thank you.

Replying to SergeyBiryukov:

We could replace $( '#pass1' ) with $pass1, which is set earlier.

I've found another quirk:

1. Click Generate Password.
2. Enter a weak password (e.g. "123").
3. Click Cancel.
4. The Update User button is still inactive after clicking cancel, because "Confirm use of weak password" checkbox was not checked.

33419.2.diff​ fixes that too.

[SergeyBiryukov]

In 33766:

Prevent unintended password change after clicking "Generate Password" and then "Cancel" when editing a user profile.

props peterwilsoncc.
fixes #33419 for trunk.

[SergeyBiryukov]

In 33980:

Prevent unintended password change after clicking "Generate Password" and then "Cancel" when editing a user profile.

Merges [33766] to the 4.3 branch.

Props peterwilsoncc.
Fixes #33419 for 4.3.1.

[SergeyBiryukov]

In 38494:

Users: After [33766], don't reset the password when clicking "Show Password" and then "Cancel" on Add New User screen.

Props smerriman for reporting.
Fixes #37902. See #33419.