From 5364193759f266e0c07128de2a7b6b54a82ef736 Mon Sep 17 00:00:00 2001
From: mdipierro <massimo.dipierro@gmail.com>
Date: Wed, 27 Aug 2014 14:35:36 -0500
Subject: [PATCH] revent register and other form from ever sending back a
 password, thanks Anthony

---
 gluon/html.py    |  6 +++++-
 gluon/main.py    |  4 ++--
 gluon/sqlhtml.py | 11 ++++-------
 gluon/tools.py   |  1 +
 4 files changed, 12 insertions(+), 10 deletions(-)

diff --git a/gluon/html.py b/gluon/html.py
index ee021da1..50ca9054 100644
--- a/gluon/html.py
+++ b/gluon/html.py
@@ -109,6 +109,7 @@ __all__ = [
     'embed64',
 ]
 
+DEFAULT_PASSWORD_DISPLAY = '*' * 8
 
 def xmlescape(data, quote=True):
     """
@@ -1858,7 +1859,7 @@ class INPUT(DIV):
                     break
         if not name in self.errors:
             self.vars[name] = value
-            return True
+            return True        
         return False
 
     def _postprocessing(self):
@@ -1889,12 +1890,15 @@ class INPUT(DIV):
                 self['_checked'] = 'checked'
             else:
                 self['_checked'] = None
+        elif t == 'password' and value != DEFAULT_PASSWORD_DISPLAY:
+            self['value'] = ''
         elif not t == 'submit':
             if value is None:
                 self['value'] = _value
             elif not isinstance(value, list):
                 self['_value'] = value
 
+
     def xml(self):
         name = self.attributes.get('_name', None)
         if name and hasattr(self, 'errors') \
diff --git a/gluon/main.py b/gluon/main.py
index 9e13058a..2b35c7da 100644
--- a/gluon/main.py
+++ b/gluon/main.py
@@ -365,9 +365,9 @@ def wsgibase(environ, responder):
                     client = client,
                     folder = abspath('applications', app) + os.sep,
                     ajax = x_req_with == 'xmlhttprequest',
-                    cid = env.http_web2py_component_element,
+                    cid = env.http_web2py_component_element,                    
                     is_local = (env.remote_addr in local_hosts and 
-                                request.client == env.remote_addr),
+                                client == env.remote_addr),
                     is_shell = cmd_opts and cmd_opts.shell,
                     is_sheduler = cmd_opts and cmd_opts.scheduler,
                     is_https = env.wsgi_url_scheme in HTTPS_SCHEMES or \
diff --git a/gluon/sqlhtml.py b/gluon/sqlhtml.py
index e5416345..5254db55 100644
--- a/gluon/sqlhtml.py
+++ b/gluon/sqlhtml.py
@@ -19,7 +19,7 @@ from gluon.http import HTTP
 from gluon.html import XmlComponent
 from gluon.html import XML, SPAN, TAG, A, DIV, CAT, UL, LI, TEXTAREA, BR, IMG, SCRIPT, P
 from gluon.html import FORM, INPUT, LABEL, OPTION, SELECT, COL, COLGROUP
-from gluon.html import TABLE, THEAD, TBODY, TR, TD, TH, STYLE
+from gluon.html import TABLE, THEAD, TBODY, TR, TD, TH, STYLE, DEFAULT_PASSWORD_DISPLAY
 from gluon.html import URL, truncate_string, FIELDSET
 from gluon.dal import DAL, Field, Table, Row, CALLABLETYPES, smart_query, \
     bar_encode, Reference, Expression, SQLCustomType, sqlhtml_validators, \
@@ -474,8 +474,6 @@ class CheckboxesWidget(OptionsWidget):
 class PasswordWidget(FormWidget):
     _class = 'password'
 
-    DEFAULT_PASSWORD_DISPLAY = 8 * ('*')
-
     @classmethod
     def widget(cls, field, value, **attributes):
         """
@@ -488,7 +486,7 @@ class PasswordWidget(FormWidget):
         # detect if attached a IS_STRONG with entropy
         default = dict(
             _type='password',
-            _value=(value and cls.DEFAULT_PASSWORD_DISPLAY) or '',
+            _value=(value and DEFAULT_PASSWORD_DISPLAY) or '',
         )
         attr = cls._attributes(field, default, **attributes)
 
@@ -1233,7 +1231,7 @@ class SQLFORM(FORM):
             elif field.type == 'password':
                 inp = self.widgets.password.widget(field, default)
                 if self.record:
-                    dspval = PasswordWidget.DEFAULT_PASSWORD_DISPLAY
+                    dspval = DEFAULT_PASSWORD_DISPLAY
                 else:
                     dspval = ''
             elif field.type == 'blob':
@@ -1548,8 +1546,7 @@ class SQLFORM(FORM):
                 else:
                     self.vars[fieldname] = fields[fieldname] = False
             elif field.type == 'password' and self.record\
-                and request_vars.get(fieldname, None) == \
-                    PasswordWidget.DEFAULT_PASSWORD_DISPLAY:
+                and request_vars.get(fieldname, None) == DEFAULT_PASSWORD_DISPLAY:
                 continue  # do not update if password was not changed
             elif field.type == 'upload':
                 f = self.vars[fieldname]
diff --git a/gluon/tools.py b/gluon/tools.py
index 58d35465..0f55fbb6 100644
--- a/gluon/tools.py
+++ b/gluon/tools.py
@@ -2780,6 +2780,7 @@ class Auth(object):
             else:
                 next = replace_id(next, form)
             redirect(next, client_side=self.settings.client_side)
+        
         return form
 
     def is_logged_in(self):