Zend Framework

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Not an Issue
• Affects Version/s: 1.10.2
• Fix Version/s: 1.10.4
• Component/s: Zend_Validate
• Labels:

  None

When using Zend_Validate_Identical on password fields, setting ObscureValue to true does not hide the token used to compare the value of the field in error message.

$passwd = new Zend_Form_Element_Password('passwd');
$passwd->addValidator('NotEmpty')
	->addValidator('StringLength', false, array(6, 20))
	->setRequired(true)
	->setLabel('New password')
		
$confirm = new Zend_Form_Element_Password('confirm');
$confirm->addValidator('NotEmpty')
	->addValidator('Identical')
	->setRequired(true)
	->setLabel('Confirm password');

$validator = $confirm->getValidator('Identical');
$validator->setObscureValue(true);

If the two fields are not identical the resulting error message is:

The token 'tester' does not match the given token '********'

where 'tester' is the value passed to setToken().

The error message would also be adapted when ObscureValue is set to true to a shorter one like 'The values did not match'

• Assignee:

  Thomas Weidner

  Reporter:

  Nicolas GRIMLER

• Created:

  26/Apr/10 2:04 PM

  Updated:

  26/Apr/10 2:15 PM

  Resolved:

  26/Apr/10 2:15 PM