Old login password keeps appearing when I login to the admin

[robertp]

When I login to the admin, the old login password appears instead of the new password. I type in the username and the old password appears. I then have to always paste the new password and it works fine. This happens every time I log in. Is there a way to fix this?
I cleared my cache and cookies but it still happens.

[joejoejoe]

It sounds like you have your password saved. Almost all browsers give you this option when you log in to a site. You save it once and then next time you go to the site it autofills for you. You'll have to look at the browser that's doing it, and dig through your security settings until you find password saving and then delete it. Sorry that sounds vague, but each browser is different.

[stevesh]

I don't believe you should be able to save the password in a browser beginning with Zencart version 1.5.0.

[DrByte]

I don't believe you should be able to save the password in a browser beginning with Zencart version 1.5.0.

Correct, unless they're using some sort of password assistance addon like KeepPass, which may auto-insert the password that the user has told it to memorize.

[David Allen]

Correct, unless they're using some sort of password assistance addon like KeepPass, which may auto-insert the password that the user has told it to memorize.

With 1.5, when you do the install the browser will remember (if you let it) the password you used. First time you login to admin you have to change the password, which because of the security in 1.5, doesn't trigger the browser to update it's password. So every time you login the browser will populate the password with the one you used on the original install.
Having noticed this on a couple of installs, I was slightly naughty and on the install used the password I wanted, but missing the last letter. Then I added that letter on the first use password change. Now when i go to admin the browser remembers most of the password and I just add the extra letter.

[DrByte]

Um ... in 1.5, auto-complete=off was set in the admin login fields, so if yours is remembering any of that info, then it's because you've either added something to your browser which overrides that (as I mentioned earlier), or you've changed the PHP code to remove the autocomplete tag (maybe you installed a very old admin skin that doesn't have all the important updates included from 1.5 onward?).
What you describe is not normal.

[David Allen]

Um ... in 1.5, auto-complete=off was set in the admin login fields, so if yours is remembering any of that info, then it's because you've either added something to your browser which overrides that (as I mentioned earlier), or you've changed the PHP code to remove the autocomplete tag (maybe you installed a very old admin skin that doesn't have all the important updates included from 1.5 onward?).
What you describe is not normal.

A fresh clean install of 1.5 will remember the password from the install procedure - mine has.

[David Allen]

A fresh clean install of 1.5 will remember the password from the install procedure - mine has.

Just checked the code -
In zc_install/admin_setup_default.php the admin password is created with this field

<input type="password" id="admin_pass" name="admin_pass" tabindex="2" />

whereas in admin/login.php the code is:

<input style="float: left" type="password" id="admin_pass" name="admin_pass" value="" autocomplete="off" />

So the password can/will be remembered from the install.

Regards
David

[DrByte]

I see.

We'll fix that. Thanks.

Meanwhile, to stop the old password from appearing, delete it from your browser's form autofill history.