Text in password TextField disappears when disabled

When a password TextField is disabled the text in that field is removed. Is this the correct behaviour? I’ve created a Feedback report to fix it in case it isn’t.

Method:
Create a new desktop app. Add a check box and text field. Set the text field to Password. Set the text field to be enabled/disabled when the check box is clicked.
Run and type some text into the text field. Click the check box. When the password field is disabled, the text is removed.

<https://xojo.com/issue/43321>

In XOJO 2016r1, under OSX
I created a new project, added a text field, and checkbox
set the checkbox action to be

TextField1.Password=me.value

and everything works exactly as I would expect. The text does NOT vanish… it simply changes from clear text to dots depending on the state of the checkbox…

I downloaded the project from the bug report. What David Cox is doing is just the same, but with the enabled property. Indeed, when the textfield is disabled, the Text property gets emptied.

Not quite sure it is a bug, though. By definition, a password field is usually never kept full beyond login. It may be a security feature.

It is fairly easy to shadow the value and reinstate it when the TextField is enabled again.

Yup… changing ENABLED does make it vanish… personal opinion… since it is masked (*****) why does it “need” to vanish

I stumbled on this bug also.
A workaround is to set it before you disable the field.

so:
myTextField.Text = myTextField.Text
myTextField.Enabled = Me.Value

I have a checkbox labelled ‘Encrypt Password’ in which the user can decide to add encryption to a DMG they create. When unchecked it disables the textfield to show the user that the entry will serve no purpose. I can think of no reason why it should empty the TextField, so I will leave the FeedBack report as a bug report.

On Windows 10, any text I type into the field remains in the field regardless of the enabled status from the checkbox. The text that is showing in the field is the Cue Text and it disappears when the field is disabled and returns when the field is re-enabled. If I turn the password property off, the cue text still disappears with the field being disabled and returns with the enabling of the field. At no time do I see text I type, or the ***s if Password is on, totally disappearing.

[h]This is not a Xojo bug, this is data security on OS X[/h]

“Password Fields” on OS X are actually a class unto themselves and are very secure. If you begin editing in a secured field, apps that ask for keyboard events no longer receive them until you exit the field. It was actually an issue for an older version of 1Password.

I have made a native Cocoa application to show this isn’t a Xojo behavior. By retaining the password in the field when it’s disabled you are potentially exposing your users to unnecessary security risks. Load the field with garbage after it’s disabled if you absolutely must have a placeholder, and do not load it with their actual password.

You can download the native app, and the four lines of source here: PasswordSecurity.zip (40kb)

I repeat, this is not a bug in Xojo, and I plead that the behavior not be circumvented.

Thanks to everyone who contributed. On the Mac it’s a security feature, not a bug!