Passing password to login form via GET?

[kenw232]

I noticed going to a URL like this will auto-populate the username but not the password:
http://demo.roundcube.net/mail/[email protected]&_pass=demopwd

Any easy way to get the latest version of roundcube to auto-populate _pass too?

[SKaero]

Thats a terrible way to pass a password. If you want to do something like that use the http_authentication plugin.

[kenw232]

why is it so bad?  its just passing a string into a input's "value" variable.  not a big deal.  much easier then some plugin I have to fight.

In fact add this to the top of index.php and now the get variable of _user= can now just be user= without the _

if ($_GET['user'] <> "") : $_GET['_user'] = $_GET['user']; endif;

[SKaero]

Passing the password in the get sting puts it in the browser history and passed the password in clear text as part of the request. Its highly insecure.