log1x / acf-encrypted-password Goto Github PK

Description
If a encrypted password field is saved with a value, it is not possible to remove that value again without removing the post/term/user and adding it again.
It is instead saved with the same value as before the removal of the password.

This is because the EncryptedPassword::update_value(); function does not properly handle empty values.

How to replicate

1. Create an encrypted password field, and assign it to a post type or taxonomy.
2. Create a post or term, with a value in the password field.
3. Save it
4. Return to another admin screen
5. Edit the same post/term
6. Empty the field and save again.

What can be done to fix this

The following snippet should be added to the function update_value(); in fields/encrypted-password.php at line 99

// Allow empty values to be stored
// e.g if the user removes the password
if( trim( $value ) == '' ) {
        return '';
}