From dc6a12f14b9ef3b1d27df97203cc925c73f5f79b Mon Sep 17 00:00:00 2001
From: Laurent Peuch <cortex@worlddomination.be>
Date: Mon, 1 Jun 2020 12:02:04 +0200
Subject: [PATCH] [mod] password argument can't have a default value

---
 locales/en.json                                   | 1 +
 src/yunohost/app.py                               | 8 ++++++++
 src/yunohost/tests/test_apps_arguments_parsing.py | 1 -
 3 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/locales/en.json b/locales/en.json
index 851656532..5952e8b2a 100644
--- a/locales/en.json
+++ b/locales/en.json
@@ -13,6 +13,7 @@
     "app_already_up_to_date": "{app:s} is already up-to-date",
     "app_argument_choice_invalid": "Use one of these choices '{choices:s}' for the argument '{name:s}'",
     "app_argument_invalid": "Pick a valid value for the argument '{name:s}': {error:s}",
+    "app_argument_password_no_default": "Error while parsing password argument '{name}': password argument can't have a default value for security reason",
     "app_argument_required": "Argument '{name:s}' is required",
     "app_change_url_failed_nginx_reload": "Could not reload NGINX. Here is the output of 'nginx -t':\n{nginx_errors:s}",
     "app_change_url_identical_domains": "The old and new domain/url_path are identical ('{domain:s}{path:s}'), nothing to do.",
diff --git a/src/yunohost/app.py b/src/yunohost/app.py
index 027a3a558..4ec043687 100644
--- a/src/yunohost/app.py
+++ b/src/yunohost/app.py
@@ -2468,6 +2468,14 @@ class PasswordArgumentParser(YunoHostArgumentFormatParser):
     argument_type = "password"
     default_value = ""
 
+    def parse_question(self, question, user_answers):
+        question = super(PasswordArgumentParser, self).parse_question(question, user_answers)
+
+        if question.default is not None:
+            raise YunohostError('app_argument_password_no_default', name=question.name)
+
+        return question
+
 
 class PathArgumentParser(YunoHostArgumentFormatParser):
     argument_type = "path"
diff --git a/src/yunohost/tests/test_apps_arguments_parsing.py b/src/yunohost/tests/test_apps_arguments_parsing.py
index 5eed5bdfe..7b835c410 100644
--- a/src/yunohost/tests/test_apps_arguments_parsing.py
+++ b/src/yunohost/tests/test_apps_arguments_parsing.py
@@ -276,7 +276,6 @@ def test_parse_args_in_yunohost_format_password_optional_with_input_without_ask(
         assert _parse_args_in_yunohost_format(answers, questions) == expected_result
 
 
-@pytest.mark.skip  # this should raises
 def test_parse_args_in_yunohost_format_password_no_input_default():
     questions = [
         {