Create a 'password' field type

[abass]

When you remove all permissions for a user, they still have access and can edit the MISC sub-category in settings on the backend which is terrible because some really important information that shouldn't be messed around with is there. To name a few plugins:

Google Analytics - Contains tons of keys & codes that will completely break it's dashboard functionality if changed.

Mailchimp - Contains the MailChimp API Key which would be very bad if changed by accident.

Disqus - Contains the Disqus API Site Key that would break comment section if changed.

[daftspunk]

These are concerns that should be raised with the plugins themselves, as they are not secured correctly.

Leaving this open as a reference to fix it.

[LukeTowers]

@LArbearrr this is an expected behaviour, the model's hidden property is only for uses of toArray().

This is not a security concern as client's injecting fields in their own browser has no effect on what October sends the client in terms of model data and if you're talking about plugins extending the fields serverside, well it's much easier for them to just to steal_hashed_passwords(User::all()) then to muck about with changing a field type and going to a my account page, just to obtain their own hashed password.

[Samuell1]

Looking trough source code field type password already exists.

https://github.com/octobercms/october/blob/develop/modules/backend/widgets/form/partials/_field_password.htm

https://octobercms.com/docs/backend/forms#field-password