Description Geoff Waymark 2014-12-01 11:55:57 EST

If a user creates a job with a password parameter which stores a default password another user with only Build and Read privileges can read that stored password from the DOM.

This is the contents of of the inspected password element
<td class="setting-main">

    <div name="parameter" description="Test Password">
        <input type="hidden" value="TEST_PWD" name="name"></input>
        <input class="setting-input " type="password" value="OhNo!" name="value"></input>
    </div>

</td>

Steps to reproduce
1. Turn on security and create two users, one with all rights and one with only Overall Read, and Job, Read and Build.
2. As the privileged user create a job that takes a password parameter and store a default password against it.
3. As the restricted user build the job, on the parameter page inspect the properties of the password field. The class has the value shown in plain text. (see above)