diff --git a/actionpack/CHANGELOG b/actionpack/CHANGELOG
index d7cfad7d6bd7256f4b24dc49f9c83dc93d1fe798..9a58d61f2b778376cca775612d25af836dbfc6df 100644
--- a/actionpack/CHANGELOG
+++ b/actionpack/CHANGELOG
@@ -1,3 +1,5 @@
+* password_field renders with nil value by default making the use of passwords secure by default, if you want to render you should do for instance f.password_field(:password, :value => @user.password) [Santiago Pastorino]
+
* Symbols and strings in routes should yield the same behavior. Note this may break existing apps that were using symbols with the new routes API. [José Valim]
* Add clear_helpers as a way to clean up all helpers added to this controller, maintaing just the helper with the same name as the controller. [José Valim]
diff --git a/actionpack/lib/action_view/helpers/form_helper.rb b/actionpack/lib/action_view/helpers/form_helper.rb
index d749e31e126394e600068bb97a227e7150dd9220..ed836581409a5ab79fd0ba8bde441b90cb533f98 100644
--- a/actionpack/lib/action_view/helpers/form_helper.rb
+++ b/actionpack/lib/action_view/helpers/form_helper.rb
@@ -624,19 +624,19 @@ def text_field(object_name, method, options = {})
#
# ==== Examples
# password_field(:login, :pass, :size => 20)
- # # =>
+ # # =>
#
- # password_field(:account, :secret, :class => "form_input")
+ # password_field(:account, :secret, :class => "form_input", :value => @account.secret)
# # =>
#
# password_field(:user, :password, :onchange => "if $('user[password]').length > 30 { alert('Your password needs to be shorter!'); }")
- # # =>
+ # # =>
#
# password_field(:account, :pin, :size => 20, :class => 'form_input')
- # # =>
+ # # =>
#
def password_field(object_name, method, options = {})
- InstanceTag.new(object_name, method, self, options.delete(:object)).to_input_field_tag("password", options)
+ InstanceTag.new(object_name, method, self, options.delete(:object)).to_input_field_tag("password", { :value => nil }.merge!(options))
end
# Returns a hidden input tag tailored for accessing a specified attribute (identified by +method+) on an object
diff --git a/actionpack/test/template/form_helper_test.rb b/actionpack/test/template/form_helper_test.rb
index 8ba4aa16397a3fac577efa0f9ef3e576da384701..fd801e2a9ec297612f58c341f46b97f752417064 100644
--- a/actionpack/test/template/form_helper_test.rb
+++ b/actionpack/test/template/form_helper_test.rb
@@ -167,7 +167,10 @@ def test_text_field
'', text_field("post", "title")
)
assert_dom_equal(
- '', password_field("post", "title")
+ '', password_field("post", "title")
+ )
+ assert_dom_equal(
+ '', password_field("post", "title", :value => @post.title)
)
assert_dom_equal(
'', password_field("person", "name")