[ThomasDaSilva]

The configuration form showed the Colissimo contract password in clear text: a text field filled with the saved value, so it was on screen and in the page source.

Changes

• The field is a password field and the saved value is never sent back to the browser.
• An empty field keeps the saved password (ColissimoLabel::passwordToSave()). The field is required only while no password is saved.
• A help line under the field says so, in English and French, linked to the field with aria-describedby.
• autocomplete="new-password" keeps the browser from filling in the administrator's own password, which would overwrite the Colissimo one on save.
• Version 3.1.1, with a line in the Readme.

Tests

• tests/ContractPasswordTest.php: 5 cases (empty or missing field keeps the password, a new value replaces it, first save, nothing saved). It fails when passwordToSave() returns the submitted value as is. The module suite passes, 22 tests.
• Checked in the default-twig back office, with a password saved: the field is empty, the value is not in the page HTML, saving with the field empty keeps it, saving a new value replaces it.