Preventing auto-filling of passwords in config #4362

We previously had set autocomplete="off" on password fields, but
browsers seem to ignore that now.

MDN suggests [1] to use autocomplete="new-pas

Preventing auto-filling of passwords in config #4362

We previously had set autocomplete="off" on password fields, but
browsers seem to ignore that now.

MDN suggests [1] to use autocomplete="new-password", so that's what's
used now. In addition autocomplete="off" is set on the form as a whole.

Will that fix the issue once and for all? Doubtful:

> This attribute is a hint to browsers; some may not comply with it.

[1] https://developer.mozilla.org/en-US/docs/Web/Security/Practical_implementation_guides/Turning_off_form_autocompletion

show more ...

don't break config manager if plugin renderer fails to load #4084

Use str_starts_with/str_ends_with

code style: line breaks

code style: static visibility

coding style: control flow line breaks

coding style: control flow whitespaces

codestyle adjustments: function declaration braces/spaces

codestyle adjustments: class declaration braces

Apply rector fixes to config plugin

Fix handling of unknown array settings

When a plugin used an array setting and was then installed, the old
configuration can remain in local.php. It is handled by the
SettingUndefined class. However

Fix handling of unknown array settings

When a plugin used an array setting and was then installed, the old
configuration can remain in local.php. It is handled by the
SettingUndefined class. However this class used the base out() mechanism
which didn't know about arrays. The result was a fatal error resulting
in a completely empty config file.

This moves the error handling from the SettingArray class to the base
class which fixes the original problem.

It also adds a check if the Writer is about to write a completely empty
config file and refuses to do so, throwing an Exception.

Probably related to #3777

show more ...

use https URLs in config manager