Merge pull request #1854 from drbobrinkman/TRUNK-2877

TRUNK-2877 Don't set password values in the UI in the installation wizard

web/src/main/java/org/openmrs/web/filter/initialization/InitializationFilter.java

@@ -260,6 +260,11 @@ protected void doGet(HttpServletRequest httpRequest, HttpServletResponse httpRes
 			renderTemplate(PROGRESS_VM, referenceMap, httpResponse);
 		} else if (page == null) {
 			httpResponse.setContentType("text/html");// if any body has already started installation
+
+			//If someone came straight here without setting the hidden page input,
+			// then we need to clear out all the passwords
+			clearPasswords();
+
 			renderTemplate(DEFAULT_PAGE, referenceMap, httpResponse);
 		} else if (INSTALL_METHOD.equals(page)) {
 			// get props and render the second page
@@ -358,6 +363,14 @@ private void loadInstallationScriptIfPresent() {
 		}
 	}
 
+	private void clearPasswords(){
+		wizardModel.databaseRootPassword = "";
+		wizardModel.createDatabasePassword = "";
+		wizardModel.createUserPassword = "";
+		wizardModel.currentDatabasePassword = "";
+		wizardModel.remotePassword = "";
+	}
+
 	/**
 	 * Called by {@link #doFilter(ServletRequest, ServletResponse, FilterChain)} on POST requests
 	 *