Security issue: private admin field labels and instructions being leaked in login screen source code

[SimonEast]

I just noticed that when viewing the source code of my Craft login screen, the relabel plugin seems to be dumping all its JSON data there. Since this could potentially include private data that includes field names and instructions intended for admin users only, it would be great if this was excluded from the login screen and any other screens that are potentially accessible by non-admins.

See example here: http://ku.staging7.yump.com.au/admin/login
(will remove this link shortly)

I don't have time right now to submit a patch, but if there is someone else willing to, that would be great.

Simon.

[ttempleton]

This issue has been resolved in the Craft 3 version of the original Relabel, which is now known as Field Labels.