I've had problems with my joomla username / password finding its way into the configuration.php file under the FTP username / pass fields in my recent J3.x sites. I haven't had this same issue with the SMTP fields as suggested by the post, just the FTP credentials. I'm guessing the name / id of those fields is getting picked up on my by browser's auto-complete fields.
What is frustrating with 3.x is that the fields are hidden by default, but it appears that the browser is still inserting the u/p into the hidden fields. As an end user browsing the global configuration page, I don't even have to do anything - just open that page up, and poof, it's sending my credentials into the fields. Its gotten to the point where i have to open up that tab and explicitly clear those fields out if I plan on saving any changes just to be sure that they don't get in there.
I understand how to change that in my browser settings (well, in theory, I haven't tried it yet, but I'm hoping it can differentiate between domain.com/administrator/index.php and domain.com/administrator/index.php?option=com_config when setting up rules for auto-complete.
That won't however help fix the issue with my clients who are universally less savvy.
Am I doing it wrong? Is there a way to help get this fixed? Do I have to manually fix it in the XML ( /administrator/components/com_config/models/forms/application.xml ) every time?