Repository: pallets/click

Issue:
click.prompt(type=int, hide_input=True) outputs rejected input
Despite asking `click.prompt()` to hide input it will still outputs the input if it rejects it.  I get the same behavior for `7.0` from PyPI, `7.x` from Git, and `master` from Git.

```bash
altendky@p1:~$ venv/bin/python -c 'import click; click.prompt("prompt", type=int, hide_input=True)'
prompt: 
Error: wait...  i get to see this? is not a valid integer
prompt:
```

If you specify a type (let's say you are inputting a numeric pin) then the same can happen with `click.password_option()`.

```python3
import click


@click.command()
@click.password_option(type=int)
def cli(password):
    pass


cli()
```

```bash
altendky@p1:~$ venv/bin/python x.py
Password: 
Error: lkjsaf is not a valid integer
Password:
```

The workaround for `click.prompt()` anyways I guess is to not specify a type and to implement the rejection manually.

If there is agreement that this is an issue that should be fixed then I can try to put together a PR for it.
click.prompt(type=int, hide_input=True) outputs rejected input
Despite asking `click.prompt()` to hide input it will still outputs the input if it rejects it.  I get the same behavior for `7.0` from PyPI, `7.x` from Git, and `master` from Git.

```bash
altendky@p1:~$ venv/bin/python -c 'import click; click.prompt("prompt", type=int, hide_input=True)'
prompt: 
Error: wait...  i get to see this? is not a valid integer
prompt:
```

If you specify a type (let's say you are inputting a numeric pin) then the same can happen with `click.password_option()`.

```python3
import click


@click.command()
@click.password_option(type=int)
def cli(password):
    pass


cli()
```

```bash
altendky@p1:~$ venv/bin/python x.py
Password: 
Error: lkjsaf is not a valid integer
Password:
```

The workaround for `click.prompt()` anyways I guess is to not specify a type and to implement the rejection manually.

If there is agreement that this is an issue that should be fixed then I can try to put together a PR for it.


Discussion:
Did you have a fix in mind?

One option is to wrap the call to `type` in `try/except Exception` and output a generic "The value you entered was invalid." if `hide_input` is true.
No, I had not looked at the code or thought about it beyond just making sure the input does not end up in the output.  Sounds like you think the concern is reasonable so I can try to find time to see if I can make a reasonable solution.
When I find time, should I target 7.x or master?
~7.x is fine~ target master now
Did you have a fix in mind?

One option is to wrap the call to `type` in `try/except Exception` and output a generic "The value you entered was invalid." if `hide_input` is true.
No, I had not looked at the code or thought about it beyond just making sure the input does not end up in the output.  Sounds like you think the concern is reasonable so I can try to find time to see if I can make a reasonable solution.
When I find time, should I target 7.x or master?
~7.x is fine~ target master now

Resolving patch:
diff --git a/src/click/termui.py b/src/click/termui.py
--- a/src/click/termui.py
+++ b/src/click/termui.py
@@ -153,7 +153,10 @@ def prompt_func(text):
         try:
             result = value_proc(value)
         except UsageError as e:
-            echo(f"Error: {e.message}", err=err)  # noqa: B306
+            if hide_input:
+                echo("Error: the value you entered was invalid", err=err)
+            else:
+                echo(f"Error: {e.message}", err=err)  # noqa: B306
             continue
         if not confirmation_prompt:
             return result


Test patch: