--- a/mercurial/sshrepo.py	Wed Feb 23 00:25:18 2011 +0100
+++ b/mercurial/sshrepo.py	Wed Feb 23 11:42:41 2011 +0100
@@ -29,6 +29,8 @@
             self._abort(error.RepoError(_("couldn't parse location %s") % path))
 
         self.user = m.group(2)
+        if self.user and ':' in self.user:
+            self._abort(error.RepoError(_("password in URL not supported")))
         self.host = m.group(3)
         self.port = m.group(5)
         self.path = m.group(7) or "."