Web Server Allows Password Auto-Completion SERVER/cgi-bin/koha/opac-user.pl Synopsis The 'autocomplete' attribute is not disabled on password fields. Description The remote web server contains at least one HTML form field that has an input of type 'password' where 'autocomplete' is not set to 'off'. While this does not represent a risk to this web server per se, it does mean that users who use the affected forms may have their credentials saved in their browsers, which could in turn lead to a loss of confidentiality if any of them use a shared host or if their machine is compromised at some point. From a security scanner : https://www.tenable.com/plugins/nessus/42057. Low severity Our clients ask for a fix in 60 days.
What version are you using? Bug 29487 set most of the inputs to autocomplete=off
21.05.08 and 22.05.06. I just validated that Bug 29487 is on the stack.
Bug 29487 corrected - auth.tt - masthead.inc - opac-main.tt If I do a grep for "type=\"password" in the OPAC code, I get koha-tmpl/opac-tmpl/bootstrap/en/includes/overdrive-login.inc koha-tmpl/opac-tmpl/bootstrap/en/includes/masthead.inc koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-memberentry.tt koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-registration-confirmation.tt koha-tmpl/opac-tmpl/bootstrap/en/modules/pages.tt koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/sco-main.tt koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-main.tt koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-password-recovery.tt koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-passwd.tt koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth.tt Which is a long list that could potentially benefit from autocomplete="off". I'll wait for your comment first, Nick, before jumping (blindly) on that.
(In reply to Blou from comment #3) > Bug 29487 corrected > > - auth.tt > > - masthead.inc > > - opac-main.tt > > If I do a grep for "type=\"password" in the OPAC code, I get > > koha-tmpl/opac-tmpl/bootstrap/en/includes/overdrive-login.inc > koha-tmpl/opac-tmpl/bootstrap/en/includes/masthead.inc > koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-memberentry.tt > koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-registration-confirmation.tt > koha-tmpl/opac-tmpl/bootstrap/en/modules/pages.tt > koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/sco-main.tt > koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-main.tt > koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-password-recovery.tt > koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-passwd.tt > koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth.tt > > Which is a long list that could potentially benefit from autocomplete="off". > I'll wait for your comment first, Nick, before jumping (blindly) on that. Yeah, any we missed should be fixed, looking forward to your patch :-)
Created attachment 149107 [details] [review] Bug 33343: Web Server Allows Password Auto-Completion This patch adds 'autocomplete=off' to all password type fields in the OPAC To test: 1. Apply the patch 2. Visit http://master/cgi-bin/koha/opac-main.pl 3. Inspect the page --> Confirm html shows autocomplete off on the password field 4. Click on Log in (without filling any field) 5. Repeat step 3 --> Confirm html shows autocomplete off on the password field 6. Set 'PatronSelfRegistration' system preference to 'Allow' and PatronSelfRegistrationDefaultCategory to 'Board' 7. Visit http://master/cgi-bin/koha/opac-memberentry.pl 9. Repeat step 3 --> Confirm html shows autocomplete off on the password field 10. Connect to the OPAC 11. Click on Change password 11. Repeat step 3 --> Confirm html shows autocomplete off on the password field 12. Set 'EnableExpiredPasswordReset' system preference to 'Enable' 13. Visit http://master/cgi-bin/koha/opac-reset-password.pl 14. Repeat step 3 --> Confirm html shows autocomplete off on the password field
Created attachment 151532 [details] [review] Bug 33343: Web Server Allows Password Auto-Completion This patch adds 'autocomplete=off' to all password type fields in the OPAC To test: 1. Apply the patch 2. Visit http://master/cgi-bin/koha/opac-main.pl 3. Inspect the page --> Confirm html shows autocomplete off on the password field 4. Click on Log in (without filling any field) 5. Repeat step 3 --> Confirm html shows autocomplete off on the password field 6. Set 'PatronSelfRegistration' system preference to 'Allow' and PatronSelfRegistrationDefaultCategory to 'Board' 7. Visit http://master/cgi-bin/koha/opac-memberentry.pl 9. Repeat step 3 --> Confirm html shows autocomplete off on the password field 10. Connect to the OPAC 11. Click on Change password 11. Repeat step 3 --> Confirm html shows autocomplete off on the password field 12. Set 'EnableExpiredPasswordReset' system preference to 'Enable' 13. Visit http://master/cgi-bin/koha/opac-reset-password.pl 14. Repeat step 3 --> Confirm html shows autocomplete off on the password field Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Created attachment 151533 [details] [review] Bug 33343: Catch more cases and correctly use new-password hint I believe where we're allowing a user to set a new password instead of using autocomplete="off" we should be hinting to the brownser that it's a new password box with autocompelte="new-password". I also correct a couple of missing instances.. Honestly, I'm not sure how much this helps these days as most browsers offer to save passwords regardless. See: https://developer.mozilla.org/en-US/docs/Web/HTML/Attributes/autocomplete
Moving to signed off.. but I'm not 100% on sure on these changes.. seeking more QA persons thoughts.
Created attachment 151544 [details] [review] Bug 33343: Web Server Allows Password Auto-Completion This patch adds 'autocomplete=off' to all password type fields in the OPAC To test: 1. Apply the patch 2. Visit http://master/cgi-bin/koha/opac-main.pl 3. Inspect the page --> Confirm html shows autocomplete off on the password field 4. Click on Log in (without filling any field) 5. Repeat step 3 --> Confirm html shows autocomplete off on the password field 6. Set 'PatronSelfRegistration' system preference to 'Allow' and PatronSelfRegistrationDefaultCategory to 'Board' 7. Visit http://master/cgi-bin/koha/opac-memberentry.pl 9. Repeat step 3 --> Confirm html shows autocomplete off on the password field 10. Connect to the OPAC 11. Click on Change password 11. Repeat step 3 --> Confirm html shows autocomplete off on the password field 12. Set 'EnableExpiredPasswordReset' system preference to 'Enable' 13. Visit http://master/cgi-bin/koha/opac-reset-password.pl 14. Repeat step 3 --> Confirm html shows autocomplete off on the password field Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Created attachment 151545 [details] [review] Bug 33343: Catch more cases and correctly use new-password hint I believe where we're allowing a user to set a new password instead of using autocomplete="off" we should be hinting to the brownser that it's a new password box with autocompelte="new-password". I also correct a couple of missing instances.. Honestly, I'm not sure how much this helps these days as most browsers offer to save passwords regardless. See: https://developer.mozilla.org/en-US/docs/Web/HTML/Attributes/autocomplete Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Created attachment 152066 [details] [review] Bug 33343: Make use of the 'autocomplete=off' attribute on password fields This patch adds 'autocomplete=off' to all password type fields in the OPAC To test: 1. Apply the patch 2. Visit http://master/cgi-bin/koha/opac-main.pl 3. Inspect the page --> Confirm html shows autocomplete off on the password field 4. Click on Log in (without filling any field) 5. Repeat step 3 --> Confirm html shows autocomplete off on the password field 6. Set 'PatronSelfRegistration' system preference to 'Allow' and PatronSelfRegistrationDefaultCategory to 'Board' 7. Visit http://master/cgi-bin/koha/opac-memberentry.pl 9. Repeat step 3 --> Confirm html shows autocomplete off on the password field 10. Connect to the OPAC 11. Click on Change password 11. Repeat step 3 --> Confirm html shows autocomplete off on the password field 12. Set 'EnableExpiredPasswordReset' system preference to 'Enable' 13. Visit http://master/cgi-bin/koha/opac-reset-password.pl 14. Repeat step 3 --> Confirm html shows autocomplete off on the password field Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Created attachment 152067 [details] [review] Bug 33343: Catch more cases and correctly use new-password hint I believe where we're allowing a user to set a new password instead of using autocomplete="off" we should be hinting to the brownser that it's a new password box with autocompelte="new-password". I also correct a couple of missing instances.. Honestly, I'm not sure how much this helps these days as most browsers offer to save passwords regardless. See: https://developer.mozilla.org/en-US/docs/Web/HTML/Attributes/autocomplete Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Pushed to master for 23.11. Nice work everyone, thanks!
Enhancement - not backporting to 22.11.x
Owen has added coding guideline HTML10: Set autocomplete attribute on all password fields to the Wiki: https://wiki.koha-community.org/wiki/Coding_Guidelines#HTML10:_Set_autocomplete_attribute_on_all_password_fields