Bug 33343 - Password fields should have auto-completion off
Summary: Password fields should have auto-completion off
Status: RESOLVED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Templates (show other bugs)
Version: unspecified
Hardware: All All
: P5 - low normal (vote)
Assignee: Hammat wele
QA Contact: Nick Clemens (kidclamp)
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2023-03-27 17:16 UTC by Anthony
Modified: 2023-06-13 22:25 UTC (History)
18 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
23.11.00,23.05.01


Attachments
Bug 33343: Web Server Allows Password Auto-Completion (12.08 KB, patch)
2023-04-03 21:05 UTC, Hammat wele
Details | Diff | Splinter Review
Bug 33343: Web Server Allows Password Auto-Completion (12.14 KB, patch)
2023-05-22 14:56 UTC, Martin Renvoize
Details | Diff | Splinter Review
Bug 33343: Catch more cases and correctly use new-password hint (10.46 KB, patch)
2023-05-22 14:56 UTC, Martin Renvoize
Details | Diff | Splinter Review
Bug 33343: Web Server Allows Password Auto-Completion (12.20 KB, patch)
2023-05-22 18:41 UTC, Nick Clemens (kidclamp)
Details | Diff | Splinter Review
Bug 33343: Catch more cases and correctly use new-password hint (10.52 KB, patch)
2023-05-22 18:42 UTC, Nick Clemens (kidclamp)
Details | Diff | Splinter Review
Bug 33343: Make use of the 'autocomplete=off' attribute on password fields (12.23 KB, patch)
2023-06-06 19:17 UTC, Tomás Cohen Arazi
Details | Diff | Splinter Review
Bug 33343: Catch more cases and correctly use new-password hint (10.53 KB, patch)
2023-06-06 19:17 UTC, Tomás Cohen Arazi
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Anthony 2023-03-27 17:16:58 UTC
Web Server Allows Password Auto-Completion

SERVER/cgi-bin/koha/opac-user.pl


Synopsis
The 'autocomplete' attribute is not disabled on password fields.

Description
The remote web server contains at least one HTML form field that has an input of type 'password' where
'autocomplete' is not set to 'off'.
While this does not represent a risk to this web server per se, it does mean that users who use the affected forms may
have their credentials saved in their browsers, which could in turn lead to a loss of confidentiality if any of them use a
shared host or if their machine is compromised at some point.


From a security scanner : 
https://www.tenable.com/plugins/nessus/42057.
Low severity
Our clients ask for a fix in 60 days.
Comment 1 Nick Clemens (kidclamp) 2023-03-28 09:10:49 UTC
What version are you using? Bug 29487 set most of the inputs to autocomplete=off
Comment 2 Blou 2023-03-28 13:52:47 UTC
21.05.08 and 22.05.06.  I just validated that Bug 29487 is on the stack.
Comment 3 Blou 2023-03-28 13:58:27 UTC
Bug 29487 corrected

- auth.tt

- masthead.inc

- opac-main.tt

If I do a grep for "type=\"password" in the OPAC code, I get

koha-tmpl/opac-tmpl/bootstrap/en/includes/overdrive-login.inc
koha-tmpl/opac-tmpl/bootstrap/en/includes/masthead.inc
koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-memberentry.tt
koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-registration-confirmation.tt
koha-tmpl/opac-tmpl/bootstrap/en/modules/pages.tt
koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/sco-main.tt
koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-main.tt
koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-password-recovery.tt
koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-passwd.tt
koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth.tt

Which is a long list that could potentially benefit from autocomplete="off".  I'll wait for your comment first, Nick, before jumping (blindly) on that.
Comment 4 Nick Clemens (kidclamp) 2023-04-03 16:40:39 UTC
(In reply to Blou from comment #3)
> Bug 29487 corrected
> 
> - auth.tt
> 
> - masthead.inc
> 
> - opac-main.tt
> 
> If I do a grep for "type=\"password" in the OPAC code, I get
> 
> koha-tmpl/opac-tmpl/bootstrap/en/includes/overdrive-login.inc
> koha-tmpl/opac-tmpl/bootstrap/en/includes/masthead.inc
> koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-memberentry.tt
> koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-registration-confirmation.tt
> koha-tmpl/opac-tmpl/bootstrap/en/modules/pages.tt
> koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/sco-main.tt
> koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-main.tt
> koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-password-recovery.tt
> koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-passwd.tt
> koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth.tt
> 
> Which is a long list that could potentially benefit from autocomplete="off".
> I'll wait for your comment first, Nick, before jumping (blindly) on that.

Yeah, any we missed should be fixed, looking forward to your patch :-)
Comment 5 Hammat wele 2023-04-03 21:05:43 UTC Comment hidden (obsolete)
Comment 6 Martin Renvoize 2023-05-22 14:56:54 UTC Comment hidden (obsolete)
Comment 7 Martin Renvoize 2023-05-22 14:56:57 UTC Comment hidden (obsolete)
Comment 8 Martin Renvoize 2023-05-22 14:58:05 UTC
Moving to signed off.. but I'm not 100% on sure on these changes.. seeking more QA persons thoughts.
Comment 9 Nick Clemens (kidclamp) 2023-05-22 18:41:57 UTC Comment hidden (obsolete)
Comment 10 Nick Clemens (kidclamp) 2023-05-22 18:42:00 UTC Comment hidden (obsolete)
Comment 11 Tomás Cohen Arazi 2023-06-06 19:17:23 UTC
Created attachment 152066 [details] [review]
Bug 33343: Make use of the 'autocomplete=off' attribute on password fields

This patch adds 'autocomplete=off' to all password type fields in the OPAC

To test:
1. Apply the patch
2. Visit http://master/cgi-bin/koha/opac-main.pl
3. Inspect the page
    --> Confirm html shows autocomplete off on the password field
4. Click on Log in (without filling any field)
5. Repeat step 3
    --> Confirm html shows autocomplete off on the password field
6. Set 'PatronSelfRegistration' system preference to 'Allow' and PatronSelfRegistrationDefaultCategory to 'Board'
7. Visit http://master/cgi-bin/koha/opac-memberentry.pl
9. Repeat step 3
    --> Confirm html shows autocomplete off on the password field
10. Connect to the OPAC
11. Click on Change password
11. Repeat step 3
    --> Confirm html shows autocomplete off on the password field
12. Set 'EnableExpiredPasswordReset' system preference to 'Enable'
13. Visit http://master/cgi-bin/koha/opac-reset-password.pl
14. Repeat step 3
    --> Confirm html shows autocomplete off on the password field

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Comment 12 Tomás Cohen Arazi 2023-06-06 19:17:27 UTC
Created attachment 152067 [details] [review]
Bug 33343: Catch more cases and correctly use new-password hint

I believe where we're allowing a user to set a new password instead of
using autocomplete="off" we should be hinting to the brownser that it's
a new password box with autocompelte="new-password".

I also correct a couple of missing instances.. Honestly, I'm not sure
how much this helps these days as most browsers offer to save passwords
regardless.

See: https://developer.mozilla.org/en-US/docs/Web/HTML/Attributes/autocomplete
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Comment 13 Tomás Cohen Arazi 2023-06-06 19:20:45 UTC
Pushed to master for 23.11.

Nice work everyone, thanks!
Comment 14 Matt Blenkinsop 2023-06-12 11:22:48 UTC
Enhancement - not backporting to 22.11.x
Comment 15 David Nind 2023-06-13 22:25:55 UTC
Owen has added coding guideline HTML10: Set autocomplete attribute on all password fields to the Wiki:
https://wiki.koha-community.org/wiki/Coding_Guidelines#HTML10:_Set_autocomplete_attribute_on_all_password_fields