Bug 18955

Summary: Autocomplete is on in OPAC password recovery
Product: Koha Reporter: Fridolin Somers <fridolin.somers>
Component: OPACAssignee: Fridolin Somers <fridolin.somers>
Status: CLOSED FIXED QA Contact: Testopia <testopia>
Severity: major    
Priority: P5 - low CC: katrin.fischer, mtj, veron
Version: Main   
Hardware: All   
OS: All   
See Also: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16711
Change sponsored?: --- Patch complexity: Trivial patch
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
Attachments: Bug 18955 - autocomplete is on in OPAC password recovery
Bug 18955 - autocomplete is on in OPAC password recovery
Bug 18955 - autocomplete is on in OPAC password recovery

Description Fridolin Somers 2017-07-19 07:46:37 UTC
In OPAC password recovery form autocomplete is not disabled.
So when login or email is entered, it is saved in browser input history for autocomplete.
This is a major issue for OPAC on computers with public access.
Comment 1 Fridolin Somers 2017-07-19 07:53:55 UTC
Created attachment 65092 [details] [review]
Bug 18955 - autocomplete is on in OPAC password recovery

In OPAC password recovery form autocomplete is not disabled.
So when login or email is entered, it is saved in browser input history for autocomplete.
This is a major issue for OPAC on computers with public access.

This patch adds autocomplete off on forms.

Test :
- Enable system preferences OpacPasswordChange and OpacResetPassword
- Go to OPAC
- Be sure to not be logged in
- Click on "Forgot your password?"
- Enter a loggin and email and Submit
=> Without patch there is an autocompletion with values you entered
=> With patch there is no autocompletion
Comment 2 Marc Véron 2017-07-20 08:49:43 UTC
Created attachment 65138 [details] [review]
Bug 18955 - autocomplete is on in OPAC password recovery

In OPAC password recovery form autocomplete is not disabled.
So when login or email is entered, it is saved in browser input history for autocomplete.
This is a major issue for OPAC on computers with public access.

This patch adds autocomplete off on forms.

Test :
- Enable system preferences OpacPasswordChange and OpacResetPassword
- Go to OPAC
- Be sure to not be logged in
- Click on "Forgot your password?"
- Enter a loggin and email and Submit
=> Without patch there is an autocompletion with values you entered
=> With patch there is no autocompletion

Signed-off-by: Marc Véron <veron@veron.ch>
Comment 3 Nick Clemens 2017-07-21 10:24:25 UTC
Created attachment 65165 [details] [review]
Bug 18955 - autocomplete is on in OPAC password recovery

In OPAC password recovery form autocomplete is not disabled.
So when login or email is entered, it is saved in browser input history for autocomplete.
This is a major issue for OPAC on computers with public access.

This patch adds autocomplete off on forms.

Test :
- Enable system preferences OpacPasswordChange and OpacResetPassword
- Go to OPAC
- Be sure to not be logged in
- Click on "Forgot your password?"
- Enter a loggin and email and Submit
=> Without patch there is an autocompletion with values you entered
=> With patch there is no autocompletion

Signed-off-by: Marc Véron <veron@veron.ch>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Comment 4 Jonathan Druart 2017-07-24 19:04:39 UTC
Pushed to master for 17.11, thanks to everybody involved!
Comment 5 Fridolin Somers 2017-07-27 10:05:42 UTC
Pushed to 17.05.x, will be in 17.05.02.
Comment 6 Katrin Fischer 2017-07-27 23:17:31 UTC
This patch has been pushed to 16.11.x and will be in 16.11.10.
Comment 7 Mason James 2017-07-31 12:16:36 UTC
Pushed to 16.05.x, for 16.05.15 release