Description
Anthony
2023-03-27 17:16:58 UTC
What version are you using? Bug 29487 set most of the inputs to autocomplete=off 21.05.08 and 22.05.06. I just validated that Bug 29487 is on the stack. Bug 29487 corrected - auth.tt - masthead.inc - opac-main.tt If I do a grep for "type=\"password" in the OPAC code, I get koha-tmpl/opac-tmpl/bootstrap/en/includes/overdrive-login.inc koha-tmpl/opac-tmpl/bootstrap/en/includes/masthead.inc koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-memberentry.tt koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-registration-confirmation.tt koha-tmpl/opac-tmpl/bootstrap/en/modules/pages.tt koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/sco-main.tt koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-main.tt koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-password-recovery.tt koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-passwd.tt koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth.tt Which is a long list that could potentially benefit from autocomplete="off". I'll wait for your comment first, Nick, before jumping (blindly) on that. (In reply to Blou from comment #3) > Bug 29487 corrected > > - auth.tt > > - masthead.inc > > - opac-main.tt > > If I do a grep for "type=\"password" in the OPAC code, I get > > koha-tmpl/opac-tmpl/bootstrap/en/includes/overdrive-login.inc > koha-tmpl/opac-tmpl/bootstrap/en/includes/masthead.inc > koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-memberentry.tt > koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-registration-confirmation.tt > koha-tmpl/opac-tmpl/bootstrap/en/modules/pages.tt > koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/sco-main.tt > koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-main.tt > koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-password-recovery.tt > koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-passwd.tt > koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth.tt > > Which is a long list that could potentially benefit from autocomplete="off". > I'll wait for your comment first, Nick, before jumping (blindly) on that. Yeah, any we missed should be fixed, looking forward to your patch :-) Created attachment 149107 [details] [review] Bug 33343: Web Server Allows Password Auto-Completion This patch adds 'autocomplete=off' to all password type fields in the OPAC To test: 1. Apply the patch 2. Visit http://master/cgi-bin/koha/opac-main.pl 3. Inspect the page --> Confirm html shows autocomplete off on the password field 4. Click on Log in (without filling any field) 5. Repeat step 3 --> Confirm html shows autocomplete off on the password field 6. Set 'PatronSelfRegistration' system preference to 'Allow' and PatronSelfRegistrationDefaultCategory to 'Board' 7. Visit http://master/cgi-bin/koha/opac-memberentry.pl 9. Repeat step 3 --> Confirm html shows autocomplete off on the password field 10. Connect to the OPAC 11. Click on Change password 11. Repeat step 3 --> Confirm html shows autocomplete off on the password field 12. Set 'EnableExpiredPasswordReset' system preference to 'Enable' 13. Visit http://master/cgi-bin/koha/opac-reset-password.pl 14. Repeat step 3 --> Confirm html shows autocomplete off on the password field Created attachment 151532 [details] [review] Bug 33343: Web Server Allows Password Auto-Completion This patch adds 'autocomplete=off' to all password type fields in the OPAC To test: 1. Apply the patch 2. Visit http://master/cgi-bin/koha/opac-main.pl 3. Inspect the page --> Confirm html shows autocomplete off on the password field 4. Click on Log in (without filling any field) 5. Repeat step 3 --> Confirm html shows autocomplete off on the password field 6. Set 'PatronSelfRegistration' system preference to 'Allow' and PatronSelfRegistrationDefaultCategory to 'Board' 7. Visit http://master/cgi-bin/koha/opac-memberentry.pl 9. Repeat step 3 --> Confirm html shows autocomplete off on the password field 10. Connect to the OPAC 11. Click on Change password 11. Repeat step 3 --> Confirm html shows autocomplete off on the password field 12. Set 'EnableExpiredPasswordReset' system preference to 'Enable' 13. Visit http://master/cgi-bin/koha/opac-reset-password.pl 14. Repeat step 3 --> Confirm html shows autocomplete off on the password field Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> Created attachment 151533 [details] [review] Bug 33343: Catch more cases and correctly use new-password hint I believe where we're allowing a user to set a new password instead of using autocomplete="off" we should be hinting to the brownser that it's a new password box with autocompelte="new-password". I also correct a couple of missing instances.. Honestly, I'm not sure how much this helps these days as most browsers offer to save passwords regardless. See: https://developer.mozilla.org/en-US/docs/Web/HTML/Attributes/autocomplete Moving to signed off.. but I'm not 100% on sure on these changes.. seeking more QA persons thoughts. Created attachment 151544 [details] [review] Bug 33343: Web Server Allows Password Auto-Completion This patch adds 'autocomplete=off' to all password type fields in the OPAC To test: 1. Apply the patch 2. Visit http://master/cgi-bin/koha/opac-main.pl 3. Inspect the page --> Confirm html shows autocomplete off on the password field 4. Click on Log in (without filling any field) 5. Repeat step 3 --> Confirm html shows autocomplete off on the password field 6. Set 'PatronSelfRegistration' system preference to 'Allow' and PatronSelfRegistrationDefaultCategory to 'Board' 7. Visit http://master/cgi-bin/koha/opac-memberentry.pl 9. Repeat step 3 --> Confirm html shows autocomplete off on the password field 10. Connect to the OPAC 11. Click on Change password 11. Repeat step 3 --> Confirm html shows autocomplete off on the password field 12. Set 'EnableExpiredPasswordReset' system preference to 'Enable' 13. Visit http://master/cgi-bin/koha/opac-reset-password.pl 14. Repeat step 3 --> Confirm html shows autocomplete off on the password field Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> Signed-off-by: Nick Clemens <nick@bywatersolutions.com> Created attachment 151545 [details] [review] Bug 33343: Catch more cases and correctly use new-password hint I believe where we're allowing a user to set a new password instead of using autocomplete="off" we should be hinting to the brownser that it's a new password box with autocompelte="new-password". I also correct a couple of missing instances.. Honestly, I'm not sure how much this helps these days as most browsers offer to save passwords regardless. See: https://developer.mozilla.org/en-US/docs/Web/HTML/Attributes/autocomplete Signed-off-by: Nick Clemens <nick@bywatersolutions.com> Created attachment 152066 [details] [review] Bug 33343: Make use of the 'autocomplete=off' attribute on password fields This patch adds 'autocomplete=off' to all password type fields in the OPAC To test: 1. Apply the patch 2. Visit http://master/cgi-bin/koha/opac-main.pl 3. Inspect the page --> Confirm html shows autocomplete off on the password field 4. Click on Log in (without filling any field) 5. Repeat step 3 --> Confirm html shows autocomplete off on the password field 6. Set 'PatronSelfRegistration' system preference to 'Allow' and PatronSelfRegistrationDefaultCategory to 'Board' 7. Visit http://master/cgi-bin/koha/opac-memberentry.pl 9. Repeat step 3 --> Confirm html shows autocomplete off on the password field 10. Connect to the OPAC 11. Click on Change password 11. Repeat step 3 --> Confirm html shows autocomplete off on the password field 12. Set 'EnableExpiredPasswordReset' system preference to 'Enable' 13. Visit http://master/cgi-bin/koha/opac-reset-password.pl 14. Repeat step 3 --> Confirm html shows autocomplete off on the password field Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> Signed-off-by: Nick Clemens <nick@bywatersolutions.com> Created attachment 152067 [details] [review] Bug 33343: Catch more cases and correctly use new-password hint I believe where we're allowing a user to set a new password instead of using autocomplete="off" we should be hinting to the brownser that it's a new password box with autocompelte="new-password". I also correct a couple of missing instances.. Honestly, I'm not sure how much this helps these days as most browsers offer to save passwords regardless. See: https://developer.mozilla.org/en-US/docs/Web/HTML/Attributes/autocomplete Signed-off-by: Nick Clemens <nick@bywatersolutions.com> Pushed to master for 23.11. Nice work everyone, thanks! Enhancement - not backporting to 22.11.x Owen has added coding guideline HTML10: Set autocomplete attribute on all password fields to the Wiki: https://wiki.koha-community.org/wiki/Coding_Guidelines#HTML10:_Set_autocomplete_attribute_on_all_password_fields |