Summary: | Password fields should have auto-completion off | ||
---|---|---|---|
Product: | Koha | Reporter: | Anthony <anthony.laquerre> |
Component: | Templates | Assignee: | Hammat wele <hammat.wele> |
Status: | CLOSED FIXED | QA Contact: | Nick Clemens (kidclamp) <nick> |
Severity: | normal | ||
Priority: | P5 - low | CC: | 1joynelson, david, dcook, didier.gautheron, eric.begin, fridolin.somers, hammat.wele, jonathan.druart, laurent.ducos, lucas, m.de.rooy, martin.renvoize, matt.blenkinsop, nick, olivier.hubert, philippe.blouin, tomascohen |
Version: | unspecified | ||
Hardware: | All | ||
OS: | All | ||
Change sponsored?: | --- | Patch complexity: | --- |
Documentation contact: | Documentation submission: | ||
Text to go in the release notes: | Version(s) released in: |
23.11.00,23.05.01
|
|
Circulation function: | |||
Attachments: |
Bug 33343: Web Server Allows Password Auto-Completion
Bug 33343: Web Server Allows Password Auto-Completion Bug 33343: Catch more cases and correctly use new-password hint Bug 33343: Web Server Allows Password Auto-Completion Bug 33343: Catch more cases and correctly use new-password hint Bug 33343: Make use of the 'autocomplete=off' attribute on password fields Bug 33343: Catch more cases and correctly use new-password hint |
Description
Anthony
2023-03-27 17:16:58 UTC
What version are you using? Bug 29487 set most of the inputs to autocomplete=off 21.05.08 and 22.05.06. I just validated that Bug 29487 is on the stack. Bug 29487 corrected - auth.tt - masthead.inc - opac-main.tt If I do a grep for "type=\"password" in the OPAC code, I get koha-tmpl/opac-tmpl/bootstrap/en/includes/overdrive-login.inc koha-tmpl/opac-tmpl/bootstrap/en/includes/masthead.inc koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-memberentry.tt koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-registration-confirmation.tt koha-tmpl/opac-tmpl/bootstrap/en/modules/pages.tt koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/sco-main.tt koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-main.tt koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-password-recovery.tt koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-passwd.tt koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth.tt Which is a long list that could potentially benefit from autocomplete="off". I'll wait for your comment first, Nick, before jumping (blindly) on that. (In reply to Blou from comment #3) > Bug 29487 corrected > > - auth.tt > > - masthead.inc > > - opac-main.tt > > If I do a grep for "type=\"password" in the OPAC code, I get > > koha-tmpl/opac-tmpl/bootstrap/en/includes/overdrive-login.inc > koha-tmpl/opac-tmpl/bootstrap/en/includes/masthead.inc > koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-memberentry.tt > koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-registration-confirmation.tt > koha-tmpl/opac-tmpl/bootstrap/en/modules/pages.tt > koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/sco-main.tt > koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-main.tt > koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-password-recovery.tt > koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-passwd.tt > koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth.tt > > Which is a long list that could potentially benefit from autocomplete="off". > I'll wait for your comment first, Nick, before jumping (blindly) on that. Yeah, any we missed should be fixed, looking forward to your patch :-) Created attachment 149107 [details] [review] Bug 33343: Web Server Allows Password Auto-Completion This patch adds 'autocomplete=off' to all password type fields in the OPAC To test: 1. Apply the patch 2. Visit http://master/cgi-bin/koha/opac-main.pl 3. Inspect the page --> Confirm html shows autocomplete off on the password field 4. Click on Log in (without filling any field) 5. Repeat step 3 --> Confirm html shows autocomplete off on the password field 6. Set 'PatronSelfRegistration' system preference to 'Allow' and PatronSelfRegistrationDefaultCategory to 'Board' 7. Visit http://master/cgi-bin/koha/opac-memberentry.pl 9. Repeat step 3 --> Confirm html shows autocomplete off on the password field 10. Connect to the OPAC 11. Click on Change password 11. Repeat step 3 --> Confirm html shows autocomplete off on the password field 12. Set 'EnableExpiredPasswordReset' system preference to 'Enable' 13. Visit http://master/cgi-bin/koha/opac-reset-password.pl 14. Repeat step 3 --> Confirm html shows autocomplete off on the password field Created attachment 151532 [details] [review] Bug 33343: Web Server Allows Password Auto-Completion This patch adds 'autocomplete=off' to all password type fields in the OPAC To test: 1. Apply the patch 2. Visit http://master/cgi-bin/koha/opac-main.pl 3. Inspect the page --> Confirm html shows autocomplete off on the password field 4. Click on Log in (without filling any field) 5. Repeat step 3 --> Confirm html shows autocomplete off on the password field 6. Set 'PatronSelfRegistration' system preference to 'Allow' and PatronSelfRegistrationDefaultCategory to 'Board' 7. Visit http://master/cgi-bin/koha/opac-memberentry.pl 9. Repeat step 3 --> Confirm html shows autocomplete off on the password field 10. Connect to the OPAC 11. Click on Change password 11. Repeat step 3 --> Confirm html shows autocomplete off on the password field 12. Set 'EnableExpiredPasswordReset' system preference to 'Enable' 13. Visit http://master/cgi-bin/koha/opac-reset-password.pl 14. Repeat step 3 --> Confirm html shows autocomplete off on the password field Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> Created attachment 151533 [details] [review] Bug 33343: Catch more cases and correctly use new-password hint I believe where we're allowing a user to set a new password instead of using autocomplete="off" we should be hinting to the brownser that it's a new password box with autocompelte="new-password". I also correct a couple of missing instances.. Honestly, I'm not sure how much this helps these days as most browsers offer to save passwords regardless. See: https://developer.mozilla.org/en-US/docs/Web/HTML/Attributes/autocomplete Moving to signed off.. but I'm not 100% on sure on these changes.. seeking more QA persons thoughts. Created attachment 151544 [details] [review] Bug 33343: Web Server Allows Password Auto-Completion This patch adds 'autocomplete=off' to all password type fields in the OPAC To test: 1. Apply the patch 2. Visit http://master/cgi-bin/koha/opac-main.pl 3. Inspect the page --> Confirm html shows autocomplete off on the password field 4. Click on Log in (without filling any field) 5. Repeat step 3 --> Confirm html shows autocomplete off on the password field 6. Set 'PatronSelfRegistration' system preference to 'Allow' and PatronSelfRegistrationDefaultCategory to 'Board' 7. Visit http://master/cgi-bin/koha/opac-memberentry.pl 9. Repeat step 3 --> Confirm html shows autocomplete off on the password field 10. Connect to the OPAC 11. Click on Change password 11. Repeat step 3 --> Confirm html shows autocomplete off on the password field 12. Set 'EnableExpiredPasswordReset' system preference to 'Enable' 13. Visit http://master/cgi-bin/koha/opac-reset-password.pl 14. Repeat step 3 --> Confirm html shows autocomplete off on the password field Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> Signed-off-by: Nick Clemens <nick@bywatersolutions.com> Created attachment 151545 [details] [review] Bug 33343: Catch more cases and correctly use new-password hint I believe where we're allowing a user to set a new password instead of using autocomplete="off" we should be hinting to the brownser that it's a new password box with autocompelte="new-password". I also correct a couple of missing instances.. Honestly, I'm not sure how much this helps these days as most browsers offer to save passwords regardless. See: https://developer.mozilla.org/en-US/docs/Web/HTML/Attributes/autocomplete Signed-off-by: Nick Clemens <nick@bywatersolutions.com> Created attachment 152066 [details] [review] Bug 33343: Make use of the 'autocomplete=off' attribute on password fields This patch adds 'autocomplete=off' to all password type fields in the OPAC To test: 1. Apply the patch 2. Visit http://master/cgi-bin/koha/opac-main.pl 3. Inspect the page --> Confirm html shows autocomplete off on the password field 4. Click on Log in (without filling any field) 5. Repeat step 3 --> Confirm html shows autocomplete off on the password field 6. Set 'PatronSelfRegistration' system preference to 'Allow' and PatronSelfRegistrationDefaultCategory to 'Board' 7. Visit http://master/cgi-bin/koha/opac-memberentry.pl 9. Repeat step 3 --> Confirm html shows autocomplete off on the password field 10. Connect to the OPAC 11. Click on Change password 11. Repeat step 3 --> Confirm html shows autocomplete off on the password field 12. Set 'EnableExpiredPasswordReset' system preference to 'Enable' 13. Visit http://master/cgi-bin/koha/opac-reset-password.pl 14. Repeat step 3 --> Confirm html shows autocomplete off on the password field Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> Signed-off-by: Nick Clemens <nick@bywatersolutions.com> Created attachment 152067 [details] [review] Bug 33343: Catch more cases and correctly use new-password hint I believe where we're allowing a user to set a new password instead of using autocomplete="off" we should be hinting to the brownser that it's a new password box with autocompelte="new-password". I also correct a couple of missing instances.. Honestly, I'm not sure how much this helps these days as most browsers offer to save passwords regardless. See: https://developer.mozilla.org/en-US/docs/Web/HTML/Attributes/autocomplete Signed-off-by: Nick Clemens <nick@bywatersolutions.com> Pushed to master for 23.11. Nice work everyone, thanks! Enhancement - not backporting to 22.11.x Owen has added coding guideline HTML10: Set autocomplete attribute on all password fields to the Wiki: https://wiki.koha-community.org/wiki/Coding_Guidelines#HTML10:_Set_autocomplete_attribute_on_all_password_fields |