Bug 18955 - autocomplete is on in OPAC password recovery
Summary: autocomplete is on in OPAC password recovery
Status: Pushed to Stable
Alias: None
Product: Koha
Classification: Unclassified
Component: OPAC (show other bugs)
Version: master
Hardware: All All
: P5 - low major (vote)
Assignee: Fridolin SOMERS
QA Contact: Testopia
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2017-07-19 07:46 UTC by Fridolin SOMERS
Modified: 2017-07-31 12:16 UTC (History)
3 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Trivial patch
Bot Control: ---
When did the bot last check this:
Who signed the patch off:
Text to go in the release notes:


Attachments
Bug 18955 - autocomplete is on in OPAC password recovery (2.39 KB, patch)
2017-07-19 07:53 UTC, Fridolin SOMERS
Details | Diff | Splinter Review
Bug 18955 - autocomplete is on in OPAC password recovery (2.52 KB, patch)
2017-07-20 08:49 UTC, Marc Véron
Details | Diff | Splinter Review
Bug 18955 - autocomplete is on in OPAC password recovery (2.57 KB, patch)
2017-07-21 10:24 UTC, Nick Clemens
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Fridolin SOMERS 2017-07-19 07:46:37 UTC
In OPAC password recovery form autocomplete is not disabled.
So when login or email is entered, it is saved in browser input history for autocomplete.
This is a major issue for OPAC on computers with public access.
Comment 1 Fridolin SOMERS 2017-07-19 07:53:55 UTC
Created attachment 65092 [details] [review]
Bug 18955 - autocomplete is on in OPAC password recovery

In OPAC password recovery form autocomplete is not disabled.
So when login or email is entered, it is saved in browser input history for autocomplete.
This is a major issue for OPAC on computers with public access.

This patch adds autocomplete off on forms.

Test :
- Enable system preferences OpacPasswordChange and OpacResetPassword
- Go to OPAC
- Be sure to not be logged in
- Click on "Forgot your password?"
- Enter a loggin and email and Submit
=> Without patch there is an autocompletion with values you entered
=> With patch there is no autocompletion
Comment 2 Marc Véron 2017-07-20 08:49:43 UTC
Created attachment 65138 [details] [review]
Bug 18955 - autocomplete is on in OPAC password recovery

In OPAC password recovery form autocomplete is not disabled.
So when login or email is entered, it is saved in browser input history for autocomplete.
This is a major issue for OPAC on computers with public access.

This patch adds autocomplete off on forms.

Test :
- Enable system preferences OpacPasswordChange and OpacResetPassword
- Go to OPAC
- Be sure to not be logged in
- Click on "Forgot your password?"
- Enter a loggin and email and Submit
=> Without patch there is an autocompletion with values you entered
=> With patch there is no autocompletion

Signed-off-by: Marc Véron <veron@veron.ch>
Comment 3 Nick Clemens 2017-07-21 10:24:25 UTC
Created attachment 65165 [details] [review]
Bug 18955 - autocomplete is on in OPAC password recovery

In OPAC password recovery form autocomplete is not disabled.
So when login or email is entered, it is saved in browser input history for autocomplete.
This is a major issue for OPAC on computers with public access.

This patch adds autocomplete off on forms.

Test :
- Enable system preferences OpacPasswordChange and OpacResetPassword
- Go to OPAC
- Be sure to not be logged in
- Click on "Forgot your password?"
- Enter a loggin and email and Submit
=> Without patch there is an autocompletion with values you entered
=> With patch there is no autocompletion

Signed-off-by: Marc Véron <veron@veron.ch>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Comment 4 Jonathan Druart 2017-07-24 19:04:39 UTC
Pushed to master for 17.11, thanks to everybody involved!
Comment 5 Fridolin SOMERS 2017-07-27 10:05:42 UTC
Pushed to 17.05.x, will be in 17.05.02.
Comment 6 Katrin Fischer 2017-07-27 23:17:31 UTC
This patch has been pushed to 16.11.x and will be in 16.11.10.
Comment 7 Mason James 2017-07-31 12:16:36 UTC
Pushed to 16.05.x, for 16.05.15 release