Prevent browsers from auto-filling auth details on settings forms.

Review Request #7614 — Created Sept. 2, 2015 and submitted

Information

Review Board
release-2.0.x

Reviewers

Browsers try very hard these days to be helpful by capturing data
entered into username/password fields and auto-filling them. While
generally useful, this ends up being a problem for settings forms that
are trying to configure other services or users.

There's no officially-supported way to disable these, and browsers try
to be smart by checking for password field types and certain labels, but
a trick that works pretty well (and ahs been used by other projects) is
to place a hidden password input without a name attribute at the top of
the form. The browser will see this, auto-fill it, and ignore any
subsequent username/password field combinations.

This change applies this to all admin settings forms and the repository
change form.

Tested in Chrome, Safari, and Firefox. Prior to this change, I could make
Chrome and Firefox auto-fill username/passwords for repository hosting
service information and for e-mail configuration. After this change, they
wouldn't auto-fill at all anymore.

Safari's behavior in this area is quite different. I still get the option
to auto-fill, but it doesn't force it. This behavior is the same both before
and after this fix. However, older versions behaved like Chrome and Firefox,
so my hope is that those will be fixed.

reviewbot
  1. Tool: PEP8 Style Checker
    Ignored Files:
        reviewboard/templates/admin/settings.html
        reviewboard/templates/admin/scmtools/repository/change_form.html
    
    
    
    Tool: Pyflakes
    Ignored Files:
        reviewboard/templates/admin/settings.html
        reviewboard/templates/admin/scmtools/repository/change_form.html
    
    
  2. 
      
brennie
  1. Ship It!
  2. 
      
chipx86
Review request changed

Status: Closed (submitted)

Change Summary:

Pushed to release-2.0.x (7de02a1)
Loading...