• 
      

    Prevent browsers from auto-filling auth details on settings forms.

    Review Request #7614 — Created Sept. 2, 2015 and submitted — Latest diff uploaded

    Information

    Review Board
    release-2.0.x

    Reviewers

    Browsers try very hard these days to be helpful by capturing data
    entered into username/password fields and auto-filling them. While
    generally useful, this ends up being a problem for settings forms that
    are trying to configure other services or users.

    There's no officially-supported way to disable these, and browsers try
    to be smart by checking for password field types and certain labels, but
    a trick that works pretty well (and ahs been used by other projects) is
    to place a hidden password input without a name attribute at the top of
    the form. The browser will see this, auto-fill it, and ignore any
    subsequent username/password field combinations.

    This change applies this to all admin settings forms and the repository
    change form.

    Tested in Chrome, Safari, and Firefox. Prior to this change, I could make
    Chrome and Firefox auto-fill username/passwords for repository hosting
    service information and for e-mail configuration. After this change, they
    wouldn't auto-fill at all anymore.

    Safari's behavior in this area is quite different. I still get the option
    to auto-fill, but it doesn't force it. This behavior is the same both before
    and after this fix. However, older versions behaved like Chrome and Firefox,
    so my hope is that those will be fixed.