From 2b857f2233ce5083b4d5bc9bfc4152f933c3e4a6 Mon Sep 17 00:00:00 2001
From: Mirek Bauer <bauer@cesnet.cz>
Date: Tue, 23 Feb 2016 11:35:35 +0100
Subject: [PATCH] Fix AutoComplete Not Disabled for 'Password' Field
 vulnerability

---
 .../lostpassword/templates/resetpassword.php  | 40 +++++++++++++++++++
 1 file changed, 40 insertions(+)
 create mode 100644 cesnet/core/lostpassword/templates/resetpassword.php

diff --git a/cesnet/core/lostpassword/templates/resetpassword.php b/cesnet/core/lostpassword/templates/resetpassword.php
new file mode 100644
index 0000000..11d329c
--- /dev/null
+++ b/cesnet/core/lostpassword/templates/resetpassword.php
@@ -0,0 +1,40 @@
+<?php
+/**
+ * @author Jan-Christoph Borchardt <hey@jancborchardt.net>
+ * @author Lukas Reschke <lukas@owncloud.com>
+ * @author Michael Gapczynski <GapczynskiM@gmail.com>
+ * @author Morris Jobke <hey@morrisjobke.de>
+ * @author Victor Dubiniuk <dubiniuk@owncloud.com>
+ *
+ * @copyright Copyright (c) 2015, ownCloud, Inc.
+ * @license AGPL-3.0
+ *
+ * This code is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License, version 3,
+ * as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License, version 3,
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>
+ *
+ */
+style('lostpassword', 'resetpassword');
+script('core', 'lostpassword');
+?>
+
+<form action="<?php print_unescaped($_['link']) ?>" id="reset-password" method="post">
+	<fieldset>
+		<p>
+			<label for="password" class="infield"><?php p($l->t('New password')); ?></label>
+			<input type="password" autocomplete="off" name="password" id="password" value="" placeholder="<?php p($l->t('New Password')); ?>" required />
+		</p>
+		<input type="submit" id="submit" value="<?php p($l->t('Reset password')); ?>" />
+		<p class="text-center">
+			<img class="hidden" id="float-spinner" src="<?php p(\OCP\Util::imagePath('core', 'loading-dark.gif'));?>"/>
+		</p>
+	</fieldset>
+</form>