Merge branch 'MDL-76478-password-unmask-MOODLE_400_STABLE' of https:/…

…/github.com/brendanheywood/moodle into MOODLE_400_STABLE
moodle · Feb 15, 2023 · 31db9d0 · 31db9d0
2 parents 2043797 + 940006d
commit 31db9d0
Show file tree

Hide file tree

Showing 3 changed files with 10 additions and 15 deletions.
diff --git a/lib/form/password.php b/lib/form/password.php
@@ -54,14 +54,19 @@ class MoodleQuickForm_password extends HTML_QuickForm_password implements templa
      */
     public function __construct($elementName=null, $elementLabel=null, $attributes=null) {
         global $CFG;
-        // no standard mform in moodle should allow autocomplete of passwords
+
+        // No standard mform in moodle should allow autocomplete of passwords.
         if (empty($attributes)) {
-            $attributes = array('autocomplete'=>'off');
+            $attributes = ['autocomplete' => 'new-password'];
         } else if (is_array($attributes) && empty($attributes['autocomplete'])) {
-            $attributes['autocomplete'] = 'off';
+            $attributes['autocomplete'] = 'new-password';
+        } else if (is_array($attributes) && $attributes['autocomplete'] === 'off') {
+            // A value of 'off' is ignored in all modern browsers and password
+            // managers and should be new-password instead.
+            $attributes['autocomplete'] = 'new-password';
         } else if (is_string($attributes)) {
             if (strpos($attributes, 'autocomplete') === false) {
-                $attributes .= ' autocomplete="off" ';
+                $attributes .= ' autocomplete="new-password" ';
             }
         }
 

diff --git a/lib/form/passwordunmask.php b/lib/form/passwordunmask.php
@@ -52,16 +52,6 @@ class MoodleQuickForm_passwordunmask extends MoodleQuickForm_password {
      *              or an associative array
      */
     public function __construct($elementName=null, $elementLabel=null, $attributes=null) {
-        // no standard mform in moodle should allow autocomplete of passwords
-        if (empty($attributes)) {
-            $attributes = array('autocomplete'=>'off');
-        } else if (is_array($attributes)) {
-            $attributes['autocomplete'] = 'off';
-        } else {
-            if (strpos($attributes, 'autocomplete') === false) {
-                $attributes .= ' autocomplete="off" ';
-            }
-        }
         $this->_persistantFreeze = true;
 
         parent::__construct($elementName, $elementLabel, $attributes);

diff --git a/lib/form/templates/element-passwordunmask.mustache b/lib/form/templates/element-passwordunmask.mustache
@@ -59,7 +59,7 @@
                         {{# error }}
                             autofocus aria-describedby="{{ element.iderror }}"
                         {{/ error }}
-                        {{{ attributes }}}
+                        {{{ element.attributes }}}
                         >
             </span>
             {{^ element.frozen }}