[Send 2] The “Would you like to save this password” form is wrongly displayed when entering a password on the download page

[Softvision-AndreeaCupsa]

[Notes]:

• This issue is not reproducible on Firefox 64. Considering this, using the mozregression tool I have found the issue that broke this in Beta and Nightly. Here is the pushlog: https://tinyurl.com/y5xt2txx
• Because of this, if the “Save” button was clicked on the “Would you like to save this password” form, when adding a new file and changing the number of downloads or the period of time the “Protect with password” option will automatically be set and the previously saved password will be added to the field.

[Affected Platforms]:

• All Windows
• All Mac
• All Linux

[Affected Versions]:

• Firefox Beta 66
• Firefox Nightly 67

[Prerequisites]:

• Have a valid link to a password protected file uploaded through https://send2.dev.lcip.org.

[Steps to reproduce]:

1. Open the Firefox Beta 66 browser and navigate to the link from the prerequisites.
2. Type the password in the “Password” field.
3. Click the “Unlock” button and observe the behavior.

[Expected result]:

• Only the “Download Encrypted File” overlay is displayed.

[Actual result]:

• The “Would you like to save this password” form is wrongly displayed in the toolbar.

[Additional notes]:

• This issue is not reproducible on Firefox 65, Chrome, Safari and Opera.
• Attached a screen recording with the issue:

[johngruen]

@6a68 is there a way to suppress this? You're a firefox password manager wizard these days, right?

[dannycoates]

this might be fixed by 060b683 but I was having trouble reproducing

[dannycoates]

nevermind, i had save passwords globally disabled

[jaredhirsch]

There's no clean, non-hacky way to fix this, until something like autocomplete="new-password" is supported. One approach that should work is to shove another non-displayed password input into the page, above the password field of interest, inside the same form (or just higher in the DOM, if there's no outer form element). See, for instance, this SO answer: https://stackoverflow.com/a/29852908

Other approaches involve funky JS maneuvers, like yanking content out of the password field on blur, then changing the password field's type to a plain input, which seems even worse.

[fzzzy]

Personally I think yanking the password out and changing the input type is perfectly fine. We never send the password to the server.

[christopher-ramirez]

This seems to be a bug when handling value changes in the dropdowns. The code automatically activates the checkout Protect with password. Once the checkbox is activated, the password field is enabled and browsers proceed to autofill the password field.