Firefox, when saving profile it checks for password match!?

[somatonic]

[LostKobrakai]

Could it be that firefox prefills your password field? Normally both fields are empty.

[somatonic]

yep he fills in something.

[ryancramerdesign]

You mentioned that he fills in something. Wouldn't you expect it to verify that the passwords match? The purpose here is to confirm that the user is really wanting to change their password and catch a potential error. If he doesn't want to change his password, he shouldn't fill it in.

There must be something I'm missing here. I went ahead and tested in the latest Firefox, but not seeing any issues here. Need more info.

[somatonic]

"He" is the Firefox Browser not a user.

"Could it be that firefox prefills your password field? Normally both fields are empty."
... "yep he fills in something."

[ryancramerdesign]

I thought Firefox was a "she" ?

On Mon, Jun 29, 2015 at 4:11 AM, Philipp Urlich notifications@github.com
wrote:

"He" is the Firefox Browser not a user.

—
Reply to this email directly or view it on GitHub
#1236 (comment)
.

[FdeQuillettes]

Firefox does this if the user saved their login information in FireFox and it finds a username and password field in the form. As of FireFox 38 there is no easy way to disable this behaviour: https://developer.mozilla.org/en-US/docs/Web/Security/Securing_your_site/Turning_off_form_autocompletion#The_autocomplete_attribute_and_login_fields

[ryancramerdesign]

Just read that link. Ignoring the autocomplete=off attribute is one bad
thing. But apparently Firefox goes further and doesn't leave any room for
"change password" functions then, at least not without some significant
confusion. That seems like a bit of a security problem on its own.

On that page, they claim the behavior is the same as in Chrome and IE 11,
but it's definitely not. Firefox seems to be the only one that will
autofill a Password field without a corresponding username/login field.
Seems like they didn't think this one through very well.

Certainly problematic if you are a manager of user accounts too. How is one
supposed to use Firefox? I stopped using Firefox a long time ago because
it's so unbearably slow (on my computer at least), but always counted on it
to be pretty consistent and reliable outside of that, so am surprised at
this behavior.

On Tue, Jun 30, 2015 at 9:04 AM, FdeQuillettes notifications@github.com
wrote:

Firefox does this if the user saved their login information in FireFox and
it finds a username and password field in the form. As of FireFox 38 there
is no easy way to disable this behaviour:
https://developer.mozilla.org/en-US/docs/Web/Security/Securing_your_site/Turning_off_form_autocompletion#The_autocomplete_attribute_and_login_fields

—
Reply to this email directly or view it on GitHub
#1236 (comment)
.

[horst-n]

If there is no other solution found, (and I have missed it), here is what I have done:
added this line to ProcessProfile.module after line 75:

  if($field->type instanceof FieldtypePassword && $field->name == 'pass') $inputfield->attr('autocomplete', 'off');

and then check with Javascript on document.ready:

$(document).ready(function() {
    // prevent browser supported autocomplete for password fields (e.g. on Profilepage)
    // to force this, attribute autocomplete='off' needs to be set for the password field
    if ($(".FieldtypePassword[autocomplete='off']")) {
        // simply set the value empty on document.ready doesn't work in FireFox,
        // but one second later, it works :)
        setTimeout(function() {
            $(".FieldtypePassword[autocomplete='off']").attr('value', '');
        }, 1000);
    }
});

For the javascript I currently use AdminCustomFiles from Martijn, but I would love to see this included into PW directly.

[ryancramerdesign]

Seems like a good solution, thanks @horst-n ! I will go ahead and add this. Do we need to do the same thing for ProcessUser.module, or does Firefox not have issues there?

[horst-n]

Currently I don't have this behave on pages with ProcessUser, but it is a good idea to add the autocomplete='off' there too. Because I believe it depends a bit on the settings a firefox user uses. So there are chances that the same odd behave can occur on ProcessUser pages too. :)

[GerardLuskin]

Running a fresh install of 2.7, I can confirm that this issue is present on ProcessUser pages when viewed via Firefox (v41, Linux).

To reproduce:
Login to back-end with Firefox...
Tell FF to remember password....
Navigate to Access > Users > Somebody
Result: Firefox populates password field with saved password.

Note, the fix present in the latest ProcessProfile.js (mentioned above by @horst-n) solves this issue, but something like this seems to work better:

$(document).ready(function() {
    // from @horst-n:
    // prevent browser supported autocomplete for password fields (e.g. on Profilepage)
    // to force this, attribute autocomplete='off' needs to be set for the password field
    if ($(".FieldtypePassword[autocomplete='off']")) {
        // simply set the value empty on document.ready doesn't work in FireFox,
        // but one second later, it works :)
        setTimeout(function() {
            var field = $(".FieldtypePassword[autocomplete='off']");
            field.attr('value', '');
            // remove class added by change event in inputfields.js
            field.closest('.Inputfield').removeClass('InputfieldStateChanged');
        }, 1000);
    }
});

Reason: FireFox seems to fire the "change" event when it populates the password field... so attempts to navigate away from the page are met with "This page is asking you to confirm that you want to leave..."

The above code amendment removes the class added by the "change" event handler in /wire/templates-admin/scripts/inputfields.js ... possibly not the cleanest solution, but hasn't broken anything yet ;)

[ryancramerdesign]

Thanks @GerardLuskin and @horst-n I have committed a follow-up fix per your recommendations.