Feature #44268
closed
Prevent browsers from autofilling the administrator's own password into the user account form
Description
As a redmine admin, when editing a user account Chrome attempts to autofill the password field with my password, and a custom slack handle field with my username.
To suppress this behaviour, password field should have "autocomplete" directive to show that the field is intended to enter a new password.
Proposed patch:
https://github.com/redmine/redmine/commit/3a19f85f8e4c9ecee15c292d1dd2972a58b8d580
Related issues
Updated by Go MAEDA about 1 month ago
- Related to Feature #41937: Enable browser autocomplete for login input fields added
Updated by Go MAEDA about 1 month ago
- Target version set to Candidate for next minor release
Thank you for reporting this issue and for proposing a fix.
Using autocomplete="new-password" may cause the administrator's browser or password manager to offer generating a password, or to suggest saving or updating a password after the form is submitted. However, I think this is much better than the current behavior, where the administrator's own password may be autofilled into another user's password field.
Updated by Go MAEDA about 1 month ago
- Target version changed from Candidate for next minor release to 7.0.1
Setting the target version to 7.0.1.