Feature #44268
closed
Prevent browsers from autofilling the administrator's own password into the user account form
Description
As a redmine admin, when editing a user account Chrome attempts to autofill the password field with my password, and a custom slack handle field with my username.
To suppress this behaviour, password field should have "autocomplete" directive to show that the field is intended to enter a new password.
Proposed patch:
https://github.com/redmine/redmine/commit/3a19f85f8e4c9ecee15c292d1dd2972a58b8d580
Related issues
Updated by Go MAEDA 2 months ago
- Related to Feature #41937: Enable browser autocomplete for login input fields added
Updated by Go MAEDA 2 months ago
- Target version set to Candidate for next minor release
Thank you for reporting this issue and for proposing a fix.
Using autocomplete="new-password" may cause the administrator's browser or password manager to offer generating a password, or to suggest saving or updating a password after the form is submitted. However, I think this is much better than the current behavior, where the administrator's own password may be autofilled into another user's password field.
Updated by Go MAEDA about 2 months ago
- Target version changed from Candidate for next minor release to 7.0.1
Setting the target version to 7.0.1.
Updated by Go MAEDA about 2 months ago
- Subject changed from Password autocomplete in user edit page to Prevent browsers from autofilling the administrator's own password into the user account form
- Status changed from New to Resolved
- Assignee set to Go MAEDA
Committed the patch in r24877. Thank you.
Updated by Go MAEDA about 2 months ago
- Tracker changed from Patch to Feature
- Status changed from Resolved to Closed
- Resolution set to Fixed
Merged the change into 7.0-stable branch.