Feature #44268
closed
Prevent browsers from autofilling the administrator's own password into the user account form
Description
As a redmine admin, when editing a user account Chrome attempts to autofill the password field with my password, and a custom slack handle field with my username.
To suppress this behaviour, password field should have "autocomplete" directive to show that the field is intended to enter a new password.
Proposed patch:
https://github.com/redmine/redmine/commit/3a19f85f8e4c9ecee15c292d1dd2972a58b8d580
Related issues
Updated by Go MAEDA 20 days ago
- Related to Feature #41937: Enable browser autocomplete for login input fields added
Updated by Go MAEDA 20 days ago
- Target version set to Candidate for next minor release
Thank you for reporting this issue and for proposing a fix.
Using autocomplete="new-password" may cause the administrator's browser or password manager to offer generating a password, or to suggest saving or updating a password after the form is submitted. However, I think this is much better than the current behavior, where the administrator's own password may be autofilled into another user's password field.