Fields incorrectly filled in by browsers in admin area

[Ryan Williams]

An issue I've noticed present in phpBB3 for a while is that when you go to an 'edit user' page in the admin control panel, certain browsers such as Firefox and Chrome will incorrectly fill in a couple of the fields with your login details if you happen to have the browser set to remember your phpBB login: the 'confirm email' field is populated with your username, and the 'password' field is populated with your password.

This isn't too problematic because due to the need to confirm emails and passwords a second time, so it can't realistically result in an accidental overwrite; however it does present an annoyance due to the need to either clear these fields whenever making user changes or instruct your browser to not remember your login details.

I haven't looked too deeply into what exactly this affects and why, but I assume it's down to something as little as the field IDs needing changing. It affects the latest versions of Firefox and Chrome at the very least, and in Firefox it's not so obvious the fields have been auto-filled as they don't go yellow like in Chrome.

I realise this is more a browser issue than a phpBB issue, but if it were my software I'd resolve this due to how often it's likely to be encountered — so do what you will.

[naderman]

I agree it would be great if we could avoid this somehow.

[Oleg]

Setting autocomplete=off on affected fields should do the trick. And deleting the second email field would make the addition of autocomplete=off harmless.

[DavidIQ]

I don't think the autocomplete attribute is valid XHTML.

[igorw]

It is not, but I care more about user experience than complying 100% with XHTML.

[naderman]

Yeah it'd be great if there was a way to avoid it, but I think usability comes first in this case.

[naderman]

Reopened this ticket and posted a fix: http://tracker.phpbb.com/browse/PHPBB3-8138

[bantu]

Hmm, I'm not sure. We've had a very strict policy about XHTML strictness in the past.

A similar issue would be http://tracker.phpbb.com/browse/PHPBB3-9457 which has been reverted because it was not XHTML strict.

[Ryan Williams]

Then maybe the IDs of the fields can be looked at to determine why it applies the auto-entry to those particular fields? It might be more of a workaround using obscure field IDs or whatever but that's certainly better than breaking validation.

[naderman]

Firefox simply picks any password field and the text input above it. Changing the ids does not circumvent that. Anyway this is ACP only, and a major PITA for users, so dropping this for concerns about markup validity seems like a poor choice.