Bug #88832
closedautocomplete="off" on password fields in install tool configuration settings does not seem to work
100%
Description
I tried the applied patch in #88709, that sets the attribute autocomplete="off"
on most fields, in a TYPO3 9.5.8 installation.
The issue is, I told my Browser (Chrome) to save the TYPO3 login credentials. And afterwards, whenever I go into install Tool Settings and open the popup for "Configure Installation-Wide Options", it automatically fills in the username and passwords in some fields.
In Chrome (75) it has (so far) always been the filter input field (at the top) for the username and the password goes into the "[MAIL][transport_smtp_password]
" setting. In Firefox (68) username and password goes into "[MAIL][transport_smtp_username]
" and "[MAIL][transport_smtp_password]
" resp.
I could not reproduce the issue in Microsoft Edge. Haven't tried other browsers yet.
This problem still occurs with the applied patch, that sets autocomplete="off"
on those fields in both browsers.
However it seems for password fields you can use autocomplete="new-password"
to avoid the autofilling in those fields. Changing only that for password fields (in .../Partials/Settings/LocalConfiguration/SubSection.html
) made it work for both Chrome (75) and Firefox (68) in my installation.
According to the compatibility table on this page the "new-password" it's supported in firefox since version 67.
https://developer.mozilla.org/en-US/docs/Web/HTML/Attributes/autocomplete#Browser_compatibility
As I understand it those values are only hints for the Browser anyway and are not guaranteed to work. Also, those values for the autocomplete attribute seem to be only a recommendation at the moment and have not been officially merged in the HTML5 Standard. So it might change.