From 6edb7495346119e2ceb25f5b5b5568b4b890dd86 Mon Sep 17 00:00:00 2001
From: Olivier Dony <odo@openerp.com>
Date: Wed, 21 Dec 2016 10:49:01 +0100
Subject: [FIX] web: provide correct autofill browser hints

Modern browser implement the autofill specs as described at
 https://html.spec.whatwg.org/multipage/forms.html#autofill

This means that there is now a way to tell the browser when a password
field is supposed to be filled with the user's own password (e.g. on a
login field), and when it's supposed to be used to input a new secret
value (e.g. when changing someone else's password).

This can be distinguished by setting the autocomplete attribute
to `current-password` or `new-password`.

In addition, many browsers have decided to entirely disregard the
autocomplete='off' attribute value, because it is felt that using
a secure password manager (as provided by those browsers) is a net
gain for security, allowing users to pick stron passwords.
See also https://developer.mozilla.org/en-US/docs/Web/Security/Securing_your_site/Turning_off_form_autocompletion

Based on this, the framework should generally consider that
password fields in the backend are meant to be used for *setting*
new values (autocomplete="new-password", i.e. no autocompletion!),
whereas the password field on the login page can indeed be autofilled
with the user's current password (autocomplete="current-password").

In addition to making the above changes, this patch also
lets developer specify their own `autocomplete` attribute on
text input fields.
---
 addons/web/static/src/xml/base.xml | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

(limited to 'addons/web/static/src/xml/base.xml')

diff --git a/addons/web/static/src/xml/base.xml b/addons/web/static/src/xml/base.xml
index 370b2d40f8d..faa9f4e8c46 100644
--- a/addons/web/static/src/xml/base.xml
+++ b/addons/web/static/src/xml/base.xml
@@ -42,17 +42,17 @@
             <tr>
                 <td class="oe_form_group_cell oe_form_group_cell_label"><label for="old_pwd" class="oe_form_label">Old Password:</label></td>
                 <td class="oe_form_group_cell"><input type="password" name="old_pwd"
-                           minlength="1" autofocus="autofocus"/></td>
+                           minlength="1" autofocus="autofocus" autocomplete="current-password"/></td>
             </tr>
             <tr>
             <td class="oe_form_group_cell oe_form_group_cell_label"><label for="new_password" class="oe_form_label">New Password:</label></td>
             <td class="oe_form_group_cell"><input type="password" name="new_password"
-                       minlength="1"/></td>
+                       minlength="1" autocomplete="new-password"/></td>
             </tr>
             <tr>
                 <td class="oe_form_group_cell oe_form_group_cell_label"><label for="confirm_pwd" class="oe_form_label">Confirm New Password:</label></td>
                 <td class="oe_form_group_cell"><input type="password" name="confirm_pwd"
-                             minlength="1"/></td>
+                             minlength="1" autocomplete="new-password"/></td>
             </tr>
             <tr>
                 <td colspan="2" align="right">
@@ -712,6 +712,7 @@
                 t-att-autofocus="widget.node.attrs.autofocus"
                 t-att-placeholder="widget.node.attrs.placeholder"
                 t-att-maxlength="widget.field.size"
+                t-att-autocomplete="widget.password ? 'new-password' : widget.node.attrs.autocomplete"
             /><img class="oe_field_translate oe_input_icon" t-if="widget.field.translate" t-att-src='_s + "/web/static/src/img/icons/terp-translate.png"' width="16" height="16" border="0"/>
         </t>
         <t t-if="widget.get('effective_readonly')">
-- 
cgit v1.2.3