admin: browser autofills password on the edit profile page, leading to accidental password changes

[martinvonwittich]

I just discovered that Grav now supports 2FA, and of course I went ahead and enabled it at once. After logging out and trying to log back in, Grav surprised me with a "Login failed" message. At first I thought that I was doing something wrong or that the 2FA implementation was buggy, but thanks to a git diff on the server I was able to figure out that my password hash had been changed. I reverted my account yml file to the old hash and then I was able to login with 2FA.

The cause for this issue is the password field in the edit profile site. Chrome immediately auto-completed it with a password (I don't even know which one, but apparently not my Grav password!), and when I enabled 2FA and clicked on the Save button, I accidentally changed my password without even realizing that.

I would suggest that the password field should be replaced with a "Change password" button that loads its own site, and which then prompts for the old password, and for a new password twice.

[rhukster]

I have noticed this also, but as my autofill is the same password, it's never been an issue. I think the better solution is simply to add an option to the base field that allows forms to disable autocomplete:

autocomplete="off"

[martinvonwittich]

I think the better solution is simply to add an option to the base field that allows forms to disable autocomplete: autocomplete=off

I don't think that that will work; most modern browsers seem to ignore the autocomplete attribute on login fields because many sites abused it to prevent users from saving passwords: https://developer.mozilla.org/en-US/docs/Web/Security/Securing_your_site/Turning_off_form_autocompletion#The_autocomplete_attribute_and_login_fields

I tested it with the following TamplerMonkey script, and as I expected, it didn't prevent Chrome from filling my password field:

// ==UserScript==
// @name         grav test
// @namespace    http://tampermonkey.net/
// @version      0.1
// @description  try to take over the world!
// @author       You
// @match        https://myserver.example.com/admin/user/martin.von.wittich
// @require      https://code.jquery.com/jquery-3.3.1.slim.min.js
// @grant        none
// ==/UserScript==

(function() {
    'use strict';

    let e = $("input[name='data[password]']");
    console.log(e);
    e.attr("autocomplete", "off");
    console.log("disabled autocomplete!");
})();

I believe though that most browsers will not autocomplete password fields when they recognize password changing forms, but this probably requires 3 password fields (old password, 2x new password). Therefor my suggestion to implement a proper password changing form :)

[rhukster]

Actually, I found a simpler approach.. setting autocomplete="new-password" works for chrome.

[rhukster]

BTW, this needs updates for (Grav + Admin)