Skip to content

Commit 4822eed

Browse files
wxiaoguangzeripath
wxiaoguang
and
zeripath
authored
Disable form autofill (#17291)
]* fix aria-hidden and tabindex * use {{template "base/disable_form_autofill"}} instead of {{DisableFormAutofill}} Co-authored-by: zeripath <[email protected]>
1 parent c59afa7 commit 4822eed

File tree

13 files changed

+51
-15
lines changed

13 files changed

+51
-15
lines changed

‎templates/admin/auth/edit.tmpl

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@
88
</h4>
99
<div class="ui attached segment">
1010
<form class="ui form" action="{{.Link}}" method="post">
11+
{{template "base/disable_form_autofill"}}
1112
{{.CsrfTokenHtml}}
1213
<input type="hidden" name="id" value="{{.Source.ID}}">
1314
<div class="inline field">
@@ -55,7 +56,6 @@
5556
<label for="bind_dn">{{.i18n.Tr "admin.auths.bind_dn"}}</label>
5657
<input id="bind_dn" name="bind_dn" value="{{$cfg.BindDN}}" placeholder="e.g. cn=Search,dc=mydomain,dc=com">
5758
</div>
58-
<input class="fake" type="password">
5959
<div class="field">
6060
<label for="bind_password">{{.i18n.Tr "admin.auths.bind_password"}}</label>
6161
<input id="bind_password" name="bind_password" type="password" value="{{$cfg.BindPassword}}">

‎templates/admin/auth/new.tmpl

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@
88
</h4>
99
<div class="ui attached segment">
1010
<form class="ui form" action="{{.Link}}" method="post">
11+
{{template "base/disable_form_autofill"}}
1112
{{.CsrfTokenHtml}}
1213
<!-- Types and name -->
1314
<div class="inline required field {{if .Err_Type}}error{{end}}">

‎templates/admin/auth/source/ldap.tmpl

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,6 @@
3030
<label for="bind_dn">{{.i18n.Tr "admin.auths.bind_dn"}}</label>
3131
<input id="bind_dn" name="bind_dn" value="{{.bind_dn}}" placeholder="e.g. cn=Search,dc=mydomain,dc=com">
3232
</div>
33-
<input class="fake" type="password">
3433
<div class="ldap field {{if not (eq .type 2)}}hide{{end}}">
3534
<label for="bind_password">{{.i18n.Tr "admin.auths.bind_password"}}</label>
3635
<input id="bind_password" name="bind_password" type="password" autocomplete="off" value="{{.bind_password}}">

‎templates/admin/user/edit.tmpl

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@
88
</h4>
99
<div class="ui attached segment">
1010
<form class="ui form" action="{{.Link}}" method="post">
11+
{{template "base/disable_form_autofill"}}
1112
{{.CsrfTokenHtml}}
1213
<div class="field {{if .Err_UserName}}error{{end}}">
1314
<label for="user_name">{{.i18n.Tr "username"}}</label>
@@ -67,7 +68,6 @@
6768
<label for="email">{{.i18n.Tr "email"}}</label>
6869
<input id="email" name="email" type="email" value="{{.User.Email}}" autofocus required>
6970
</div>
70-
<input class="fake" type="password">
7171
<div class="local field {{if .Err_Password}}error{{end}} {{if not (or (.User.IsLocal) (.User.IsOAuth2))}}hide{{end}}">
7272
<label for="password">{{.i18n.Tr "password"}}</label>
7373
<input id="password" name="password" type="password" autocomplete="new-password">

‎templates/admin/user/new.tmpl

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@
88
</h4>
99
<div class="ui attached segment">
1010
<form class="ui form" action="{{.Link}}" method="post">
11+
{{template "base/disable_form_autofill"}}
1112
{{.CsrfTokenHtml}}
1213
<!-- Types and name -->
1314
<div class="inline required field {{if .Err_LoginType}}error{{end}}">
@@ -61,7 +62,6 @@
6162
<label for="email">{{.i18n.Tr "email"}}</label>
6263
<input id="email" name="email" type="email" value="{{.email}}" required>
6364
</div>
64-
<input class="fake" type="password">
6565
<div class="required local field {{if .Err_Password}}error{{end}} {{if not (eq .login_type "0-0")}}hide{{end}}">
6666
<label for="password">{{.i18n.Tr "password"}}</label>
6767
<input id="password" name="password" type="password" autocomplete="new-password" value="{{.password}}" {{if eq .login_type "0-0"}}required{{end}}>

‎templates/base/disable_form_autofill.tmpl

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
{{/*
2+
Why we need to disable form autofill:
3+
1. Many pages contain different password inputs for different usages, eg: repo setting, autofill will make a mess.
4+
2. We have `areYouSure` confirm dialog if a user leaves a pages without submit.
5+
Autofill will make the form changed even if the user didn't input anything. Then the user keeps seeing annoying confirm dialog.
6+
7+
In history, Gitea put `<input class="fake" type="password">` in forms to bypass the autofill,
8+
but there were still many forms suffered the autofill problem.
9+
10+
Now we improve it.
11+
12+
Solutions which do NOT work:
13+
1. Adding `autocomplete=off` doesn't help. New Chrome completely ignores it.
14+
2. Use a JavaScript to run in a few seconds later after the page is loaded to process the autofilled inputs, it doesn't work.
15+
Because for security reason, the inputs won't be filled before the user makes an interaction in the page.
16+
So we can not predict the correct time to run the JavaScript code.
17+
18+
Solutions which work:
19+
1. Some hacky methods like: https://github.com/matteobad/detect-autofill
20+
2. This solution: use invisible inputs. Be aware of:
21+
(a) The inputs must be at the beginning of the form, and can not be hidden.
22+
(b) The input for username must have a valid name.
23+
(c) There should be no negative word (eg: fake) in the `name` attribute.
24+
(d) Chrome seems to use a weighted algorithm to choose an input to fill text, so the using "username" as input name is better than using "user".
25+
We make the names of these dummy inputs begin with an underline to indicate it is for special usage,
26+
and these dummy form values won't be used by backend code.
27+
*/}}
28+
<div class="autofill-dummy" aria-hidden="true">
29+
<input type="text" name="_autofill_dummy_username" class="ays-ignore" tabindex="-1">
30+
<input type="password" name="_autofill_dummy_password" class="ays-ignore" tabindex="-1">
31+
</div>

‎templates/repo/migrate/git.tmpl

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33
<div class="ui middle very relaxed page grid">
44
<div class="column">
55
<form class="ui form" action="{{.Link}}" method="post">
6+
{{template "base/disable_form_autofill"}}
67
{{.CsrfTokenHtml}}
78
<h3 class="ui top attached header">
89
{{.i18n.Tr "repo.migrate.migrate" .service.Title}}
@@ -21,7 +22,6 @@
2122
<label for="auth_username">{{.i18n.Tr "username"}}</label>
2223
<input id="auth_username" name="auth_username" value="{{.auth_username}}" {{if not .auth_username}}data-need-clear="true"{{end}}>
2324
</div>
24-
<input class="fake" type="password">
2525
<div class="inline field {{if .Err_Auth}}error{{end}}">
2626
<label for="auth_password">{{.i18n.Tr "password"}}</label>
2727
<input id="auth_password" name="auth_password" type="password" value="{{.auth_password}}">

‎templates/repo/migrate/onedev.tmpl

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33
<div class="ui middle very relaxed page grid">
44
<div class="column">
55
<form class="ui form" action="{{.Link}}" method="post">
6+
{{template "base/disable_form_autofill"}}
67
{{.CsrfTokenHtml}}
78
<h3 class="ui top attached header">
89
{{.i18n.Tr "repo.migrate.migrate" .service.Title}}
@@ -22,7 +23,6 @@
2223
<label for="auth_username">{{.i18n.Tr "username"}}</label>
2324
<input id="auth_username" name="auth_username" value="{{.auth_username}}" {{if not .auth_username}}data-need-clear="true"{{end}}>
2425
</div>
25-
<input class="fake" type="password">
2626
<div class="inline field {{if .Err_Auth}}error{{end}}">
2727
<label for="auth_password">{{.i18n.Tr "password"}}</label>
2828
<input id="auth_password" name="auth_password" type="password" value="{{.auth_password}}">

‎templates/repo/settings/options.tmpl

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@
99
</h4>
1010
<div class="ui attached segment">
1111
<form class="ui form" action="{{.Link}}" method="post">
12+
{{template "base/disable_form_autofill"}}
1213
{{.CsrfTokenHtml}}
1314
<input type="hidden" name="action" value="update">
1415
<div class="required field {{if .Err_RepoName}}error{{end}}">
@@ -104,6 +105,7 @@
104105
<tr>
105106
<td colspan="4">
106107
<form class="ui form" method="post">
108+
{{template "base/disable_form_autofill"}}
107109
{{.CsrfTokenHtml}}
108110
<input type="hidden" name="action" value="mirror">
109111
<div class="inline field {{if .Err_EnablePrune}}error{{end}}">
@@ -132,7 +134,6 @@
132134
<label for="mirror_username">{{.i18n.Tr "username"}}</label>
133135
<input id="mirror_username" name="mirror_username" value="{{$address.Username}}" {{if not .mirror_username}}data-need-clear="true"{{end}}>
134136
</div>
135-
<input class="fake" type="password">
136137
<div class="inline field {{if .Err_Auth}}error{{end}}">
137138
<label for="mirror_password">{{.i18n.Tr "password"}}</label>
138139
<input id="mirror_password" name="mirror_password" type="password" placeholder="{{if $address.Password}}{{.i18n.Tr "repo.mirror_password_placeholder"}}{{else}}{{.i18n.Tr "repo.mirror_password_blank_placeholder"}}{{end}}" value="" {{if not .mirror_password}}data-need-clear="true"{{end}} autocomplete="off">
@@ -195,11 +196,12 @@
195196
<tr>
196197
<td colspan="4">
197198
<form class="ui form" method="post">
199+
{{template "base/disable_form_autofill"}}
198200
{{.CsrfTokenHtml}}
199201
<input type="hidden" name="action" value="push-mirror-add">
200202
<div class="field {{if .Err_PushMirrorAddress}}error{{end}}">
201203
<label for="push_mirror_address">{{.i18n.Tr "repo.settings.mirror_settings.push_mirror.remote_url"}}</label>
202-
<input id="push_mirror_address" name="push_mirror_address" value="{{.push_mirror_address}}" autocomplete="off" required>
204+
<input id="push_mirror_address" name="push_mirror_address" value="{{.push_mirror_address}}" required>
203205
<p class="help">{{.i18n.Tr "repo.mirror_address_desc"}}</p>
204206
</div>
205207
<details class="ui optional field" {{if or .Err_PushMirrorAuth .push_mirror_username}}open{{end}}>
@@ -211,7 +213,6 @@
211213
<label for="push_mirror_username">{{.i18n.Tr "username"}}</label>
212214
<input id="push_mirror_username" name="push_mirror_username" value="{{.push_mirror_username}}">
213215
</div>
214-
<input class="fake" type="password">
215216
<div class="inline field {{if .Err_PushMirrorAuth}}error{{end}}">
216217
<label for="push_mirror_password">{{.i18n.Tr "password"}}</label>
217218
<input id="push_mirror_password" name="push_mirror_password" type="password" value="{{.push_mirror_password}}" autocomplete="off">

‎templates/repo/settings/webhook/gitea.tmpl

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
{{if eq .HookType "gitea"}}
22
<p>{{.i18n.Tr "repo.settings.add_webhook_desc" "https://docs.gitea.io/en-us/webhooks/" | Str2html}}</p>
33
<form class="ui form" action="{{.BaseLink}}/gitea/{{or .Webhook.ID "new"}}" method="post">
4+
{{template "base/disable_form_autofill"}}
45
{{.CsrfTokenHtml}}
56
<div class="required field {{if .Err_PayloadURL}}error{{end}}">
67
<label for="payload_url">{{.i18n.Tr "repo.settings.payload_url"}}</label>
@@ -30,7 +31,6 @@
3031
</div>
3132
</div>
3233
</div>
33-
<input class="fake" type="password">
3434
<div class="field {{if .Err_Secret}}error{{end}}">
3535
<label for="secret">{{.i18n.Tr "repo.settings.secret"}}</label>
3636
<input id="secret" name="secret" type="password" value="{{.Webhook.Secret}}" autocomplete="off">

‎templates/repo/settings/webhook/gogs.tmpl

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
{{if eq .HookType "gogs"}}
22
<p>{{.i18n.Tr "repo.settings.add_webhook_desc" "https://docs.gitea.io/en-us/webhooks/" | Str2html}}</p>
33
<form class="ui form" action="{{.BaseLink}}/gogs/{{or .Webhook.ID "new"}}" method="post">
4+
{{template "base/disable_form_autofill"}}
45
{{.CsrfTokenHtml}}
56
<div class="required field {{if .Err_PayloadURL}}error{{end}}">
67
<label for="payload_url">{{.i18n.Tr "repo.settings.payload_url"}}</label>
@@ -18,7 +19,6 @@
1819
</div>
1920
</div>
2021
</div>
21-
<input class="fake" type="password">
2222
<div class="field {{if .Err_Secret}}error{{end}}">
2323
<label for="secret">{{.i18n.Tr "repo.settings.secret"}}</label>
2424
<input id="secret" name="secret" type="password" value="{{.Webhook.Secret}}" autocomplete="off">

‎templates/user/settings/account.tmpl

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@
99
<div class="ui attached segment">
1010
{{if or (.SignedUser.IsLocal) (.SignedUser.IsOAuth2)}}
1111
<form class="ui form ignore-dirty" action="{{AppSubUrl}}/user/settings/account" method="post">
12+
{{template "base/disable_form_autofill"}}
1213
{{.CsrfTokenHtml}}
1314
{{if .SignedUser.IsPasswordSet}}
1415
<div class="required field {{if .Err_OldPassword}}error{{end}}">
@@ -178,8 +179,8 @@
178179
{{ end }}
179180
</div>
180181
<form class="ui form ignore-dirty" id="delete-form" action="{{AppSubUrl}}/user/settings/account/delete" method="post">
182+
{{template "base/disable_form_autofill"}}
181183
{{.CsrfTokenHtml}}
182-
<input class="fake" type="password">
183184
<div class="required field {{if .Err_Password}}error{{end}}">
184185
<label for="password-confirmation">{{.i18n.Tr "password"}}</label>
185186
<input id="password-confirmation" name="password" type="password" autocomplete="off" required>

‎web_src/less/_base.less

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -962,10 +962,13 @@ a.ui.card:hover,
962962
}
963963

964964
.form {
965-
.fake {
966-
display: none !important;
965+
.autofill-dummy {
966+
position: absolute;
967+
width: 1px;
968+
height: 1px;
969+
overflow: hidden;
970+
z-index: -10000;
967971
}
968-
969972
.sub.field {
970973
margin-left: 25px;
971974
}

0 commit comments

Comments
 (0)