From 0513ba8d9f431cac17152f9366f8433906a7846f Mon Sep 17 00:00:00 2001
From: Alexandre Alapetite <alexandre@alapetite.fr>
Date: Tue, 1 May 2018 21:50:45 +0200
Subject: Use HTML autocomplete new-password (#1877)

* Use HTML autocomplete new-password

https://github.com/FreshRSS/FreshRSS/issues/1841#issuecomment-376551901
autocomplete="new-password" for user management pages

https://developer.mozilla.org/en-US/docs/Web/Security/Securing_your_site/Turning_off_form_autocompletion

* autocomplete username

https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#attr-fe-autocomplete-username
---
 app/views/user/manage.phtml  | 2 +-
 app/views/user/profile.phtml | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

(limited to 'app/views/user')

diff --git a/app/views/user/manage.phtml b/app/views/user/manage.phtml
index 26838fcc1..9d457f7a5 100644
--- a/app/views/user/manage.phtml
+++ b/app/views/user/manage.phtml
@@ -66,7 +66,7 @@
 			<label class="group-name" for="newPasswordPlain"><?php echo _t('admin.user.password_form'); ?></label>
 			<div class="group-controls">
 				<div class="stick">
-					<input type="password" id="newPasswordPlain" name="newPasswordPlain" autocomplete="off" pattern=".{7,}" <?php echo cryptAvailable() ? '' : 'disabled="disabled" '; ?>/>
+					<input type="password" id="newPasswordPlain" name="newPasswordPlain" autocomplete="new-password" pattern=".{7,}" <?php echo cryptAvailable() ? '' : 'disabled="disabled" '; ?>/>
 					<a class="btn toggle-password" data-toggle="newPasswordPlain"><?php echo _i('key'); ?></a>
 				</div>
 				<?php echo _i('help'); ?> <?php echo _t('conf.profile.password_format'); ?>
diff --git a/app/views/user/profile.phtml b/app/views/user/profile.phtml
index 7a63c0941..83140376d 100644
--- a/app/views/user/profile.phtml
+++ b/app/views/user/profile.phtml
@@ -22,7 +22,7 @@
 			<label class="group-name" for="newPasswordPlain"><?php echo _t('conf.profile.password_form'); ?></label>
 			<div class="group-controls">
 				<div class="stick">
-					<input type="password" id="newPasswordPlain" name="newPasswordPlain" autocomplete="off" pattern=".{7,}" <?php echo cryptAvailable() ? '' : 'disabled="disabled" '; ?>/>
+					<input type="password" id="newPasswordPlain" name="newPasswordPlain" autocomplete="new-password" pattern=".{7,}" <?php echo cryptAvailable() ? '' : 'disabled="disabled" '; ?>/>
 					<a class="btn toggle-password" data-toggle="newPasswordPlain"><?php echo _i('key'); ?></a>
 				</div>
 				<?php echo _i('help'); ?> <?php echo _t('conf.profile.password_format'); ?>
@@ -35,7 +35,7 @@
 			<label class="group-name" for="apiPasswordPlain"><?php echo _t('conf.profile.password_api'); ?></label>
 			<div class="group-controls">
 				<div class="stick">
-					<input type="password" id="apiPasswordPlain" name="apiPasswordPlain" autocomplete="off" pattern=".{7,}" <?php echo cryptAvailable() ? '' : 'disabled="disabled" '; ?>/>
+					<input type="password" id="apiPasswordPlain" name="apiPasswordPlain" autocomplete="new-password" pattern=".{7,}" <?php echo cryptAvailable() ? '' : 'disabled="disabled" '; ?>/>
 					<a class="btn toggle-password" data-toggle="apiPasswordPlain"><?php echo _i('key'); ?></a>
 				</div>
 				<?php echo _i('help'); ?> <kbd><a href="../api/"><?php echo Minz_Url::display('/api/', 'html', true); ?></a></kbd>
-- 
cgit v1.2.3