gian/phpmyadmin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add spellcheck="false" on password fields to avoid data leaks to spell checking services

Browse Source 
Ref: https://www.otto-js.com/news/article/chrome-and-edge-enhanced-spellcheck-features-expose-pii-even-your-passwords

Signed-off-by: William Desportes <williamdes@wdes.fr>
This commit is contained in:
William Desportes 2023-01-16 12:36:39 +04:00
parent f7d9321d02
commit 2f2f7d4c92
No known key found for this signature in database
GPG Key ID: 90A0EF1B8251A889
8 changed files with 11 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
examples/signon.php
View File

@ -60,7 +60,7 @@ if (isset($_POST['user'])) {
echo '<form action="signon.php" method="post">
Username: <input type="text" name="user" autocomplete="username"><br>
Password: <input type="password" name="password" autocomplete="current-password"><br>
Password: <input type="password" name="password" autocomplete="current-password" spellcheck="false"><br>
Host: (will use the one from config.inc.php by default)
<input type="text" name="host"><br>
Port: (will use the one from config.inc.php by default)

2
templates/config/form_display/input.twig
View File

@ -26,7 +26,7 @@
{% if type == 'text' %}
<input type="text" name="{{ path }}" id="{{ path }}" value="{{ value }}" class="w-75{{ not value_is_default ? (has_errors ? ' custom field-error' : ' custom') }}">
{% elseif type == 'password' %}
<input type="password" name="{{ path }}" id="{{ path }}" value="{{ value }}" class="w-75{{ not value_is_default ? (has_errors ? ' custom field-error' : ' custom') }}">
<input type="password" name="{{ path }}" id="{{ path }}" value="{{ value }}" class="w-75{{ not value_is_default ? (has_errors ? ' custom field-error' : ' custom') }}" spellcheck="false">
{% elseif type == 'short_text' and value is not iterable %}
{# https://github.com/phpmyadmin/phpmyadmin/issues/11505 #}
<input type="text" size="25" name="{{ path }}" id="{{ path }}" value="{{ value }}" class="{{ not value_is_default ? (has_errors ? 'custom field-error' : 'custom') }}">

2
templates/login/form.twig
View File

@ -85,7 +85,7 @@
{% trans 'Password:' %}
</label>
<div class="col-sm-8">
<input type="password" name="pma_password" id="input_password" value="" class="form-control" autocomplete="current-password">
<input type="password" name="pma_password" id="input_password" value="" class="form-control" autocomplete="current-password" spellcheck="false">
</div>
</div>

4
templates/server/privileges/change_password.twig
View File

@ -22,7 +22,7 @@
</td>
<td>
{% trans 'Enter:' %}&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
<input type="password" name="pma_pw" id="text_pma_change_pw" size="10" class="textfield"
<input type="password" spellcheck="false" name="pma_pw" id="text_pma_change_pw" size="10" class="textfield"
onkeyup="Functions.checkPasswordStrength($(this).val(), $('#change_password_strength_meter'), meter_obj_label = $('#change_password_strength'), CommonParams.get('user'));"
onchange="nopass[1].checked = true">
<span>{% trans %}Strength:{% context %}Password strength{% endtrans %}</span>
@ -30,7 +30,7 @@
<span id="change_password_strength" name="pw_strength"></span>
<br>
{% trans 'Re-type:' %}&nbsp;
<input type="password" name="pma_pw2" id="text_pma_change_pw2" size="10" class="textfield" onchange="nopass[1].checked = true">
<input type="password" spellcheck="false" name="pma_pw2" id="text_pma_change_pw2" size="10" class="textfield" onchange="nopass[1].checked = true">
</td>
</tr>

4
templates/server/privileges/login_information_fields.twig
View File

@ -50,7 +50,7 @@
<option value="userdefined"{{ username is null ? ' selected' }}>{% trans 'Use text field' %}</option>
</select>
</span>
<input type="password" id="text_pma_pw" name="pma_pw" title="{% trans 'Password' %}"{{ username is null ? ' required' }}>
<input type="password" spellcheck="false" id="text_pma_pw" name="pma_pw" title="{% trans 'Password' %}"{{ username is null ? ' required' }}>
<span>{% trans %}Strength:{% context %}Password strength{% endtrans %}</span>
<meter max="4" id="password_strength_meter" name="pw_meter"></meter>
<span id="password_strength" name="pw_strength"></span>
@ -59,7 +59,7 @@
<div class="item" id="div_element_before_generate_password">
<label for="text_pma_pw2">{% trans 'Re-type:' %}</label>
<span class="options">&nbsp;</span>
<input type="password" name="pma_pw2" id="text_pma_pw2" title="{% trans 'Re-type' %}"{{ username is null ? ' required' }}>
<input type="password" spellcheck="false" name="pma_pw2" id="text_pma_pw2" title="{% trans 'Re-type' %}"{{ username is null ? ' required' }}>
</div>
<div class="item" id="authentication_plugin_div">

2
templates/server/replication/change_primary.twig
View File

@ -16,7 +16,7 @@
</div>
<div class="item">
<label for="text_pma_pw">{% trans 'Password:' %}</label>
<input id="text_pma_pw" name="pma_pw" type="password" title="{% trans 'Password' %}" required>
<input id="text_pma_pw" name="pma_pw" type="password" spellcheck="false" title="{% trans 'Password' %}" required>
</div>
<div class="item">
<label for="text_hostname">{% trans 'Host:' %}</label>

4
templates/server/replication/primary_add_replica_user.twig
View File

@ -54,7 +54,7 @@
<option value="userdefined"{{ not has_username ? ' selected' }}>{% trans 'Use text field:' %}</option>
</select>
</span>
<input type="password" id="text_pma_pw" name="pma_pw" title="{% trans 'Password' %}">
<input type="password" id="text_pma_pw" name="pma_pw" title="{% trans 'Password' %}" spellcheck="false">
</div>
<div class="item">
@ -62,7 +62,7 @@
{% trans 'Re-type:' %}
</label>
<span class="options"></span>
<input type="password" id="text_pma_pw2" name="pma_pw2" title="{% trans 'Re-type' %}">
<input type="password" id="text_pma_pw2" name="pma_pw2" title="{% trans 'Re-type' %}" spellcheck="false">
</div>
<div class="item">

2
test/classes/Plugins/Auth/AuthenticationCookieTest.php
View File

@ -227,7 +227,7 @@ class AuthenticationCookieTest extends AbstractNetworkTestCase
$this->assertStringContainsString(
'<input type="password" name="pma_password" id="input_password" ' .
'value="" class="form-control" autocomplete="current-password">',
'value="" class="form-control" autocomplete="current-password" spellcheck="false">',
$result
);