From 6d42cd80172da0a1aef852e553406e6820e2a4f5 Mon Sep 17 00:00:00 2001
From: William Desportes <williamdes@wdes.fr>
Date: Mon, 16 Jan 2023 12:43:54 +0400
Subject: [PATCH] Add `spellcheck="false"` on some login text fields to avoid
 data leaks to spell checking services

Ref: https://www.otto-js.com/news/article/chrome-and-edge-enhanced-spellcheck-features-expose-pii-even-your-passwords

Signed-off-by: William Desportes <williamdes@wdes.fr>
---
 examples/signon.php                                        | 2 +-
 templates/login/form.twig                                  | 2 +-
 templates/server/privileges/login_information_fields.twig  | 2 +-
 templates/server/replication/primary_add_replica_user.twig | 2 +-
 test/classes/Plugins/Auth/AuthenticationCookieTest.php     | 2 +-
 5 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/examples/signon.php b/examples/signon.php
index 3cb9a82855..f3754fb4c7 100644
--- a/examples/signon.php
+++ b/examples/signon.php
@@ -59,7 +59,7 @@ if (isset($_POST['user'])) {
     }
 
     echo '<form action="signon.php" method="post">
-Username: <input type="text" name="user" autocomplete="username"><br>
+Username: <input type="text" name="user" autocomplete="username" spellcheck="false"><br>
 Password: <input type="password" name="password" autocomplete="current-password" spellcheck="false"><br>
 Host: (will use the one from config.inc.php by default)
 <input type="text" name="host"><br>
diff --git a/templates/login/form.twig b/templates/login/form.twig
index a592b9028a..59574ea2a8 100644
--- a/templates/login/form.twig
+++ b/templates/login/form.twig
@@ -76,7 +76,7 @@
           {% trans 'Username:' %}
         </label>
         <div class="col-sm-8">
-          <input type="text" name="pma_username" id="input_username" value="{{ default_user }}" class="form-control" autocomplete="username">
+          <input type="text" name="pma_username" id="input_username" value="{{ default_user }}" class="form-control" autocomplete="username" spellcheck="false">
         </div>
       </div>
 
diff --git a/templates/server/privileges/login_information_fields.twig b/templates/server/privileges/login_information_fields.twig
index 69b2de0185..01ac279a62 100644
--- a/templates/server/privileges/login_information_fields.twig
+++ b/templates/server/privileges/login_information_fields.twig
@@ -8,7 +8,7 @@
         <option value="userdefined"{{ pred_username is null or pred_username == 'userdefined' ? ' selected' }}>{% trans 'Use text field' %}</option>
       </select>
     </span>
-    <input type="text" name="username" id="pma_username" class="autofocus" maxlength="{{ username_length }}" title="{% trans 'User name' %}"
+    <input type="text" name="username" id="pma_username" class="autofocus" spellcheck="false" maxlength="{{ username_length }}" title="{% trans 'User name' %}"
       {%- if username is not empty %} value="{{ new_username is not null ? new_username : username }}"{% endif -%}
       {{- pred_username is null or pred_username == 'userdefined' ? ' required' }}>
 
diff --git a/templates/server/replication/primary_add_replica_user.twig b/templates/server/replication/primary_add_replica_user.twig
index 5dc9574aa4..6140bcde4e 100644
--- a/templates/server/replication/primary_add_replica_user.twig
+++ b/templates/server/replication/primary_add_replica_user.twig
@@ -21,7 +21,7 @@
             <option value="userdefined"{{ predefined_username == 'userdefined' ? ' selected' }}>{% trans 'Use text field:' %}</option>
           </select>
         </span>
-        <input type="text" name="username" id="pma_username" maxlength="{{ username_length }}" title="{% trans 'User name' %}" value="{{ username }}">
+        <input type="text" name="username" id="pma_username" maxlength="{{ username_length }}" title="{% trans 'User name' %}" value="{{ username }}" spellcheck="false">
       </div>
 
       <div class="item">
diff --git a/test/classes/Plugins/Auth/AuthenticationCookieTest.php b/test/classes/Plugins/Auth/AuthenticationCookieTest.php
index a8bedf551d..b1c8379ab5 100644
--- a/test/classes/Plugins/Auth/AuthenticationCookieTest.php
+++ b/test/classes/Plugins/Auth/AuthenticationCookieTest.php
@@ -221,7 +221,7 @@ class AuthenticationCookieTest extends AbstractNetworkTestCase
 
         $this->assertStringContainsString(
             '<input type="text" name="pma_username" id="input_username" ' .
-            'value="pmauser" class="form-control" autocomplete="username">',
+            'value="pmauser" class="form-control" autocomplete="username" spellcheck="false">',
             $result
         );