https://www.icyphoenix.com/viewtopic.php?f=35&t=514 ----------------------------------- moreteavicar Tue 24 Oct, 2006 14:24 Firefox and its dislike of Autocomplete = "off" ----------------------------------- Despite the tabbed browsing feature, Firefox otherwise is a real pain for many reasons, especially is you are a making a web page. One problem is autocompletion. You might want to make a site more secure/easier to administer by disabling auto-completion regardless of whather the user has it set in their preferenes. An example here is changing a usernames password because they've forgotten their original one. When you go into ACP>>user management, the username and password gets auto-filled by firefox - incredibly annoying! Yes, you can personally go into firefox and change the autofill settings (not by much, you can only delete them - mozilla had a much better system!), but we should be a little more clever and allow autocomplete still to work for some things, and not for others. I have tried, unsuccessfully thus far, to implement this for firefox though. I thought I'd list the ideas here, so that anybody else trying this will know what doesn't work... and maybe somebody might even know the answer! There is generally a tag for doing this: autocomplete = "off" which you can put inside the form and input tags. Older firefox derivatives, i.e. Mozilla, and Internet explorer, understand this attribute (even though its not W3C standard - not suprising, W3C takes years to do anything, and then cocks it all up). With Firefox, however, the mozdev team decided not to follow this attribute! If I open templates/ca_aphrodite/adm/user_edit_body and change the opening form line to [codeblock]
[codeblock] Firefox still autofills! Adding it to the input tag: Firefox still autofills! Removing "address" in lang_main for related input fields (e.g. emial address, AIM address): No result. (See http://developer.mozilla.org/en/docs/How_to_Turn_Off_Form_Autocompletion - it gives conditions of where autocomplete="off" fails). There are some suggestions around for disabling with javascript. E.g. http://forum.java.sun.com/thread.jspa?threadID=755798&tstart=90 suggests: [codeblock] [/codeblock] And also from: http://chrisholland.blogspot.com/2004/11/banks-protect-privacy-disable.html [codeblock][/codeblock] which also requires adding class="disableAutoComplete" to each input field. These javascript methods are nothing more than a "html mask" - i.e. they still use autocomplete="off", but sets it in javascript to hide it from html validation (for the W3C validator). As expected, trying these javascript methods in firefox: autofill still works! This should be a concern not just for phpbbxs, but anybody who is building a site handling protected data - you want to minimise the risk to users accounts by ensuring autocomplete doesn't work, for that risk of users on public machines. Before anyone points it out, yes, Mozdev mention disableAutoComplete for XUL, but this is for themes/user side XML, so in all a pretty useless feature! If anyone knows a work around... ----------------------------------- Mighty Gorgon Tue 24 Oct, 2006 23:52 Re: Firefox and its dislike of Autocomplete = "off" ----------------------------------- You are right about what you are saying... but regarding ACP forms there is a solution... The problem is related to the name assigned in the ACP form which is the same assigned in the login form. If that field name is changed, than the auto completion problem should be avoided. When I have some free time, I'll try to change that field and see what happens. :wink: ----------------------------------- Vortex Wed 25 Oct, 2006 12:12 Re: Firefox And Its Dislike Of Autocomplete = "off" ----------------------------------- Easier than you think ;) I always used a mod (found on phpbbhacks.com) to fix that problem with straight phpBB, now I modified that mod to be applied in XS in a very simple way. Here's the mod: [spoiler] [code] ############################################################## ## MOD Title: Firefox Autocomplete Bypass ## MOD Author: Thoul < thoul@phpbbsmith.com > ( Jeremy Rogers ) http://www.phpbbsmith.com ## MOD Description: ## Prevents Firefox's overwriting of username and password fields ## in the admin user editor. ## MOD Version: 1.0.1 ## ## Installation Level: Easy ## Installation Time: 3 Minutes ## Files To Edit: ## admin/admin_users.php, ## templates/subSilver/admin/user_edit_body.tpl ## Included Files: N/A ## License: contrib/license.txt GNU General Public License v2 ############################################################## ## For security purposes, please check: http://www.phpbb.com/mods/ ## for the latest version of this MOD. Although MODs are checked ## before being allowed in the MODs Database there is no guarantee ## that there are no security problems within the MOD. No support ## will be given for MODs not found within the MODs Database which ## can be found at http://www.phpbb.com/mods/ ############################################################## ## Author Notes: ## ## This modification is not compatible with Categories Hierarchy. From my ## experience, it should not be needed when using Categories Hierarchy anyway, ## as that does not appear to be affected by Firefox's auto completion. ## ############################################################## ## Before Adding This MOD To Your Forum, You Should Back Up All Files Related To This MOD ############################################################## # #-----[ OPEN ]-------------------------------------- # admin/admin_users.php # #-----[ FIND ]-------------------------------------- # {L_USER_TITLE} # #-----[ BEFORE, ADD ]-------------------------------------- # # #-----[ FIND ]-------------------------------------- # # #-----[ BEFORE, ADD ]-------------------------------------- # # #-----[ IN-LINE FIND ]-------------------------------------- # name="username" # #-----[ IN-LINE REPLACE WITH ]-------------------------------------- # name="edit_username" # #-----[ AFTER, ADD ]-------------------------------------- # # #-----[ SAVE/CLOSE ALL FILES ]------------------------------------------ # # EoM [/code] [/spoiler] Instead of [b]admin/admin_users.php[/b] and [b]templates/subSilver/admin/user_edit_body.tpl[/b] just edit files [b][color=#00ff00]adm/admin_users.php[/color][/b] and [b][color=#00ff00]templates/ca_aphrodite(orwhatyougot)/admin/user_edit_body.tpl[/color][/b] Files are pretty the same, only search in a different directory and this will do the trick. I tried with my own site and it works perfectly. What do you think MG, do you approve this solution? Edit: Author Notes say that this mod is not compatible with CH which is implemented in XS. I never experienced any problems anyway, but thought it was a good thing to notice that ;) ----------------------------------- moreteavicar Wed 25 Oct, 2006 20:43 Re: Firefox and its dislike of Autocomplete = "off" ----------------------------------- :up: Thanks Vortex! Ah, I see... the Categories Heirarchy incompatibility is to do with predefined PHP browser variables like $HTTP_POST_VARS, (CH has changed this to $_POST). The problem will arise when you want to change a username - it will not be parsed because the form input field name has changed, and the this needs to be 'plucked' from the browser variables. So, the fix is just as easy as this mod itself, replace $HTTP_POST_VARS with $_POST! [codeblock]if( isset($_POST['edit_username']) ) { $_POST['username'] = $_POST['edit_username']; }[/codeblock] This mod is good to note. I've been making a conference registration system, and have similar problems - the only real firefox fix is to use different form field names to the ones originally used in initial registration / login. I'm worried also about sensitive data like passport number and address - but it now looks that only the input variable "username" triggers autocompletion! ----------------------------------- Vortex Wed 25 Oct, 2006 21:28 Re: Firefox And Its Dislike Of Autocomplete = "off" ----------------------------------- I understand, thanks for the trick... ;) I never encountered problem because I don't let users change their nick otherwise it would become a mess... when I need to change one I do it via SQL so that's why it all worked perfectly. ----------------------------------- Mighty Gorgon Sun 29 Oct, 2006 11:17 Re: Firefox and its dislike of Autocomplete = "off" ----------------------------------- Thanks... added to DEV package.