140262 - context menu for <input type=password> should include paste

Status: VERIFIED FIXED

(SeaMonkey :: UI Design, defect)

Description

[John P Baker]

From Bugzilla Helper:
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.0rc1)
Gecko/20020424
BuildID:    2002042406



Reproducible: Always
Steps to Reproduce:
1. Copy some text to clipboard
2. Go to http://bugzilla.mozilla.org/query.cgi?GoAheadAndLogIn=1 (or say
http://www.talk21.com)
3. Right click in password field

Actual Results:  Get navigation context menu

Expected Results:  should get same menu as username field with copy and cut disabled

Comment 1

[Boris Zbarsky [:bzbarsky]]

Confirmed, and to blake.

Comment 2

[Boris Zbarsky [:bzbarsky]]

Blake for real.  As a note, this is a one-line fix if we want to fix it.

Comment 3

[Boris Zbarsky [:bzbarsky]]

Attachment: The fix.....

Comment 4

[Mark Bitterling]

Boris, are you saying "if we want to fix it in the 1.0 branch" or "if we want to
fix this at all" ?

I hope that there is no question about whether or not this should be fixed in
the trunk.  Many registration based websites will email users long random
character passwords when they register and often the intruction tell users to
copy and paste the password.  It would be bad if Mozilla did not allow them to
use the context menu to paste.  

Personally I can not think of any downside of allowing the paste option in the
context menu for both branch or trunk.

Comment 5

[Boris Zbarsky [:bzbarsky]]

I meant "If we fix at all"....  I personally think it should be fixed (hence I
went to the trouble if making a patch), but some people have security issues
with allowing paste of passwords for some reason.....

While we're here, nominating for various things I think this should be fixed by.
 :) It's a trivial fix that makes password fields (which look just like text
fields) _act_ just like text fields when right-clicked.

Comment 6

[Paul Wyskoczka]

qa --> [e-mail]

Comment 7

[John P Baker]

... and you can already paste into password fields - you just have to remember to
use Ctrl/V when you can't find Paste in the menu.

Comment 8

[Mark Bitterling]

I understand why being able to Cut/Copy _from_ a password field could be
considered a security risk; however, I can not see how being able to Paste _to_
a password field could be a security risk.

If you are Pasting something then the data is already on your clipboard and is
easily accessible; what is the difference security-wise between pasting it from
the clipboard and manually viewing the clipboard and manually typing it in?

Comment 9

[rob cherny]

I really don't think a security concern is a good reason not to fix this. 
Particularly with regard to the notes above -- good points.  Pasting into and
also nonesense passwords that people are used to pasting in.  Plus, it is rather
unexpected behavior all security concerns aside.  Seriously.

Comment 10

[Samir Gehani]

Nav triage team: nsbeta1+, adt2 rtm

Comment 11

[Boris Zbarsky [:bzbarsky]]

*** Bug 141899 has been marked as a duplicate of this bug. ***

Comment 12

[Blake Ross]

Comment on attachment 81149 [details] [diff] [review]
The fix.....

sr=blake
what about input type=file?

Comment 13

[Boris Zbarsky [:bzbarsky]]

Input type=file is a little odd because we don't really have a way of
differentiating between the button and the textfield in it....  I'm not really
sure what we want to do there, and I'm loath to change our current behavior
without an explicit UI spec.

Comment 14

[Christian :Biesinger (don't email me, ping me on IRC)]

Comment on attachment 81149 [details] [diff] [review]
The fix.....

r=biesi

Comment 15

[Blake Ross]

checked in on trunk.

Comment 16

[Asa Dotzler [:asa]]

Comment on attachment 81149 [details] [diff] [review]
The fix.....

a=asa (on behalf of drivers) for checkin to the 1.0 branch

Comment 17

[Boris Zbarsky [:bzbarsky]]

Checked in on the branch.

Comment 18

[sairuh (rarely reading bugmail)]

vrfy'd fixed using 2002.05.06.0x-1.0.0 (branch, comm) bits on mac 10.1.4, linux
rh7.2 and win2k.

Comment 19

[Jaime Rodriguez, Jr.]

posthumus adt1.0.0+

Comment 20

[sairuh (rarely reading bugmail)]

...and vrfy'd fixed using 2002.06.10 comm trunk bits on linux rh7.2, win2k and
mac 10.1.5.