Closed Bug 1020701 Opened 10 years ago Closed 2 years ago

Don't modify hidden/disabled/readonly fields

Categories

(Toolkit :: Form Manager, defect)

Product:
Toolkit
Component:
Form Manager
Type:
defect
Priority:
Not set
Severity:
normal
Points:
2

Tracking

()

Status:
RESOLVED WORKSFORME

People

(Reporter: MattN, Unassigned)

References

(Blocks 1 open bug)

Details

They may still have @autocomplete and provide hints for which profile to use but we should never modify the value of them.
Flags: firefox-backlog+
Summary: Don't modify hidden/disabled fields → Don't modify hidden/disabled/readonly fields
Points: --- → 2
Whiteboard: p=2
(In reply to Matthew N. [:MattN] (PM me if requests are blocking you) from comment #0)
> They may still have @autocomplete and provide hints for which profile to use
> but we should never modify the value of them.

I can't tell - does this mean hidden fields could still auto-fill? There's a well-publicized phishing vector in that case: https://github.com/anttiviljami/browser-autofill-phishing

Looks like we are already doing that in form history/password manager. Please reopen if I'm mistaken.

Status: NEW → RESOLVED
Closed: 2 years ago
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.