1188622 - Password incorrectly updating when logging in from the State Farm logout page

Status: NEW

(Toolkit :: Password Manager: Site Compatibility, defect, P3)

Description

[Walter Snyder]

Attachment: statefarm-login.jpg

User Agent: Mozilla/5.0 (Windows NT 6.0; rv:39.0) Gecko/20100101 Firefox/39.0
Build ID: 20150630154324

Steps to reproduce:

When logging in at State Farm, saved passwords work correctly when using https://www.statefarm.com/

Upon log out, State Farm resolves to https://oams.statefarm.com/auth/UI/Login?pageFlow=logout

Attempting to log back in from this page produces the error.


Actual results:

When attempting to log back in from https://oams.statefarm.com/auth/UI/Login?pageFlow=logout, Firefox accepts the saved password but also produces a popup asking "Would you like to update the saved password for 'statefarm.com'?" This popup is populated with a long series of characters and if the user clicks it without paying attention, the new password is stored. I was unable to duplicate the error in either Chrome or IE.

I have screen caps of the oams.statefarm.com page, the next page with popup box showing, and of my Mozilla password manager bundled as one graphic titled statefarm-login.jpg. I've passed this information on to State Farm's tech support, as well.

I'm also including the character string that was saved as the incorrect new password. I don't know how it will send but in the original, it's one long string with no breaks.

version=1&pm_fpua=mozilla/5.0 (windows nt 6.0; rv:39.0) gecko/20100101 firefox/39.0|5.0 (Windows)|Win32&pm_fpsc=24|1280|800|800&pm_fpsw=pdf|pdf|qt1|qt5|qt3|qt4|qt2|rpl&pm_fptz=-5&pm_fpln=lang=en-US|syslang=|userlang=&pm_fpjv=1&pm_fpco=1


Expected results:

Login with no additional popups or attempts to modify the password.

Comment 1

[Matthew N. [:MattN]]

I can reproduce this issue. Thanks for the report.

LoginManagerContent: Username field  <input type="text" data-validators="required" data-datatype="string" aria-required="true" data-required="true" class="default input-edit validate input-large" value="" name="IDToken1" id="userId" aria-describedby="server-error-message"> has name/value: IDToken1 / foo LoginManagerContent.jsm:654
LoginManagerContent: Password field (new) id/name is:  devicePrint  /  IDToken3 LoginManagerContent.jsm:707
LoginManagerContent: Password field (old) id/name is:  password  /  IDToken2 LoginManagerContent.jsm:708

We think this is a password change form since the #devicePrint is type=password too for some reason. We may be able to make a recipe for this but I'm not sure how that works with multiple fields off the top of my head.