137196 - unable to select multiple entries in change which password

Status: RESOLVED INVALID

(SeaMonkey :: Passwords & Permissions, enhancement)

Description

[Chris Abbey]

In the past I seem to recall that when PSM detected that I was changing a
password on a web form and asked me which of it's stored passwords I was
changing that you could use ctrl- and shift-click to select multiple entires and
have them all updated. I just tried to do this with the branch build's 0411
nightly rpms and it now only allows me to select one entry. If it is supposed to
be this way, then please mark this an RFE, otherwise it looks like something
regressed.

Comment 1

[R.K.Aa.]

Do you mean that you are unable to select multiple entries under
Tools->Password Manager->Stored Passwords ?

Or is this related to bug 84521, with several pages at same site being password
protected?

Comment 2

[Chris Abbey]

Neither.

Internally within IBM we use something called "common web authentication", the
same userid and password with several internal websites, such as w3.ibm.com,
w3.hr.ibm.com, w3.this.ibm.com, w3.that.ibm.com, etc... When you change your
password on the main cwa management site, password manager correctly recognizes
that you're just changed a password, and pops up a dialog asking which of the
many passwords it has stored you just changed. On this dialog you aren't able to
select more than one entry.

I used to think you could do this, but some co-workers convinced me it's never
done it and that it is an RFE. (marking as such)

Comment 3

[Michael Lefevre]

seems like a reasonable request, so confirming as an RFE.

Comment 4

[Stephen P. Morse]

I don't understand why you would want this.

Assume you went to a.x.com and saved the password, then the same for b.x.com and
for c.x.com.  Then you go back to a.x.com and want to change the password.  Well
perhaps they redirect you to d.x.com for the change form.  That's why password
manager doesn't know which form you are changing it for.  So it asks you.

But there is only one login that you are changing the password for.  So why
should you be able to select more than one password from this list?

Comment 5

[Chris Abbey]

Morse stated (emphasis mine): But there is *only one login* that you are
changing the password for.

Wrong. We're changing the password for a whole raft of different sites which all
use a common password management backend implemented via ldap over ssl to a
single server. When you change it at any one, you in reality change it for all.

He then asked: So why should you be able to select more than one password from
this list?

Because on this one form I just changed several dozen passwords. Password
manager seems to be smart enough to say "I know it was one of these..." and list
all the ones with the correct userid in the selection box (and possibly also the
correct old password?). It doesn't throw my entire list of stored user id's up
there, just a subset. Password manager is smart enough to figure that much out,
but then it is artifically limited to only allow me to change ONE of them. I'm
asking that this artifical limitation be removed.

I'm not talking about something theoretical here, btw... this is inplace TODAY
within IBM.

Comment 6

[Heikki Toivonen (remove -bugzilla when emailing directly)]

Reassigning to new module owner.

Comment 7

[Daniel Bernstein]

This seems to have gotten lost somewhere along the way. I don't see any updates
in the past year.
                                                                               
                                            
Actually, I'd like to go one further than allowing multiple sites to be updated
at once. I'd like to see a way to associate different sites to a single
"account". Thus, when I go to a new site which uses this centrally-managed
password, I'd like to see it offer to either remember a new password, or
associate it with such an account. And then when the time comes to change the
password, I go to the site that manages the password and update it, it would
only need to update the one "account" instead of giving me a list of accounts
where I don't remember which one I've updated and which I haven't.

Otherwise, what I've been doing recently was just deleting all internal web
sites from the password manager, and telling it to remember them anew with the
new password.

Comment 8

[Doron Rosenberg (IBM)]

cc:ing ibmers

Comment 9

[sciusta]

(In reply to comment #5)
> Morse stated (emphasis mine): But there is *only one login* that you are
> changing the password for.
> 
> Wrong. We're changing the password for a whole raft of different sites which all
> use a common password management backend implemented via ldap over ssl to a
> single server. When you change it at any one, you in reality change it for all.
> 
> He then asked: So why should you be able to select more than one password from
> this list?
> 
> Because on this one form I just changed several dozen passwords. Password
> manager seems to be smart enough to say "I know it was one of these..." and list
> all the ones with the correct userid in the selection box (and possibly also the
> correct old password?). It doesn't throw my entire list of stored user id's up
> there, just a subset. Password manager is smart enough to figure that much out,
> but then it is artifically limited to only allow me to change ONE of them. I'm
> asking that this artifical limitation be removed.
> 
> I'm not talking about something theoretical here, btw... this is inplace TODAY
> within IBM.

We (government organization with 10000 staff) got the same problem with LDAP,
IMAP, SMTP; lack of this feature causes trouble for users and user help desk

Comment 10

[Ole Asmussen]

Hi, is anyone working on this Bug, or is there any change in plan ??

Comment 11

[timeless]

[e-mail]: no. dveditz is the default assignee and the target milestone
is future.

the problem here is that wallet is using nsIPromptService.select which is an api
that should have been killed. it's been on my list of things to kill for a long
time :(.

To fix this, you'll want to visit the url for this bug, and replace the
promptservice call with something else that opens a new chrome dialog and then
handles the user response.

are you volunteering to work on this? i'll gladly find people to help you...

Comment 12

[Chris Abbey]

(In reply to comment #11)
> are you volunteering to work on this? i'll gladly find people to help you...

Timeless, if Ole doesn't take you up in this offer by sometime first of next
year I think I will. Hopefully about then I'll be free of another project that
has consumed all my hacking time and I'll be able to get back to Mozilla. (Not
that this should discourage anyone else from looking at this issue in the mean
time, because this looks to be one of the deepest changes I've ever made in
Mozilla, and it will likely take me quite awhile.)

Comment 15

[Robert Kaiser]

invalidated by switch to different UI for this.