first popup-type authentication saved in password manager used to fill in all subsequent forms automatically.




15 years ago
15 years ago


(Reporter: ron adams, Assigned: Blake Ross)


Firefox Tracking Flags

(Not tracked)




(1 attachment)



15 years ago
User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.3a) Gecko/20021207 Phoenix/0.5
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.3a) Gecko/20021207 Phoenix/0.5

Any site that pops up one of those "enter password" type prompt boxes now allows
phoenix to save the password in the password manager. The first saved password
is then used to fill in all subsequent popup forms including non-password forms
(such as bookmarklet that comes with mozilla "Quick Searches -> Dictionary Lookup")

I dislike sending my saved router password to when i want to lookup a
word, but the form entry gets filled in automatically with my passwords. Not good.

Where is the password manager?

Reproducible: Always

Steps to Reproduce:
1. Go to:
2. Click on the first link on page "Restricted Information"
3. type in John as username
4. type in orange as password
5. Check "Save password blah blah" checkbox below so it saves it.
6. Enter site. Done with password saving part.
7. Use a bookmarklet that prompts user for input, such is the famous "Highlight
Text" bookmarklet that highlights the text a user inputs on a specific page. 
Bookmarket below, create a new toolbar bookmark, add this below as the URL

javascript:Qr=document.getSelection();if(!Qr){void(Qr=prompt('Enter word to find
in Merriam-Webster
8. should notice that the search says...
Suggestions for [first password in your database here]
9. be scared.
Actual Results:  
first password saved in password manager is filled into the prompt. Using the
above bookmarklet searches for that password on the page, and if not found,
displays the following in the statusbar...

"Found 0 occurences of '[password]'."

Can no longer use such bookmarklets.

Expected Results:  
let the user fill in the textbox.

Here is the bookmarklet, drag into your toolbar.
<a href="javascript:Qr=document.getSelection();if(!Qr){void(Qr=prompt('Enter
word to find in Merriam-Webster
'">Highlight Text</a>

Comment 1

15 years ago
I've tested this in Windows 2000, debian linux 3.0, the following builds. Both
reproduce the same failures.

Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.3a) Gecko/20021207 Phoenix/0.5
Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.3a) Gecko/20021207 Phoenix/0.5

Comment 2

15 years ago
Created attachment 110421 [details]
Javascript bookmarklet

You lost me between 5 and 6... after 5 I get a page that says the following:

"Restricted Document
You've successfully accessed this document as either user john with password
orange or user sheri with password apple.

Back To .htaccess Demo"

Where to from there? And I do not fully understand 7 either.

I managed to put a bookmarklet on the bookmarks tool bar, and, after cleaning
it up, it gives me a pop-up that tells me to enter a word to find in the
Merriam-Webster dictionary. I chose "debian" and it returned a list of other
words I might have been thinking of. Typing 'o' instead did not give me a
suggestion of "orange". Finally, just pressing OK with nothing in the field did
nothing either.

I'm turning your script into an attachment which hopefully will either be
dragable or the first link once you open the attachment will be. Using that,
please start at instruction 5 (or rather, 6) and redescribe how to do this.

Comment 3

15 years ago
Ok, the attachment worked. Click on it
and then you can drag the "Highlight Text" to your bookmarks toolbar.

Comment 4

15 years ago

*** This bug has been marked as a duplicate of 184436 ***
Last Resolved: 15 years ago
Resolution: --- → DUPLICATE

Comment 5

15 years ago
mass verifying.
You need to log in before you can comment on or make changes to this bug.