209423 - No prompt to save passwords when there are 2 <input type=password> with different values and no matching saved password

Status: RESOLVED WORKSFORME

(Toolkit :: Password Manager, defect)

Description

[Serge Gautherie (:sgautherie)]

User-Agent:       Mozilla/5.0 (Windows; U; Win95; en-US; rv:1.4) Gecko/20030529
Build Identifier: Mozilla/5.0 (Windows; U; Win95; en-US; rv:1.4) Gecko/20030529

(that's v1.4rc1)

An (private) account on this bank site may be needed to reproduce, and I can't
give you mine obviously...


Reproducible: Always

Steps to Reproduce:
1. Fill in the form at the given URL
2. Press Enter (image), to submit the form

Actual Results:  
I log in, without P.M. trigerring/asking me if I want to save the data;
and I would like to !



The "submit" action is to "click" an 'image'-type field;
I didn't see any javascript involved, unlike (related) bug 207147.

Could it be because there are two (2) 'password'-type fields in the form ??

Comment 1

[Serge Gautherie (:sgautherie)]

Addition to comment 0:

There is no 'autocomplete=off' (which I overrided anyway).

I have saved the page locally and started to reduce the testcase...
But should P.M. activate when going from a login page to a web site ?
If yes, I'll carry on building the reduced testcase;
if not, what can be done ?

Comment 2

[Serge Gautherie (:sgautherie)]

Typo in comment 1: read 'local' instead of 'login' "page".

Comment 3

[Serge Gautherie (:sgautherie)]

Addition to comment 0:

There is a [damn !]
[
<script language="JavaScript">
	//check for cookie
	if(!document.cookie){
		//redirect to No Cookies page
		window.location.href = '/security/registered/failed/ganc';
	}
</script>
]
on the page, so you need to enable the 'Read Cookies' for JavaScript in the
Pref. (or use Proxomitron or the like ;-))

NB: I tried (both v1.3.1 and v1.4rc1) without using my local Proxomitron, and
enabling the Pref.: same bug.

Comment 4

[Serge Gautherie (:sgautherie)]

Addition to comment 3:

[Mozilla/5.0 (Windows; U; Win95; en-US; rv:1.3.1) Gecko/20030425]

Bug was already there: probably "trunk, since the beginning" !?

Comment 5

[Serge Gautherie (:sgautherie)]

[Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.4) Gecko/20030624] (W98SE)

Confirming bug on W98SE.


--> Changing OS from W95 to W98, since I should not be running W95 anymore. <--


Another page with the "same" bug: I was able to log in without the P.M. activating.
<http://www.grenouille.com/ma_grenouille/login.php?url=%2Fma_grenouille%2F>

Comment 6

[Serge Gautherie (:sgautherie)]

[Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.5) Gecko/20030925] (v1.5rc2) (W98SE)

Re comment 1
>
> But should P.M. activate when going from a local (== <file:///xxx>) page to a
web site (== <http(s)://xxx>) ?
>
The answer is NO: I had to install a local Apache server to test this bug :->
(I don't know if it "should", but at least it _don't_.)

Re Description
>
> Could it be because there are two (2) 'password'-type fields in the form ??
>
The answer is YES: changing any of them to 'text' type is a "(server)
workaround" to this bug !

Re comment 5: I'll have to look closer at it to see if it's the same bug or not...

Comment 7

[Serge Gautherie (:sgautherie)]

Addition to comment 6:

I guess that the issue could be somewhere in WLLT_OnSubmit(...) defined at
http://lxr.mozilla.org/seamonkey/source/extensions/wallet/src/wallet.cpp#3904 !?

Comment 8

[Serge Gautherie (:sgautherie)]

Attachment: (Comment 6) Reduced testcase

Simply press the submit button of the case which you want to test :-)

Comment 9

[Serge Gautherie (:sgautherie)]

Re comment 5 (and 6)
about <http://www.grenouille.com/ma_grenouille/login.php?url=%2Fma_grenouille%2F>:

(not this bug:)
See bug 207147 comment 6.

Comment 10

[Serge Gautherie (:sgautherie)]

Attachment: (Comment 10) Reduced testcase (v2)

While the initial real-life case bug is with 2 passwords;

The testcase shows that a form with only a password field has the same bug;
by looking at the code, the culprit seems to be the 'OKToPrompt' variable.

Could someone write or point me to the specification of when the P.M. should
activate ?
Or is it up to the current maintainer' will: currently, nobody = anybody !?

I would say:
as soon as there is a (non empty !!?) password in the form,
unless the 'autocomplete' attribute (& override preference) prevents it.

But the actual code seems more complex...

In addition, could someone tell me what a field 'schema' is ?

Comment 11

[Serge Gautherie (:sgautherie)]

Adding (CC) dwitte@s_u, with his approval, for comment/advice.

Comment 14

[Peter Weilbacher]

This problem exists also on other platforms and at least with Firefox 2.0.0.x (didn't try trunk), too. So I guess this should be in Core, but as there is no good component for this in there, I leave it in the suite product.

Comment 15

[Serge Gautherie (:sgautherie)]

(In reply to comment #12)
> *** Bug 234753 has been marked as a duplicate of this bug. ***

bug 234753 comment1:
{{
Michiel van Leeuwen (email: mvl+moz@)   2004-02-18 08:42:40 PDT

there is a reason for this: usually forms with two passwords are signon forms.
Wallet decides that it doesn't want to store them yet, but only when you logon.

whether this is a good design is open for discussion :)
}}

Comment 16

[Serge Gautherie (:sgautherie)]

Removing defunct <https://www.fr.egg.com/...> URL.

*****

(In reply to comment #14)
> This problem exists also on other platforms and at least with Firefox 2.0.0.x
> (didn't try trunk), too.

[Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.9pre) Gecko/2008040302 SeaMonkey/2.0a1pre] (nightly) (W2Ksp4)

I think SM v2 has yet to replace "Wallet" to store passwords.

The testcase still fully applies.


[Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.8.1.13pre) Gecko/2008030203 BonEcho/2.0.0.13pre] (nightly) (W2Ksp4)
[Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.9b5pre) Gecko/2008032605 Minefield/3.0b5pre] (nightly) (W2Ksp4)

Does FF v2 still use "Wallet" too ?
I think FF v3, at least, does not anymore.

The testcase "2 passwords" form still applies,
but not the "1 password alone" form, which is WFM.

I suggest to either:
*File a separate bug for Firefox.
*Wait for SeaMonkey to switch to the new Password Manager code, then "morph" this bug.

Comment 17

[julien.t43+mozilla]

it seems problem still applies with Firefox 3 (tested with 3.0.5)

Comment 18

[Matthew N. [:MattN]]

It seems like we bail intentionally as we see it as a password change form but don't know which of the two passwords are the new one.

"Login Manager (parent): (no logins for this host -- pwchange ignored)"

Comment 19

[Chris Karlof [:ckarlof]]

Recipes could help with this.

Comment 20

[Matthew N. [:MattN]]

Not sure what I saw 6 months ago but the testcase works fine for me now in a new profile. The 2nd password field value is the one that gets saved.