293211 - JS causes Firefox to blank out previously saved passwords

Status: VERIFIED DUPLICATE of bug 257781

(Toolkit :: Password Manager, defect)

Description

[Jeremy M. Dolan]

This used to happen on a different site a while ago, and never realized why. Now
I think I know what's happening, and I'd say it's a bit of poor behavior on
Firefox's part.

Testcase is the forums at MacOSXHints. The login page is:
http://forums.macosxhints.com/usercp.php? [sic]

OK, so, first know that there is JS muckity-muck on their login form, so to have
Firefox save your password initially, you'll have to use a bookmarklet-type
thing to neuter the "onsubmit". I hope such a setup doesn't make the premise of
this bug invalid.

OK, so, without the onsubmit, Firefox correctly asks if you want it to remember
the password. Yes. Logout, and go to the login page again. Firefox correctly
pre-fills the Username and password field. Looks like everything's set, except...

You click "Log in". With the onsubmit still active on your page, it (for god
knows what reason) rewrites the password field to blank (you can visibly see it
change before the next page loads). You're logged in fine, but Firefox
(silently! SILENTLY!) updates your password to the form's new password, ie, "".
This is incredibly unhelpful. A few days later, you go to login, and your
password is gone, with no obvious reason why.

Yes, this form's behavior sucks, so it's partly the site's problem (depending on
what exactly the onsubmit does, I suppose). But I see no reason for Firefox to
ever silently null out a saved password on a user.

(Hope this report wasn't too ranty, just a little grumpy from having to do the
whole "e-mail me a link to change my password" thing for a 4th time on this
site! Keep up the great work.)

Comment 1

[:Gavin Sharp [email: [e-mail]]]

This is bug 257781, reopen if I'm missing something here.

*** This bug has been marked as a duplicate of 257781 ***

Comment 2

[Jeremy M. Dolan]

Indeed. Though I think most of the comments in that bug miss the point. Added a
little more info there.

Marking VERIFIED.