294458 - password manager substitutes contents of read-only input field

Status: RESOLVED DUPLICATE of bug 361517

(Toolkit :: Password Manager, defect)

Description

[Ulrich Windl]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.7) Gecko/20050414
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; de-DE; rv:1.7.8) Gecko/20050511 Firefox/1.0.4

When password manager knows about a user-id and a password, it substitues these
values even in a read-only form field, and the user has no chance to fix that!
(I have a CGI application that allows log-in and changing the password for the
current user after being logged in. For that purpose, the user-name field is
preset read-only. Now when loggin in as a different user with the option for the
password manager not to remember those values, the password for displays the
remembered login name in the read-only field (not the current one)

This mean <input type="text" name="user" value="else" size="10" maxlength="80"
readonly="" /> is rendered as a read-only field with a content different to "else".

Reproducible: Always

Steps to Reproduce:
1. Make a form using password-manager-remembered values as readonly fields and
different default values
2. Display that form

Actual Results:  
The default values ("value" attribute) are not displayed. Instead the remembered
value is displayed.

Expected Results:  
For read-only input elements the specified value should be displayed.

Comment 1

[Phil Ringnalda (:philor)]

We certainly shouldn't be changing a readonly field, but this is really just a
special case of the problem that reopened bug 229762 - if the only thing we do
with a prefilled username is add the password if we know the username, then
readonly or not we won't be changing it.

Really awful awkward workaround: since we don't mess things up if you have more
than one username/password saved, saving another bogus one would let your
readonly page work, at the cost of having to use autocomplete to choose the
correct username when you really are logging in. 

*** This bug has been marked as a duplicate of 229762 ***

Comment 2

[Ulrich Windl]

(In reply to comment #1)
>(...), saving another bogus one would let your
> readonly page work, at the cost of having to use autocomplete to choose the
> correct username when you really are logging in. 

I had that in mind as well, but I suspected Firefox would let me choose which
value to substitute for the read-only field then ;-)

Comment 3

[Jesse Ruderman]

*** This bug has been marked as a duplicate of 361517 ***