335719 - Password manager attempts to "remember" a form with a password input and an "EmailAddress" input when it shouldn't.

Status: RESOLVED DUPLICATE of bug 270558

(Toolkit :: Password Manager, defect)

Description

[Erik Brooks]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.7.12) Gecko/20050915 Firefox/1.0.7
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.8.0.2) Gecko/20060308 Firefox/1.5.0.2

Say you have URLs to a few records (e.g. user login profiles for a message forum) with four inputs...
- FirstName
- LastName
- EmailAddress
- Password (type="password")

...and one 'submit' button (document.forms[0].submit())

When you open a user account, the HTML will have a "value" attribute for the EmailAddress input for that user, e.g. value="[e-mail]".  It will also have a "value" attribute to for the Password input.  

If "Remember Passwords" is on, submitting this form will cause the Password Manager to prompt you and ask if you would like for it to "remember the password for this site".

What's worse is if you answer "yes", then for every subsequent login record you open, Password Manager will overwrite the EmailAddress input's default "value" attribute with what it thinks is the stored username (which it appears to derive from the EmailAddress input).

Firefox 1.0.7 did not exhibit this behavior.


Reproducible: Always

Steps to Reproduce:
1.  Turn on "Remember Passwords".  Open form.
2.  Complete form.
3.  Click 'submit' button.  

Actual Results:  
Password manager will prompt to remember the password for the site.  If you answer "yes" then any subsequent records you open, regardless of having a "value" attribute for the EmailAddress input, will then have the Password Manager's "remembered" value in-place of the EmailAddress default value.

Expected Results:  
Password manager will not prompt to remember the site.

Comment 1

[Erik Brooks]

Attachment: Sample HTML form to exhibit problem

Comment 2

[Phil Ringnalda (:philor)]

We don't have any way of telling that we shouldn't ask about remembering, since one text input next to a password input looks like any other, but at least Fx 2.0 won't overwrite the prefilled one, with either an accidentally saved one or with your own saved login from elsewhere in the site.

*** This bug has been marked as a duplicate of 270558 ***