357551 - Prompt before changing password when form has 2 password fields

Status: RESOLVED DUPLICATE of bug 394611

(Toolkit :: Password Manager, defect)

Description

[Chip Welch]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.0.7) Gecko/20060909 Firefox/1.5.0.7
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.0.7) Gecko/20060909 Firefox/1.5.0.7

I am having a problem with Password Manager not properly saving the Password information for my local county library site. It seems to work properly everywhere else. My library requires you to enter your name, library card number and password to log in. When I try to log in, all the fields are empty. When I re-enter my information into the fields on the web page, there is no prompt asking whether I want to save the information into Password Manager. If I enter the information on the web site, I can log into my library card record, but if I log out and try to log in again, all the fields are blank again. If I look for a new entry in my Password Manager, there is nothing there for this site. The bug is reproducable, since it always happens.

My library's login page can be found at:

http://scully.ccls.org/patroninfo

By the way,  I read the help pagementioned on the library web site. Firefox is set to allow sites to save cookies as instructed in this help page. I am not sure what the problem is, but would appreciate any help. Thanks!

Reproducible: Always

Steps to Reproduce:
1.Go to http://scully.ccls.org/patroninfo
2.Enter name, library card # and password
3.View user record
4.Try to go to website again to enter info 

Actual Results:  
Nothing is input into the name, card# or password fields by Password MAnager

Expected Results:  
Password Manager should enter name, library card # and password

Comment 1

[Adam Guthrie]

Did you ever see the dialog asking if you would like to save your password?

Comment 2

[Chip Welch]

(In reply to comment #1)
> Did you ever see the dialog asking if you would like to save your password?
> 

No.

Comment 3

[Justin Dolske [:Dolske]]

The basic issue here is that the form has two password fields, which results in two problems:

1) The password manager only stores a username and (single) password.

2) During a form submit, the password manager treats two different password fields as a password-change request.

I'm not sure this issue can be fixed, as it's probably indistinguishable from a password-change submission, which I would expect to be far more common. But, given that this code is currently being reworked, I'll leave this open for now.

Comment 5

[Justin Dolske [:Dolske]]

I'm mutating this slightly...

Login Manager isn't going to be modified to store multiple passwords for a login. It's an uncommon case that would complicate and break the normal 1-password cases. --> WONTFIX

However, I think there's a good argument to be made that a form with 2 password fields shouldn't be treated as a password-change form when the passwords differ... [If they're the same value, it may indeed be a password-change for a username already logged into the site] A form that doesn't ask for the new password twice is bad design (ie, prone to typos), and since there's no way for us to unambiguously determine if the password is being changed we should prompt the user.

Alternatively, we may want to assume the password is *not* being updated, and thus not prompt the user. If it was actually a password change, it'll be corrected when the user logs in via a normal form, replaces the autofilled password, and we update the stored login for that case.

Comment 6

[Thomas Bertels]

(In reply to comment #5)

> However, I think there's a good argument to be made that a form with 2 password
> fields shouldn't be treated as a password-change form when the passwords
> differ... [If they're the same value, it may indeed be a password-change for a
> username already logged into the site] A form that doesn't ask for the new
> password twice is bad design (ie, prone to typos), and since there's no way for
> us to unambiguously determine if the password is being changed we should prompt
> the user.

I think this is the best way to do it.