424268 - Fx3 ignores autocomplete="off"

Status: RESOLVED DUPLICATE of bug 362576

(Toolkit :: Password Manager, defect)

Description

[Frédéric Buclin]

WFM with Firefox 2.0.0.12, broken with Firefox 3 beta 4:

Bugzilla has an admin page to administrate user accounts (editusers.cgi), which among others contains the 3 following fields: login name (a.k.a email address), real name and password. The password field is always empty by default (only set it if you want to change the user's password). If a user didn't set a real name, Fx3b4 sees the realname and password fields as empty and fills them with my own credentials despite both fields have autocomplete="off". As I was editing user's group memberships, I didn't notice Fx3 filled these 2 fields automatically, and my login and password have been saved with other changes, overriding the user's own credentials.

We added autocomplete="off" on purpose, because those fields are not about your own credentials, and we don't want to override them (as I did by accident). Fx3 should restore this behavior and correctly leave these fields alone.

CC'ing dolske and nominating per mconnor's suggestion on IRC.

Comment 1

[Jesse Ruderman]

The way you describe the bug, it sounds like a dup of bug 362576.  But that has been Firefox's behavior for years.  What's the real difference between Firefox 2 and Firefox 3 here?

Comment 2

[Jesse Ruderman]

(Maybe Firefox 3 is paying less attention to the field names, for example?)

Comment 3

[Justin Dolske [:Dolske]]

Correct, FF3 does not use the field names.

This is the same issue as 362576. The has been a historical... quirk... that autocomplete=off means that logins will not be *saved*, but they will still be *filled*.

Comment 4

[Frédéric Buclin]

Please also read bug 423966 comment 3 about why Firefox should not fills fields when autocomplete="off", and why it should take field names into account. How are we supposed to fix this problem in our precise case here? Overwriting other user's credentials because Firefox badly is not acceptable.