431331 - Firefox auto-fills incorrect boxes with username and password

Status: RESOLVED WONTFIX

(Toolkit :: Password Manager, defect)

Description

[IBBoard]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9b5) Gecko/2008032619 Firefox/3.0b5
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9b5) Gecko/2008032619 Firefox/3.0b5

A longer conversation is available at http://forums.mozillazine.org/viewtopic.php?p=3355131#3355131.

Basically, if I get Firefox to remember a password for a domain then it will fill that username and password in at any opportunity, including some that are unsuitable and not related to the original. The most annoying occurrence is within the phpBB admin control panel where Firefox insists on putting your (the admin's) username and password in the boxes for forum password and image.

There used to be a similar issue with Firefox 2, but only if the box was called "password" (i.e. Firefox auto-filled all boxes of the same name on a domain) so it could easily be worked around by renaming the box. Firefox 3 seems to do it for any password box on the domain and then takes a stab in the dark and puts your username in the first box before the password.

Reproducible: Always

Steps to Reproduce:
1. Go to forums.hiveworldterra.co.uk
2. Sign in as ModTester with password "modtester"
3. Tell Firefox to remember the password
4. Go to forums.hiveworldterra.co.uk/password_autocomplete_1.html
5. Watch as Firefox fills the password box named "forum_password" and then puts your username in the box above it named "forum_image"
6. Go to forums.hiveworldterra.co.uk/password_autocomplete_2.html
7. Watch behaviour repeat
Actual Results:  
Firefox fills in boxes with username and password that should not be auto-filled (different name for password box, username appears to be determined as "the box just before the password box").

Expected Results:  
Firefox only fills in matching password boxes and doesn't take random guesses as to what the username field is. Bad matching like this should not lead to admins of forums having to delete their password every time they edit a user's profile.

Comment 1

[Justin Dolske [:Dolske]]

This is by design. On other sites, the differing field names are an accident and filling in passwords there is desired. It's an unfortunate ambiguity in the way form logins work, pushing the guesswork as to what fields are relevant and on what pages onto the browser.

See also bug 362576 for a workaround.